Ransomware Simulation: What to Expect from a Risk Assessment
A ransomware simulation is a controlled test of what happens after an attacker gets their first foothold in your environment. It is not a scan and it is not a tabletop exercise; it is a senior tester working outward from a single compromised account to see how far they can get, and whether your people and tools notice. Here is what to expect, start to finish.
Setting the rules
Every engagement starts with a scoping conversation: how the attack begins (a phished user, an exposed service, a compromised supplier), how encryption will be simulated on decoy data only, and a clear kill switch anyone can pull. We also agree which of your teams stay blind for realism and which get to watch, since the point is partly to test detection.
Foothold, escalation, and movement
From an initial foothold, we look for the paths attackers actually use. In a Windows estate that usually means Active Directory: weak service-account passwords, Kerberoasting, and misconfigured certificate services. We cover the detection and hardening for one of the most common in detecting and stopping Kerberoasting. Then we test lateral movement across the network to see whether segmentation holds or whether one laptop reaches everything.
What we measure: time to detect, time to contain, and time to recover, plus which controls actually fired, EDR, SIEM alerts, and network monitoring. A simulation that generates zero alerts is telling you something important about your visibility.
Impact, without the damage
Once we understand the blast radius, we test the things ransomware operators do before they pull the trigger: reaching business-critical shares and databases, attempting to delete shadow copies, and probing backup catalogs. All of it against decoy data, so you learn how resilient your recovery really is without any real disruption.
What you walk away with
You get a prioritized backlog across identity hygiene, segmentation, EDR tuning, and backup isolation, plus a clear narrative of the single most dangerous path we found and how to close it. This pairs naturally with an internal penetration test, which asks the same assume-breach question about your wider network.
Curious how far an attacker could get from one compromised account in your environment? Our ransomware risk assessment is built to answer exactly that, book a scoping call.
