It is 2:47 AM. A KSA hospital’s primary domain controller is showing the early signs of ransomware encryption. File extensions are changing. Active Directory replication is failing. EDR alerts are cascading. The IT director on call has 60 minutes before this becomes a 6-month catastrophe instead of a 2-day disruption.

Here is what those 60 minutes look like — when done right and when done wrong.

Minute 0-5: Detection and confirmation

Done wrong: Confusion. “Is this real? Is this a false positive?” Five minutes of debate.

Done right: EDR detects suspected encryption activity; alert flows to SIEM; SOC analyst confirms within 90 seconds based on file-modification rate, AD replication failure pattern, and process-tree characteristics. Confirmation triggers the playbook.

Minute 5-15: Initial containment

Done wrong: Power off affected systems immediately. Volatile evidence (memory, encryption keys) is lost.

Done right: Network-isolate affected systems but keep them powered. Memory snapshots captured for forensic team. EDR contains laterally-spreading processes. Critical assets get protective isolation.

Minute 15-30: Notification cascade

Done wrong: IT director calls CIO. CIO calls CEO. CEO asks questions. Lots of questions. Every minute spent answering is a minute attackers spread.

Done right: Pre-engaged DFIR retainer activates. Notification matrix executes per playbook: technical incident commander (IT director), executive incident commander (CIO), legal counsel, communications lead, regulator coordinator. Each has a single role.

Minute 30-45: Forensic preservation

Done wrong: Affected systems are rebuilt before investigation; the attack vector is lost.

Done right: Disk imaging started for affected systems. Network captures from this period preserved. Cloud logs frozen. Backup integrity validated. The forensic chain of custody begins.

Minute 45-60: Initial scope assessment

Done wrong: “It’s just one server.” Twelve hours later, ransom note appears across 200 endpoints.

Done right: EDR data analyzed for lateral movement indicators. Identity logs reviewed for compromised credentials. Cloud audit logs scanned for suspicious admin activity. Initial scope estimate within ±20% accuracy.

What separates the patterns

A pre-engaged DFIR retainer. A rehearsed playbook. A tabletop exercise within the last 12 months. None of these things exist in time-critical situations unless they exist before time-critical situations.

→ DFIR retainer → | Managed SOC → | Vulnerability Management →