Building a Ransomware Decision Tree Before the Call Comes In
Help Net Security, Friday, September 11th, 2026
Arctic Wolf's Kerri Shafer-Page explains why containment, payment, law enforcement and communications decisions should be made in advance.
In this Help Net Security video, Kerri Shafer-Page, VP of Incident Response at Arctic Wolf, walks through a ransomware decision tree covering four areas to settle before an incident.
Containment requires someone who understands what taking systems offline does to client data, production or websites.
For extortion, organizations must decide who can negotiate and set a payment ceiling, which she treats as a business decision that may cost less than insurance retention and higher premiums.
She also recommends including law enforcement in the playbook and preparing communications with legal counsel, a spokesperson and the help desk.