31 October 2026 · 11 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
Ransomware Readiness Assessment: Measuring Whether Your Defences Would Stop an Attack, Stage by Stage
Most organisations that suffer a ransomware incident had an EDR, a backup product and an incident response plan. What they lacked was evidence that the three worked together against a determined adversary. A ransomware readiness assessment produces that evidence by safely exercising each stage of the attack chain in your own environment, under control, and measuring where it would have been detected and stopped.
What a ransomware readiness assessment is
A ransomware readiness assessment is a controlled, objective-driven security test that evaluates your defences against the sequence an attacker would follow: reach the environment, gain privileges, move toward the systems that matter, test whether backups could be reached or disabled, check whether data could leave unnoticed, and confirm whether detection and response would interrupt the chain. It differs from a conventional penetration test in two ways. It is scoped to that specific chain rather than to one system or application, and it measures the organisation's response as much as its exposures: the output is not only a findings list but a timeline of what the defenders saw, when, and what they did about it.
The assessment normally works from an assumed-breach position, because that reflects how incidents begin in practice. Initial exposure is evaluated separately and realistically (email susceptibility, exposed remote access, reused credentials), but the core of the engagement assumes one of those gave an attacker a foothold and asks the question that decides whether an intrusion becomes a crisis: starting from a single standard user on a single workstation, how far could an attacker reach toward domain administration, the backup console and the file servers, and would anyone notice in time? The method is the same discipline used in red teaming, applied with a narrower objective and a shorter timeline so an organisation can afford to run it every year. Every action is agreed in the rules of engagement, performed without deploying real encryption or destroying data, and designed to demonstrate risk rather than to cause it.
Who commissions it: boards and executive teams who want a straight answer to 'would we withstand it', insurers and brokers who increasingly ask for evidence behind the questionnaire, and compliance leads who need testing of business continuity and backup controls under DORA, NIS2 or the US financial regulations. The assessment is designed so one engagement answers all three.
The seven stages we evaluate
Each stage maps to techniques catalogued in MITRE ATT&CK and to a control your defences should provide. The assessment records, per stage, whether the risk existed, whether your tooling detected the activity, and whether your team responded. No destructive action is taken; the goal is evidence, demonstrated safely.
1. Initial access exposure
A controlled phishing campaign against an agreed sample of staff to measure susceptibility and reporting rates, plus a review of internet-facing remote services such as VPN, RDP and published gateways for phishing-resistant multi-factor authentication, and a check for exposed or reused credentials. The question is not whether one employee clicks; it is whether a single click or a single exposed service would give an attacker a usable foothold, and whether that foothold would be seen.
2. Privilege escalation
From a standard user context, we assess the paths that lead to higher privilege: unpatched local components, weak service configurations, credentials cached on endpoints, and over-permissive local administration. We demonstrate that a path exists and stop at proof; the finding is the path and the control that should have closed it.
3. Active Directory attack paths
Active Directory is where most ransomware incidents are decided. We map the relationships that lead from an ordinary account to domain-wide control (delegation misconfigurations, excessive group membership, stale privileged accounts, weak tiering) using the same path-analysis approach defenders can adopt, and show which single changes break the most paths.
4. Lateral movement and detection
We exercise realistic movement between systems to measure segmentation and, equally, to measure detection: does the EDR, SIEM or managed detection service raise an alert, and does anyone act on it? The value is the timeline. A path that is noisy and caught is a very different risk from the same path crossed in silence.
5. Backup resilience
The difference between an outage and a catastrophe is whether backups survive. We assess whether the backup console, repositories and credentials are reachable from the positions an attacker would hold, whether backups are immutable or offline, and whether backup service accounts are over-privileged. We never delete data; we document what could have been reached and what protects it.
6. Data-exfiltration detection
Modern ransomware relies on stealing data before encryption to pressure victims. Using benign marker files, we test whether a realistic volume of data could leave the network without triggering data-loss prevention, egress monitoring or the detection stack, so you learn whether an attacker would have obtained the data that drives double-extortion pressure.
7. Response and restore
Finally we test the defender side end to end: did the incident response plan activate, were the right people reachable, and, in a controlled restore test, can critical systems actually be recovered from backup within the recovery-time objective the business assumes? A plan that has never been restored from is an assumption, not a control.
Assumed-breach methodology and why it is the honest starting point
Assumed breach means the assessment begins by granting the tester a modest, realistic foothold: a standard domain account on a standard workstation, the position an attacker reaches within hours of a successful phishing email or a single exposed service. It is the honest starting point because defending the perimeter perfectly is not achievable, and every credible threat model for ransomware accepts that an attacker will eventually get a foothold. The useful question is what happens next, and assumed breach spends the engagement's time on that question instead of on re-proving that email is a risk.
The approach also makes the test repeatable within a predictable timeframe. A full objective-based red team that must find its own way in can take many weeks and is worth running periodically; an assumed-breach readiness assessment reaches the decisive ground (privilege, Active Directory, backups, detection) in a predictable time, which is why it suits an annual cadence and an insurance or compliance evidence cycle. Initial-access testing still happens, but as a measured, separate component rather than as a gate the rest of the engagement waits behind.
