Ransomware takes about 4 minutes to encrypt your files. Recovery takes an average of 22 days.
That gap is the real story — and most businesses don't think about it until they're living it. The popular mental model is that ransomware is a crisis you respond to. The reality is that by the time you know you have a problem, the encryption is already done and the decisions in front of you are the ones you needed to prepare for months ago.
The Real Sequence of Events
Here's what actually happens after a ransomware attack — in order. Not the idealized version. The real one.
Someone can't open a file
Detection almost never comes from a security tool alerting at the moment of encryption. It comes from an employee who gets an error message and calls IT. By that point, encryption has been complete for minutes or hours. The ransom note is already on the desktop.
Everything gets isolated — operations stop
Every system that touched the network gets taken offline. File servers, email, line-of-business applications — all of it goes dark while the scope is assessed. This isn't an overreaction. Ransomware spreads laterally, and leaving connected systems online risks re-infection during recovery.
How did they get in, and how long have they been there?
A forensics investigation is required before any recovery work begins. You need to know the initial access vector — phishing email, unpatched vulnerability, compromised credential — before you rebuild anything. You also need to establish whether data was exfiltrated before encryption, which triggers separate notification obligations.
Pay the ransom — or restore from backup
This decision is the hinge point of the entire incident. If your backups are tested, current, and offsite, the answer is almost always restore. If your backups failed, were encrypted along with everything else, or haven't been tested and you're not confident they'll work — the calculus gets complicated very fast. The average ransom payment in 2024 was $1.5M. Paying does not guarantee recovery.
Rebuild, restore, re-test — then go live
Recovery is not flipping a switch. It involves reimaging endpoints, restoring data from backup, rebuilding server configurations, patching the vulnerability that was exploited, and testing everything before reconnecting to the network. Each of these steps takes time — and if the initial forensics were incomplete, you risk getting hit again before you're done.
Pay vs. Restore: The Decision Framework
The pay-or-restore decision is one that needs to be made with legal counsel, your cyber insurer, and your IR team — not under pressure at 2am when the ransom timer is counting down. Here's the framework:
Pay vs. Restore — What drives each decision
Factors that point toward paying
- Backups are compromised or untested
- Data was exfiltrated and attacker threatens to publish
- Recovery time exceeds business survival threshold
- Ransom is materially less than recovery cost
- Cyber insurer has approved and will cover payment
Factors that point toward restoring
- Tested, current, offsite backups are available
- No evidence of data exfiltration
- Recovery time is within tolerable range
- Attacker is a known actor with poor decryption track record
- Regulatory or legal issues with paying this actor
One critical point: paying the ransom does not guarantee that the decryption key works, that all data is recovered, or that the attacker doesn't still have access. Roughly 20% of businesses that pay still lose significant data, and re-infection rates for companies that pay without addressing the root cause are meaningfully higher.
The Three Things That Determine How Fast You Get Back
Across every ransomware response we've been involved in or seen the aftermath of, the recovery speed comes down to three factors — and all three need to be in place before the attack, not after.
MDR running before the attack
Managed Detection and Response that's actively monitoring your endpoints detects and contains ransomware in hours, not days. The difference between a contained incident affecting 10 systems and a full network compromise is usually whether someone was watching when the first endpoint started behaving abnormally. Without MDR, that alert goes to nobody.
Tested, offsite backups
Not a backup job that runs — backups you've actually restored from. Offsite or cloud copies that weren't reachable from the network when the encryption happened. If your backups are on a NAS that was connected to the same network as your servers, they're likely encrypted too. This is the single most important factor in recovery time and the decision of whether to pay.
A documented incident response plan
An IR plan isn't a compliance document — it's a decision framework you use under pressure. Who gets called first? Who's authorized to make the pay/restore decision? Who notifies your cyber insurer? Who communicates with clients? Who contacts law enforcement? These decisions made in advance, by the right people, take hours. Made under pressure without a plan, they take days — and people make different choices.
Free Ransomware Readiness Assessment
Moore Technology Consulting will assess your actual recovery capability — backups, MDR coverage, and IR plan — and tell you honestly how long recovery would take if you got hit today.
DM us "BACKUP" or schedule a free consultation · (646) 791-2137