Stopping ransomware in real time: Live simulation of detection, containment and recovery

Ransomware continues to be one of the most disruptive and financially damaging cyber threats facing organisations today. Despite widespread awareness, many organisations still do not know whether their current security controls, configurations, and response processes would actually prevent or contain an attack before significant damage occurs.

This session presents a simulated ransomware scenario designed to demonstrate how a well-configured security environment can detect, stop, and contain an attack in real time, as well as how effective recovery processes enable organisations to restore operations quickly. The focus is on showing what actually happens during an attack and how different layers of security interact under real conditions.

The presentation will walk through the stages of a typical ransomware attack (we will execute ransomware on a demo computer), beginning with initial access and progressing through execution, persistence, and attempted lateral movement. As the simulated attack unfolds, the session will highlight the indicators that appear at each stage and how security controls can identify and disrupt the attack before encryption or data exfiltration occurs.

A key focus will be on how layered security controls work together, including identity protections, endpoint detection, monitoring and alerting, access controls, and segmentation. The session will demonstrate how gaps in configuration or visibility can allow an attack to progress, as well as how properly implemented controls can significantly reduce impact. The presentation will also emphasise the importance of operational readiness. Detection alone is not enough; organisations must be able to respond quickly and effectively. 

The session will explore how incident response processes, alert triage, and coordination between teams influence the outcome of an attack. Recovery will form a critical part of the session. Many discussions around ransomware focus heavily on prevention, but resilience depends equally on the ability to recover. The session will demonstrate how backup strategies, restoration processes, and recovery planning affect business continuity and how organisations can validate their readiness before an incident occurs.

This session is vendor neutral and focuses on practical outcomes rather than specific tools. Attendees will leave with a clear understanding of how ransomware attacks unfold, what effective defence looks like in practice, and how to strengthen both prevention and recovery capabilities within their own environment.