Office team
The cable gets pulled in 40 seconds
In the second drill, staff disconnect and call IT in under a minute, down from six minutes in the first.
Coming SoonSite editionSecurity awareness
Ransomware Fire Drill
A hands-on ransomware fire drill on a disposable Hyper-V desktop: staff see a harmless simulated attack (training files renamed, a ransom note appears), practise the first five minutes (disconnect, report, do not pay, do not switch off), and IT practises the restore. Timed, debriefed, and safely contained.
The problem
Everyone knows ransomware exists; almost nobody has rehearsed what to do when the note appears. The first minutes decide the damage: pulling the network cable, calling the right person, not paying, not wiping evidence. Tabletop exercises help managers talk it through, but staff never practise with their hands, and small offices never test that the backup actually restores.
Features
- A disposable training desktop cloned in seconds from a template on an isolated Hyper-V switch with no route anywhere
- A harmless simulator that only renames copies of dummy files inside the training VM and shows a ransom note; it uses no encryption and refuses to run outside a marked drill VM
- Staff practise the first five minutes with a timer: disconnect (a virtual cable pull), report (the Report Button), photograph the note, do not pay and do not switch off
- IT practises the recovery in the same drill: restore the VM's data from Snapshot Backup and time it
- A manager track runs alongside with timed injects (the press calls, the attacker emails, the insurer needs a reference) in the style of the CISA packages
- A debrief report with times, decisions and the gaps to fix, kept as evidence for insurers and NIS2 incident-readiness
How it works
Safe by construction
- Training VMs come from a differencing-disk template on an isolated switch; the drill refuses to start if a route to a real network is detected
- The simulator renames and marks dummy files only; it contains no encryption and no spreading code
- It checks for a signed drill marker in the VM and exits if it is not inside one
- The whole drill resets to its starting snapshot in seconds
The people side
- Staff track: recognise, disconnect, report, preserve evidence, wait for IT
- Manager track: timed injects for communications, insurer, legal and regulator decisions
- Roles and contact cards printed from the drill so the real plan is on paper
The recovery side
- IT restores the training data from Snapshot Backup and the time to recover is measured
- Restore verification by checksum, so 'the backup works' is proven
- Lessons feed into the incident plan and the Academy
Who it is for
IT admin
Finding out the backup was incomplete
The recovery leg shows a shared folder was never in the backup set; it is fixed before a real incident.
Managing director
Insurance renewal
The debrief report from two drills goes with the cyber insurance renewal as evidence of incident readiness.
Benefits
- Staff rehearse the first five minutes with their hands, not just a slide
- IT proves the backup restores, with a measured time
- A debrief pack insurers and auditors accept
Built to be trusted
- Nothing in the drill can reach a real network or a real file
- The simulator contains no encryption and exits outside a marked drill VM
- Every drill resets to its exact starting state
Good to know
A drill is only as good as the follow-up; the debrief lists the gaps but people have to fix them. The simulation is deliberately harmless and therefore less dramatic than real ransomware, which is the right trade. Tabletop content draws on the free CISA and NCSC material, which is excellent and should be credited.
Under the hood
For technical readers
- C# 13 on .NET 9, WinUI 3
- Hyper-V differencing-disk templates and isolated switches
- Signed, harmless rename-and-note simulator gated on a drill marker
- Snapshot Backup and checkpoint reset
- Inject engine and Reports
Related products
Works well with
Coming SoonSite edition
Golden Image Studio
System & diagnostics
Set up Windows once, perfectly, then put that exact setup on every other machine in minutes.
ReadyPro edition
Clone & Deep Rename
Virtualization
Cold clone with verified copy or instant ReFS block clone, and a reversible rename of VM, folder and disks.
Coming SoonIn developmentPro edition
Checkpoint Chain Doctor
Virtualization
Visual differencing-disk chains with sizes, orphan detection and offline repair.
Coming Soon
Notify me when Ransomware Fire Drill is ready
Ransomware Fire Drill is planned for a later release. Leave your e-mail address and we will write once when it becomes available. We ask you to confirm your address first, and you can unsubscribe at any time.
Questions now? Contact our team.