Tabletop, penetration test and ransomware readiness assessment
These three are complementary, not interchangeable. Choosing the right one for the question you have saves money and produces evidence that actually answers it.
| Dimension | Tabletop exercise | Penetration test | Ransomware readiness assessment |
|---|---|---|---|
| Primary question | Do our people and our plan know what to do? | Where are the exploitable weaknesses in this system? | Would our defences detect and stop a ransomware chain end to end? |
| Format | Facilitated discussion against a scenario | Hands-on technical test of a defined scope | Hands-on, controlled exercise of the full attack chain plus response measurement |
| Technical depth | None; decision and communication focused | Deep, within the scoped systems | Deep across the chain, scoped to the ransomware objective |
| Measures response | Yes, at the decision level | Rarely; findings are usually vulnerabilities | Yes; detection and response timeline is a core deliverable |
| Touches backups and restore | Discussed | Only if explicitly scoped | Yes; backup reachability assessed and a controlled restore tested |
| Typical cadence | Quarterly to annually | Annually and after major change | Annually, and before or after an insurance renewal |
| Best combined with | A readiness assessment to validate the plan's assumptions | Readiness assessment to confirm fixes hold against a real chain | A tabletop for the human side and a pentest for depth on key systems |
The frameworks behind the assessment
The technical method is organised around MITRE ATT&CK, which gives a shared vocabulary for each stage and lets the report state exactly which techniques your defences did and did not detect, so your security team can turn findings into detection-engineering work. For the readiness and governance side, the assessment draws on CISA's Cross-Sector Cybersecurity Performance Goals, a prioritised baseline of the controls that most reduce ransomware risk, and references the methodology of CISA's Cyber Security Evaluation Tool and its ransomware readiness module, which was retired as a downloadable tool but whose question set remains a useful structure for a self-assessment companion to the technical test.
For incident response, the assessment is written against NIST Special Publication 800-61 Revision 3 (2025), which recasts the incident response life cycle around the Govern, Identify, Protect, Detect, Respond and Recover functions of the NIST Cybersecurity Framework 2.0, so the response findings line up with the framework your risk team already reports against. Where the organisation is in scope for DORA or NIS2, the backup, continuity and incident-handling findings map directly to DORA's resilience-testing and ICT-continuity requirements (Articles 11 and 24 to 25) and to the business-continuity and incident-handling duties under NIS2 Article 21, so one assessment feeds both the security programme and the regulatory file.
The controls an assessment consistently finds decisive
Across ransomware readiness assessments, the organisations that would have stopped or survived the chain share a recognisable set of controls. These are the ones worth confirming you have, and worth testing rather than assuming.
- Phishing-resistant multi-factor authentication on every external service and every privileged login, with no legacy protocol or exception that bypasses it
- Endpoint detection and response deployed everywhere, including servers and the backup infrastructure, tuned to alert and with someone who acts on the alert around the clock
- Immutable or offline backups of critical systems, with the backup console and credentials unreachable from ordinary user and server contexts
- A restore that has actually been performed within the last year, timed against the recovery-time objective the business assumes, not merely a backup that reports success
- Active Directory tiering that separates workstation administration from server and domain administration, so one compromised workstation does not lead to the domain
- Network segmentation between user, server, backup and OT environments that is enforced and monitored, not only documented
- Egress monitoring or data-loss prevention capable of noticing a large, unusual outbound transfer
- An incident response plan with current contacts, defined roles, an out-of-band communication method, and evidence it was exercised in the past year
- Logging centralised and retained long enough to reconstruct an intrusion, with the logging pipeline itself protected from tampering
Cyber insurance and why insurers now expect testing
Cyber-insurance underwriting has tightened around exactly the controls a readiness assessment measures. Renewal questionnaires now ask, as conditions rather than preferences, for multi-factor authentication on remote access and privileged accounts, endpoint detection and response coverage, immutable or offline backups with tested restores, privileged access management, and email filtering with user training. Insurers ask because the controls are the ones that most change the outcome and the claim size, and because they have learned that a signed questionnaire is not the same as a working control. A readiness assessment turns the questionnaire answers into evidence: it shows that the MFA has no bypass, that the EDR actually alerts, and that the backups a form claims are immutable cannot be reached from the positions an attacker would hold.
The commercial effect runs both ways. Organisations increasingly use the assessment report as part of their submission, to support coverage, pricing or a higher sub-limit, and underwriters increasingly treat independent testing as a positive signal. Where an assessment finds a gap against a condition the policy assumes, it is far better to find it in a controlled test than to discover at claim time that a warranty was not met. The report is written so a broker and an underwriter can read the control status directly.
How HackersHub runs the assessment
We agree the objective and the rules of engagement first: the assumed-breach starting point, the systems in scope, the safeguards (no real encryption, no destructive action, benign markers for any data-movement test, named escalation contacts for anything time-critical), and the measurement goals for detection and response. We then exercise the chain stage by stage, coordinating with your security team on what they are permitted to see so the detection timeline is honest, and we run a controlled restore test with your infrastructure team. The deliverable is two things in one: a prioritised, risk-rated findings report that your engineers can act on, mapped to MITRE ATT&CK and to the relevant NIST and regulatory references, and a response narrative that tells your board and your insurer, in plain terms, where the chain would have been broken and where it would not.
Testers are OSCP-certified and named in the report. HackersHub is based in Amsterdam, Netherlands, with 10+ years of offensive security expertise and a 4.9/5 rating across 127 reviews, and we work with organisations across Europe and the United States. The assessment complements our red teaming for organisations that want the full adversary simulation, our network penetration testing for depth on the internal estate, and our managed detection and response work for the organisations that want the detection gaps the assessment finds closed and watched.
Frequently asked questions
Want evidence, not an assumption, about ransomware?
We exercise the attack chain safely in your own environment and tell your board and your insurer exactly where it would have been stopped and where it would not. Talk to an expert about scoping an assessment.