Building a ransomware decision tree before the call comes in
Arctic Wolf's IR VP urges pre-deciding ransomware response choices on containment, negotiation authority, law enforcement engagement, and crisis communications.
A Help Net Security video features Kerri Shafer-Page, VP of Incident Response at Arctic Wolf, walking through a ransomware decision tree. She recommends settling four decision areas in advance: containment, extortion negotiation limits, law enforcement involvement, and communications. She frames paying as a business decision that can cost less than insurance retention and renewal hikes, and notes agencies may know the threat actor and help avoid sanctions issues.
- Pre-decide containment so staff know the impact of taking systems offline
- Treat ransom payment as a business decision with an authorized negotiator and ceiling
- Include law enforcement in the playbook to avoid sanctions complications
- Prepare communications: legal counsel, spokesperson, and help desk in advance
Full article163 words · extracted from helpnetsecurity.com · click to collapse
In this Help Net Security video, Kerri Shafer-Page, VP of Incident Response at Arctic Wolf, walks through the ransomware decision tree in this video. She covers four areas where decisions need settling in advance, starting with containment.
Someone has to know the network well enough to judge what pulling a system offline does to client data, a manufacturing line, or a website. Then comes the extortion demand. Who is authorized to negotiate, and what is the ceiling?
Shafer-Page treats paying as a business decision, noting that a demand can cost less than an insurance retention and higher renewal rates. She argues law enforcement belongs in the playbook, since agencies may know the threat actor and can help you avoid sanctions problems.
Communication matters too, from cyber legal counsel on disclosure deadlines to a spokesperson and a prepared help desk. Her advice: make these decisions on a Tuesday afternoon, not at 2 a.m. on a holiday weekend.
Download: 2026 Credential Risk Report
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/11/ransomware-decision-tree-video/