Most of the damage in a ransomware incident is decided in the first hour, and a surprising amount of it is self-inflicted. Not by the attacker, but by smart people reacting on instinct. They reboot the machine to make the problem go away. They start deleting files. They quietly try to handle it without telling anyone, hoping it stays contained. Every one of those instincts makes the situation worse, and they all happen inside the first sixty minutes.
I lead a firm that does incident recovery, which means I get the call when systems are already locked and a ransom note is already on the screen. The single biggest predictor of how that story ends is not the strength of the malware. It is whether the first hour was spent containing the incident or compounding it. According to the Sophos State of Ransomware 2025 report, which surveyed 3,400 organizations hit in the previous year, 53% now recover within a week, up from 35% the year before. The companies in that faster group tend to share one thing: they knew what to do in the first hour. Here is what that hour should look like.
First, the three things not to do
Before any action, know what to avoid, because the wrong move here is hard to undo.
Do not power off the affected machines. It feels like pulling the fire alarm, but shutting a system down erases the volatile evidence held in memory that responders need to understand the attack, and in some cases it triggers further damage on reboot. The federal guidance from CISA is explicit on this point: disconnect from the network instead of powering down whenever that is possible.
Do not delete anything, including the ransom note. That note, the encrypted files, and the system logs are the evidence that tells you which variant you are dealing with, how the attacker got in, and whether they stole data before locking it.
Do not pay, negotiate, or contact the attacker in the first hour, and do not discuss the incident over your normal email or chat. After breaking in, attackers frequently watch the very systems they compromised, so your internal messages about the response may be read by the people who attacked you.
Minutes 0 to 15: contain the spread
The first priority is stopping the encryption from reaching anything it has not reached yet. Identify which systems are affected and isolate them immediately. In practice that means unplugging the network cable, disabling Wi-Fi, and, if several machines or segments are involved, taking the network offline at the switch level rather than chasing individual devices. Speed matters more than precision here. Ransomware spreads in minutes, and the goal of these first fifteen is simply to cut off its path.
If you genuinely cannot isolate a critical machine from the network any other way, then, and only then, do you power it down. That is the one exception, and it exists because an uncontained spread is worse than the lost evidence.
Minutes 15 to 30: activate the plan and change how you communicate
Once the spread is contained, activate your incident response plan and put one person in charge as the incident lead. This is not the moment to improvise roles. Then move your communication off the compromised network entirely. Use phones, cell phones, or a messaging channel that does not touch the affected environment, because, as CISA warns, coordinating your response on a network the attacker may still be watching can tip them off and push them to deploy faster or destroy more. Out-of-band communication is not paranoia. It is standard practice.
Minutes 30 to 45: call the people who protect you
This is where many businesses lose money they did not have to lose. If you carry cyber insurance, your carrier is one of your very first calls, often before you bring in any outside technical help. Most policies require you to use their approved response firms, and acting outside that panel can reduce or void your coverage. Calling them early protects both the response and the claim. Alongside the carrier, engage your legal counsel, which establishes privilege over the investigation and starts the clock on any notification obligations, and bring in your managed security provider or incident response team to run the technical containment and forensics.
Minutes 45 to 60: scope the damage, but do not restore yet
With the bleeding stopped and the right people engaged, the last stretch of the hour is about understanding what happened, not rushing to fix it. Identify every encrypted system. Look for signs that data was copied out before it was locked, because modern ransomware groups routinely steal data first and threaten to publish it, a tactic known as double extortion. Protect your backups by isolating them, since attackers specifically hunt for backups so they can encrypt those too. And resist the urge to restore from backup right now. Restoring into an environment that is not yet verified clean simply reinfects you, and you spend the win you just earned.
The truth about the first hour
Here is what every part of this comes back to. You cannot improvise an incident response plan while your systems are encrypted. The relationships are what matter most: the insurance contacts, the legal counsel, the response team, the isolated backups, the named incident lead. They have to exist before the attack, not after. The reason the Sophos data shows companies recovering faster and at lower cost, with the average recovery cost excluding ransom falling to $1.53 million overall and to around $638,000 for smaller organizations, is that more of them prepared in advance. The first hour is not really about reacting well. It is about having already decided what you would do.
For businesses across the CSRA
The hard part of this is not understanding the steps. It is being honest about whether your business could actually execute them under pressure at 4 p.m. on a Friday. For the companies we work with around Augusta and the CSRA, that is exactly the gap we close before an incident ever happens: a written response plan, defined roles, tested backups, and a number to call that someone will actually answer.
If you are not certain your business could survive its first hour with ransomware, that is worth fixing now, while it is still hypothetical. You can learn more about how we help at alchanistech.com.
The attacker decides when the clock starts. You decide whether you are ready when it does.
