Hutch

Ransomware prevention and recovery

We measure with real tests on your network how many days you would hold out against a ransomware attack and how to get back to work sooner. We find the doors the gangs use and tell you which to close first.

Four pillars measured on your network through the LOP BOX: prevent, detect (benign Atomic Red Team), resist (a real timed restore) and recover (a tabletop exercise with leadership). Output: a score per pillar, days to withstand and to recover, and a roadmap.

Duration: 3 to 4 weeks
Start: We agree on the start date when we close the scope

from US$5,900

one-time payment

Request my Hutch

Is it urgent? Write to us and we will set the start as soon as possible.

It is for you if

Ransomware worries you and you want to really know how many days you would hold out.
You have an internal network, servers and backups you never tested restoring.
Your insurer or a customer asks you to prove you are prepared.
You would rather measure it with real tests, not a questionnaire.

What we measure

Prevent: we close the doors the gangs use before they get in.KEV-prioritized patching, MFA, Active Directory hardening and network segmentation.

Detect: we test whether anyone would notice, without doing harm.Real attacker techniques run benignly (Atomic Red Team) to measure whether your EDR alerts and how long it takes someone to notice.

Resist: we check that your backups restore, against the clock.Immutable backups and a real timed restore, to measure the days to recover.

Recover: we rehearse the plan with your leadership before you need it.Response plan and a tabletop exercise with leadership, with clear roles and decisions.

To reach your network you install the LOP BOX and switch it off when we finish.Internal access through the LOP BOX: an encrypted outbound tunnel, no inbound ports opened.

How we work

Week 0
Scope and access
We agree on the scope and you sign. You install the LOP BOX so we can reach your network.
Signed authorization, rules of engagement and LOP BOX deployment with an encrypted outbound tunnel.
Week 1
Prevent
We measure where an attack would get in and what to close first. If something is serious, we tell you the same day.
Exposure, KEV patching, MFA, Active Directory hardening and segmentation. Same-day notice for a critical finding.
Week 2
Detect
We simulate a harmless attack to see whether anyone notices and how long it takes.
Benign Atomic Red Team: we measure whether the EDR alerts and the time until someone sees it.
Week 3
Resist and recover
We restore your backups against the clock and rehearse the plan with your leadership.
Real timed restore from immutable backups and a tabletop exercise with leadership.
Week 4
Report and wrap-up
We hand you the score per pillar, the days you would hold out and the roadmap, and go through it together.
Report with a score per pillar, estimated days to withstand and recover, and a prioritized roadmap. 30-minute wrap-up meeting.
At 3 months
Re-measurement
We measure again to see how much you improved with what you closed.
Re-measurement of the four pillars at 3 months, to confirm the improvement.

What you get

A score per pillar, how many days you would hold out and how long recovery would take.
Score per pillar, estimated days to withstand and to recover.
A roadmap of what to close first, ordered by what protects you most.
Roadmap prioritized by risk reduction, with estimated effort.
Timed proof that your backups restore.
Record of the real timed restore and its total time.
A response plan rehearsed with your leadership.
Response plan with roles and decisions, tested in the tabletop exercise.
A dashboard where you see the status of every point on the roadmap.
Dashboard with the status of each point: open, in progress or closed.

See a sample report

Scope limits

Includes

1 internal network, through the LOP BOX.Access to 1 internal network through the LOP BOX, with no inbound ports opened.
The four pillars: prevent, detect, resist and recover.Measurement of the four pillars, with a score and estimated days.
A real timed restore of your backups.A real timed restore from immutable backups.
A tabletop exercise with your leadership.A tabletop exercise with leadership, with a response plan.

Does not include

It is not a full audit of your apps. That is what Dig, Rabbit Hole and Warren are for.No full application pentest: that is an audit (Dig, Rabbit Hole or Warren).
We do not pay the ransom or negotiate with attackers.No ransom payment or negotiation. Preparation and measurement, not response to an ongoing incident.
We do not install a new antivirus: we measure the one you already have.No new EDR deployment: we measure the detection of the one already in use.

The price is “from”: the final scope depends on the size of your network. We fix it before signing.

Questions before you buy

How is it different from a maturity questionnaire?

A questionnaire asks what you think you have. We measure it with real tests on your network: whether your antivirus alerts, whether your backups restore and how long it takes.

Is it dangerous to simulate an attack on my network?

No. We use real techniques in a benign way, agreed with you and without harm. We encrypt nothing and do not touch your data.

Would you survive ransomware?

We measure it with real tests on your network, 3 to 4 weeks, and tell you what to close first. We measure again at 3 months.