Assumed Breach Assessment
Testing that starts from the inside: a compromised user or workstation, and the question of how far an attacker can get from there before anyone notices.
Service 11
Ransomware readiness assessment
Ransomware is rarely a single piece of malware. It is a human-operated intrusion that ends with encryption and extortion. We emulate the steps that come before, safely, so you find out whether your defenses and your recovery plan hold up before someone else tests them for you.
Overview
The problem we are solving
Modern ransomware groups follow a well-documented playbook: gain access, harvest credentials, reach domain-level privilege, disable defenses, locate and destroy backups, exfiltrate data, and only then deploy encryption. Each step is an opportunity to detect and stop them.
This assessment emulates that playbook against your environment using the techniques publicly attributed to active ransomware groups. No real ransomware is used and nothing is encrypted. Instead, each stage is demonstrated safely and documented, along with whether it was detected.
It also looks at the part of ransomware defense that testing often skips: whether backups are actually isolated from the domain an attacker would control, whether recovery has been rehearsed, and whether your incident response plan names who does what in the first hours.
Coverage
What we assess
Scope is agreed up front; these are the areas an engagement typically covers.
- Initial access exposure
- The entry points ransomware operators favor: exposed remote access, VPN and edge devices, phishing susceptibility, and credentials already circulating online.
- Privilege escalation & spread
- How quickly a foothold becomes domain admin, and how widely an attacker could push a payload using the tools your own admins rely on.
- Defense evasion
- Whether EDR, antivirus, and logging can be tampered with or disabled from the privileges an attacker would hold, and whether that tampering is noticed.
- Backup & recovery resilience
- Whether backups are reachable, deletable, or encryptable from compromised domain credentials, and whether offline or immutable copies actually exist.
- Data exfiltration
- Whether large-scale data staging and exfiltration would be blocked or detected, since extortion now often relies on stolen data rather than encryption alone.
- Incident response readiness
- A review of your response plan, contacts, and decision points, checked against what the technical testing showed would actually happen.
Methodology
How the engagement runs
-
01
Scoping & safety
Agree objectives, starting foothold, safety controls, and explicitly prohibited actions. No destructive or encrypting actions are ever performed.
-
02
Playbook emulation
Stage-by-stage emulation of ransomware operator techniques, from foothold through privilege escalation, defense evasion, and lateral movement.
-
03
Backup & recovery review
Testing whether backup systems and copies are reachable from compromised credentials, alongside a review of recovery procedures and rehearsal history.
-
04
Pre-impact verification
Demonstrating that an attacker would have been in position to deploy ransomware and exfiltrate data, stopping short of either.
-
05
Reporting
A stage-by-stage view of where the attack could have been stopped, what was detected, and the fixes that most reduce ransomware risk.
-
06
Debrief & validation handoff
A walkthrough with IT, security, and leadership, with validation steps for every finding so your team can confirm fixes on its own.
Deliverables
What you receive
- Stage-by-stage attack narrative from foothold to pre-impact position
- Detection and response gap analysis mapped to MITRE ATT&CK
- Backup and recovery resilience findings
- Prioritized remediation roadmap focused on ransomware risk reduction
- Validation steps for every finding, so your team can confirm and close out each fix on its own
- Executive briefing suitable for leadership and board reporting
Aligned to
- MITRE ATT&CK
- CISA #StopRansomware Guide
- NIST IR 8374 (Ransomware Risk Management)
Questions
Frequently asked
Do you use real ransomware?
No. Nothing is encrypted, destroyed, or exfiltrated. Each stage is demonstrated safely, and the engagement stops at the point where a real operator would have deployed their payload.
Will this help with cyber insurance?
Many insurers ask detailed questions about ransomware controls such as MFA, EDR, privileged access, and backup isolation. This assessment gives you tested evidence for those answers rather than assumptions.
How is this different from an assumed breach assessment?
An assumed breach assessment pursues whatever objectives you choose. This assessment is built around one specific threat: it follows the ransomware playbook and adds backup, recovery, and response readiness to the scope.
Related
Often scoped together
Red Team & Adversary Emulation
Goal-based, stealthy campaigns that emulate a real threat actor end to end, measuring whether your people, processes, and tooling detect and stop an intrusion, not just whether one is possible.
Get started
Ready to scope ransomware readiness?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 sales@infocus-security.com