Summary
We isolate infected machines, wipe and rebuild infected computers, and restore cloud files from clean backups. Server and workstation backups are available as an add-on.
If it's happening right now, call 647-547-5473. After hours, press 9 to reach whoever is on call.
How is ransomware caught early?
Protected computers and servers carry hidden decoy files that no one has a reason to touch. Ransomware hits these files early when it starts encrypting data.
A 24/7 security operations analyst confirms whether the activity is ransomware. The infected computer is disconnected from the network but remains reachable by the security team. Whoever is on call receives a page. This can happen before the investigation report is written.
What happens to the infected computer?
We wipe and rebuild it. We do not try to clean it, because rebuilding is the only way to be sure nothing was left behind.
Managed computers keep Desktop and Documents in OneDrive, or Google Drive for Google Workspace clients. Work files in those locations are kept in cloud storage and can be recovered from backup.
How do you get your email and files back?
We back up Microsoft 365 and Google Workspace data separately from the live systems. This includes mail, OneDrive, SharePoint, Google Drive and shared drives.
We restore encrypted files from a clean copy taken before the attack.
What about servers and computers that hold data locally?
Server and workstation backup is an add-on. It makes full image backups to an appliance on site and copies them to the cloud.
Backups are encrypted in transit and at rest, and checked automatically. They stay out of reach of ransomware on the network, so clean restore points survive.
A failed server can start from its backup as a virtual machine, on site or in the cloud. This lets the business keep running while the hardware is fixed.
What do you get afterwards?
You receive a full incident report.