Back Helpnetsecurity Building a ransomware decision tree before the call comes in
In this Help Net Security video, Kerri Shafer-Page, VP of Incident Response at Arctic Wolf , walks through the ransomware decision tree in this video. She covers four areas where decisions need settling in advance, starting with containment.
Someone has to know the network well enough to judge what pulling a system offline does to client data, a manufacturing line, or a website. Then comes the extortion demand . Who is authorized to negotiate, and what is the ceiling?
Shafer-Page treats paying as a business decision, noting that a demand can cost less than an insurance retention and higher renewal rates. She argues law enforcement belongs in the playbook, since agencies may know the threat actor and can help you avoid sanctions problems.
Communication matters too, from cyber legal counsel on disclosure deadlines to a spokesperson and a prepared help desk. Her advice: make these decisions on a Tuesday afternoon, not at 2 a.m. on a holiday weekend.
Download: 2026 Credential Risk Report
Getting a stranger’s phone kicked off the cellular network costs a few dollars
Building a ransomware decision tree before the call comes in
Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)
Download: The High-Performance Team Playbook
Simplify security management with CIS SecureSuite Platform
Download: The IT and security field guide to AI adoption
Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)
Fake GTA 6 download delivers malware-packed bundle to impatient gamers
Apple is building photo verification for the people who need it most
Product showcase: GitGuardian Honeytoken catches credential theft as it happens
September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
