The First 20 Minutes of a Ransomware Attack
What High-Performing Teams Actually Do
By Ann Marie van den Hurk, Mind The Gap Advisory
Most ransomware damage doesn’t come from encryption. It comes from hesitation.
In the first 20 minutes, organizations either take decisive, credible action or they descend into confusion and avoidable losses. High-performing teams move faster, communicate more clearly, and maintain operational stability far better than the rest.
Here’s what they do differently.
Why the First Minutes Define the Entire Incident
Ransomware isn’t just a technical crisis. It’s a leadership crisis. When the attack hits, most organizations experience the same breakdowns:
IT and Comms operating from different playbooks
Legal slowing the process due to uncertainty
Executives freezing or asking for more information
No pre-approved internal messaging
No clarity on activation roles
Every minute of indecision increases cost, downtime, and reputational damage.
High performers eliminate guesswork before the crisis begins.
Minutes 0–5: Contain
The best teams don’t waste time debating. They act:
Confirm the attack
Isolate affected systems
Protect backups
Move to secure comms
Activate the crisis team
This is where most organizations lose control. Containment must be reflexive, not negotiated.
Minutes 5–10: Verify
Verification isn’t about gathering every detail. It’s about getting enough clarity to guide action.
Teams should quickly determine:
What systems are impacted
Whether the intrusion is ongoing
Preliminary business impact
Whether sensitive data might be exposed
Which internal pathways must be secured
Slow verification is one of the biggest failure points during ransomware. Precision matters, but speed matters more.
Minutes 10–20: Communicate
This is the make-or-break stage. The first internal message sets the tone for the entire event. When it arrives too late, employees fill the information vacuum with assumptions, rumors, and fear.
Effective internal messaging in the first 20 minutes should:
Acknowledge the disruption
Establish who is leading the response
Direct employees to secure channels
Clarify what not to do
Reduce panic and operational drift
Without prepared messaging, most organizations improvise under pressure. Improvisation causes avoidable mistakes.
Where Teams Struggle Most
Even well-resourced organizations fail in predictable ways:
They don’t have pre-built activation scripts
Leaders don’t understand their decision authority
Messaging must be drafted from scratch
Too many people wait for approval
No one owns the first communication cycle
A ransomware crisis rewards preparedness, not intelligence.
The Playbook Problem
Most teams think they have a ransomware plan. What they really have is:
A technical SOP with no communication layer
A generic “cyber response guide” not suited to AI-era threats
A PDF that nobody has looked at since last year
Strong organizations operate from:
Pre-approved messaging templates
Activation workflows
Internal and external holding statements
Decision trees
Secure communication protocols
Clearly defined roles
This is why the CrisisOS5 Response Playbook exists — to eliminate hesitation in the moments that matter most.
Move Faster. Communicate Better. Recover Stronger.
The first 20 minutes shape recovery time, cost, public narrative, and leadership credibility.
If you want a ready-made system for ransomware, deepfakes, AI-driven misinformation, and fast-moving incidents, the CrisisOS5 Response Playbook gives your team the clarity and speed that high performers rely on.
Ann Marie van den Hurk, MSc., APR is the founder of Mind The Gap Advisory and originator of the CrisisOS5™ Framework. She advises CISOs, General Counsel, Chief Risk Officers, and boards on decision authority and executive crisis readiness for the AI era. Based in Newport, Rhode Island — serving organizations in Providence, Boston, Portsmouth, Portland, and Hartford, and across New England, nationally, and globally. mindthegapcyber.com