Ransomware recovery
How to Evaluate a Ransomware Recovery Plan
A successful backup job proves that a job ran. A recovery exercise proves whether your business can work again.
Open the checklistPillar · Incident Readiness
Incident Readiness
Security in a regulated environment comes down to one question: could you detect, contain, and report an incident fast enough to satisfy your mandate and your board. In 2026 the incident may start in a browser extension, an agent's token or a poisoned package, and it moves at machine speed, so containment has to be pre-approved and measured in minutes.
Reviewed October 5, 2026 · Standards in force
The buyer's problem
Stolen credentials, unpatched internet-facing systems and third-party access still drive most breaches. What changed is speed and the new paths in. Microsoft says weaponization now follows discovery in well under 24 hours. Rogue browser extensions lift session tokens without touching the endpoint agent. Password-spray campaigns run millions of attempts against cloud sign-in. And an agent control plane can hand an attacker every token it stores at once. Playbooks written for a laptop infection do not cover those cases, and a thin-staffed team cannot improvise them at two in the morning.
What incident readiness actually requires
- Do our playbooks cover AI? Write specific runbooks for shadow AI data exposure, agent hijacking through prompt injection, and credential exfiltration through tool calls.
- Can we contain automatically? Pre-approve actions your tooling can take without a meeting: revoke agent tokens, disable a connector, isolate a host, block an egress destination.
- Can we mitigate before the patch? For an exploited edge device, know who can apply a vendor workaround and restrict management interfaces within hours, then hunt for persistence.
- Do we know every notification clock? Map the SEC, state, sector, EU and contract deadlines that apply to you, and who decides materiality, before the incident.
- Could we prove our response? Keep timestamped decisions, containment actions and evidence so a board, auditor or regulator can see what you did and when.
- Can our SOC triage at machine speed? Let automation enrich, deduplicate and score alerts, and auto-execute pre-approved containment for high-confidence detections, with a human reviewing within minutes rather than approving first.
- Do we measure mean time to contain? Track MTTC per incident type, not just mean time to detect. Set targets in minutes for identity and agent incidents and report them monthly.
- Can we revoke a non-human identity fast? Know how to disable an agent, rotate its secrets and invalidate its tokens across every connected service, and rehearse it.
- Could we beat an AI-driven intrusion? DIVD says an AI agent went from a hijacked helpdesk session to root in seconds. Assume human-speed approval loses; pre-approve isolation for high-confidence detections and segment helpdesk and ticketing systems.
- Did patching remove the attacker? No. After upgrading an exploited gateway, hunt for web shells, unknown superuser accounts, unexpected scripts and configuration exfiltration, and rotate any credentials stored on the appliance.
Response clocks and directives in force on October 5, 2026
- SEC Form 8-K Item 1.05 Public companies disclose a material cybersecurity incident within four business days of determining materiality. Industry groups have asked the SEC to rescind it; as of August 2026 no rescission had been proposed.
Compyl SEC guide ↗ - CIRCIA final rule (pending) Expected from CISA this fall. The statute sets 72 hours to report covered cyber incidents and 24 hours to report ransom payments across 16 critical infrastructure sectors.
Federal News Network, Sept. 29, 2026 ↗ - CISA BOD 26-04: Prioritizing Security Updates Based on Risk Issued June 10, 2026 for federal agencies, effective December 7. Actively exploited, automatable flaws that give partial control of internet-facing systems get three days to fix.
CISA ↗ - NIS2 Directive (EU) An early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours, and a final report within one month.
NexCyber NIS2 reference ↗ - HIPAA Breach Notification Rule Notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach of unsecured protected health information.
HHS ↗ - CISA Cybersecurity Awareness Month 2026 This year’s Securing the Next 250 campaign adds two baseline actions to the usual basics: have and use an incident response plan, and prepare for disruptions.
CISA ↗ - MITRE ATT&CK T1110.003 Password Spraying The reference technique for spray detection and mitigation: block legacy authentication, use MFA and monitor failed sign-ins across accounts.
MITRE ATT&CK ↗ - CISA KEV: Zammad CVE-2026-102489 and CVE-2026-102490 Added October 2, 2026 with a federal remediation deadline of October 5, binding on federal civilian agencies under CISA's operational directive. Exploited in the wild; DIVD reports an AI agent chained them to root. Zammad recommends 7.2.0.
