Start with business impact and an authorised incident lead
Encrypted files, a ransom message or a disabled service require a coordinated response. Identify the affected business functions and whether harmful activity appears ongoing. The company may depend on both local servers and cloud services, so establish who can make decisions across those environments and who can authorise operational disruption.
Suspected AI involvement does not change the immediate need to limit harm. An attacker may have used AI during reconnaissance or social engineering without leaving clear evidence of that use. Preserve the observed facts and avoid delaying the response to settle that attribution question.
Coordinate containment and evidence preservation
CISA’s StopRansomware guide recommends identifying and isolating impacted systems and preserving evidence that may be volatile or short-lived. The practical method depends on the environment and the people available. Have authorised responders weigh isolation, continuity and evidence needs, rather than issuing a universal instruction to shut down every machine.
Keep a decision log recording the time, action, approver and observed result. Use trusted communications if the attacker may have access to normal channels. Do not ask employees to experiment with suspicious files or run unreviewed cleanup instructions received through a potentially compromised account.
Investigate identity and recovery infrastructure
The visible encrypted endpoint may not be the original entry point or the full scope. Include the relevant privileged accounts, remote access, servers, virtualisation and backup administration in the investigation. Establish whether the same credentials could reach Microsoft 365 or other cloud applications.
A backup job marked successful is not by itself a recovery decision. Identify the available recovery points, access restrictions and the evidence needed to choose a trusted source. Keep recovery infrastructure under review so restoration does not reintroduce the same access path.
Separate restoration from declaring the incident resolved
| Decision | Evidence or owner needed |
|---|---|
| Restore a critical service | Business priority and approved recovery source |
| Reconnect a rebuilt host | Security checks, dependency testing and an accountable approver |
| Restore account access | Credential and permission review with verified effect |
| Communicate scope | Confirmed facts, unknowns and the next investigation milestone |
| Close the incident | Recovery acceptance and assigned residual actions |
A system can be available while the investigation remains incomplete. State that distinction clearly in executive updates. Privacy, legal, insurer and regulatory decisions belong to the responsible owners, supported by the factual timeline and evidence rather than an automatically generated incident narrative.
Use automation where it supports accountable work
Automated collection and approved AI assistance can help with repetitive analysis and organising observations. They do not establish that every compromised system has been found. Require source references, human review and explicit approval for actions that change accounts, networks or production services.
Before commissioning support, agree the boundaries between triage, investigation, remediation and recovery validation. Ask what access and records are needed, what remains your organisation’s responsibility and how urgent findings will be communicated. Use our legacy infrastructure response guide to prepare a realistic inventory.
Get help with the affected business systems
Explore this response workstream or our AI incident response services. You do not need to operate an AI application or prove the attacker used AI to request help. Describe the affected systems, observed impact and urgency; we confirm availability and agree an authorised scope.
Send only non-sensitive context through the website. If company email may be compromised, use a trusted communication channel and avoid sharing the investigation through the suspected account.
Sources and review
Reviewed 24 October 2026. The decision tables and planning examples are Atlant Security guidance. A suspected use of AI is not established attribution. Scope, availability and evidence handling are agreed before an engagement.
