What Happens Step-by-Step After a Ransomware Attack — And How Cyber Insurance Kicks In

When ransomware detonates, the attacker has typically been inside the network for weeks before encrypting a single file. That dwell time means backups may already be compromised, credentials may already be exfiltrated, and your first hour is triage, not recovery. The containment window, not the ransom note, is where the outcome is decided.

Hour 0-4: Containment Before Everything Else

The first decision is network isolation, pulling infected machines off the domain before ransomware propagates to file shares, cloud-synced drives, or backup targets. Without a tested incident response plan, this step alone can consume half a day while staff argue about which systems to pull and who has the authority to do it.

Hour 4-24: The Documentation Problem Starts Now

Every action taken in these hours, which systems were touched, what commands were run, and what logs were pulled, becomes evidence the forensic vendor and insurer will scrutinize later. An MSP running a managed detection and response or endpoint detection and response (EDR) platform generates timestamped telemetry automatically. A business relying on manual notes does not.

The difference between a 4-hour containment and a 4-day shutdown is almost always whether an incident response plan existed and was tested before the attack. American Frontier builds and tests these plans with clients as a pre-breach deliverable, not a post-breach scramble.

Where Cyber Insurance Enters the Timeline And What It Actually Covers

Cyber insurance for small businesses activates in distinct phases after an attack, not all at once. Each coverage category has its own trigger point, and none of them pay on Day 1. Understanding which coverage activates when, and what documentation each requires, is the difference between a full payout and a protracted dispute.

American Frontier's cyber insurance services in Raleigh are built around the operational reality of this timeline, not the purchasing decision that precedes it.

The prior-acts exclusion is the coverage gap Triangle-area professional services firms (CPA practices, law offices, architecture firms) most frequently discover after filing. If an attacker established access three months before the policy start date, the insurer can argue the incident predates coverage.

What Insurers Actually Require to Pay Out And Why Most SMBs Fail the Audit

Underwriters now verify specific technical controls at claim time, not just at policy application. A policy purchased without those controls already deployed is routinely disputed or paid at a reduced amount. The controls that trigger the most claim disputes are MFA on privileged accounts, immutable off-site backups, EDR, and a documented incident response plan.

Multi-Factor Authentication (MFA) on Privileged Accounts

MFA, requiring a second verification factor beyond a password, is now a baseline underwriting requirement, not a bonus control. Insurers increasingly check MFA coverage at claim time, not just application time. A business that applied with MFA on admin accounts but later disabled it for convenience may find that gap cited in a coverage dispute.

Immutable Off-Site Backups

Immutable backups are backup copies written in a format that cannot be altered or deleted, even by an authenticated administrator. They are the control that separates a ransomware recovery measured in hours from one measured in weeks. American Frontier's immutable off-site backup configuration is designed specifically to satisfy this underwriting requirement and to survive the attacker dwell period that precedes most ransomware detonations.

Documented Incident Response Plan

Underwriters and forensic vendors both reference the incident response plan during a claim to determine whether the business followed reasonable security practices. American Frontier deploys EDR and configures backups as part of its cybersecurity services and validates these controls against insurer checklists before a policy is bound.

The Step-by-Step Claim Process: From Breach Discovery to Payment

A cyber insurance claim after ransomware follows a defined sequence. Steps 1 through 3 are where unprepared businesses stall, and where an MSP's incident log and pre-built documentation are decisive. Skipping or delaying any step can void coverage for that phase of recovery.

1. Breach notification to insurer: Most policies require notification within 24-72 hours of discovery. Missing this window is one of the most common grounds for claim denial.
2. Insurer assigns approved forensic vendor: The insurer sends their own forensic firm, not yours. That vendor's report, not the victim's account, governs coverage decisions. This is the step most SMBs are unprepared for.
3. Forensic report establishes scope and causation: The report identifies initial access vector, dwell time, and which data was accessed or exfiltrated. A documented incident response and disaster recovery plan gives the forensic vendor a baseline to work from and compresses this step from weeks to days.
4. Ransom negotiation through insurer-approved firm: The insurer assigns a specialized negotiation firm, not the victim's IT team. This firm communicates with the attacker, verifies decryption capability, and negotiates the amount. The victim does not negotiate directly.
5. Remediation and system rebuild: Covered under the policy's first-party expense coverage, but only if the forensic report confirms the systems affected. EDR telemetry from before the attack is essential here.
6. Business interruption loss documentation: The business must produce documented revenue loss tied to the outage period. Anecdotal claims without financial records are routinely reduced or denied.
7. Final settlement: The insurer reconciles all documented costs against policy limits, sub-limits, and any applicable exclusions. NC businesses should note that breach notification costs under N.C.G.S. § 75-65's 30-day requirement often hit policy notification cost caps before all affected parties are reached.

Steps 1 through 3 are where claims stall. An MSP that maintains continuous incident logs, EDR telemetry, and a current IR plan hands the forensic vendor a complete picture on Day 1, compressing what otherwise becomes a multi-week documentation exercise.

Frequently Asked Questions