CISA ↗ - CISA KEV: Citrix NetScaler CVE-2026-88779 Added October 4, 2026 with a federal remediation deadline of October 7, binding on federal civilian agencies. Exploited in targeted attacks against appliances configured as SAML SP or IdP; fixed in 14.1-73.41 and 13.1-64.28.
NVD ↗
Machine-speed incident playbook matrix
B3 recommended mean-time-to-contain targets, not regulatory deadlines. Use them to set the timers in your tabletop and your SOC automation.
| Threat vector | First signal | Automated containment | MTTC target |
|---|---|---|---|
| Non-human identity hijacking (agent or service token) | Token used from a new network, unusual role-policy change or new tool-server registration | Disable the identity, revoke tokens, rotate stored secrets, freeze role-policy changes | Within 15 minutes |
| Agent hijacking (prompt injection) | Tool calls outside the agent’s baseline or task scope | Pause the agent, revoke its tokens, quarantine the source content | Within 15 minutes |
| Rogue browser extension stealing sessions | Extension with new permissions, session reuse from an unknown device, EDR silent | Force-remove the extension by policy, revoke all sessions, reset credentials, block the extension ID | Within 30 minutes |
| Automated password spraying | Many low-rate failed sign-ins across accounts from rotating IPs, legacy-auth attempts | Block legacy authentication, apply smart lockout and conditional access, force reset on any success | Within 30 minutes |
| Software supply-chain compromise (package or update) | Malicious version advisory, unexpected post-install script, new outbound connection from build hosts | Pin to last known-good version, block the package, rotate CI/CD and developer tokens | Within 2 hours |
| Credential exfiltration via tool calls | Secrets or tokens appear in outbound requests or logs | Rotate exposed secrets, block the egress endpoint, review every action the identity took | Within 1 hour |
| Exploited edge appliance or AI control plane before a patch | KEV listing or vendor advisory confirming exploitation | Apply the workaround, restrict management interfaces, preserve logs, hunt for persistence | Same day |
| Shadow AI data exposure | DLP or CASB alert on uploads to unapproved AI domains | Block the destination, revoke the session, open a data-exposure review | Within 1 hour |
| AI-driven exploit chain (agentic intrusion) | Session reuse on a helpdesk or web app followed by new processes and privilege escalation within seconds | Auto-isolate the host, kill sessions, block lateral paths by segmentation, preserve memory and logs | Within 5 minutes |
| Sandbox or hypervisor escape | Vendor advisory or unexpected host-level activity from a sandbox or microVM | Pause untrusted workloads, rotate host and workload credentials, restrict sandbox egress | Same day |
| Edge gateway exploitation (NetScaler) | Appliance crashes, new admin accounts, outbound connections from the appliance or access to its configuration file | Upgrade to a fixed build, hunt for web shells and rogue superusers, rotate stored credentials, review VPN sessions | Patch within 72 hours; hunt same day |
| Peripheral portal probing | Enumeration patterns, unusual request rates or bulk record reads from a partner, broker or field-staff portal | Rate-limit or block the source, force reauthentication, review the authentication path and scope of exposed records | Same day |
Tabletop exercise framework
- Run it quarterly, with a real clock. Inject the first signal, then time detection, the containment decision and the first notification draft.
- Include an AI scenario every time. Alternate shadow AI exposure, agent hijacking and vendor-side AI incidents.
- Bring legal and communications. The materiality call and the notification wording are where most tabletop time is actually lost.
- Close with evidence. Every exercise should leave timestamps and decisions you could hand to an auditor.
- Rehearse a non-human identity incident. Inject a stolen agent token and time how long it takes to find every service that trusts it and revoke it.
- Measure automation, not just people. Record which containment steps ran automatically, which waited for approval, and how long each wait took.
This is one of the six domains in the readiness assessment. See where your organization actually stands.
Take the readiness assessmentNetScaler gateways are under attack again. The deadline is Wednesday.
CISA added CVE-2026-88779, a NetScaler SAML memory overflow, to KEV on October 4 with a federal deadline of October 7. It follows September's zero-days CVE-2026-88771 and CVE-2026-88772, which attackers used to plant web shells. The federal deadline for the Zammad flaws an AI agent chained to root is today.
Test now: Search your NetScaler configuration for add authentication samlAction or samlIdPProfile. If either appears, upgrade before Wednesday and hunt afterward.
Read the October 5 brief →
Watch
Public talks, with a buyer-side read.
Curated public-sector and regulated-technology speeches, each with buyer-side commentary.
Loading…