This presentation examines the incident response lifecycle for a ransomware attack. Participants will gain insight into the methods threat actors use, from initial access to post-compromise activities, and the steps incident response teams take to contain and recover from the incident. The session will also look at where AI could assist in incident response.

Topics that will be addressed:

• How attackers get in: Attack surfaces to be aware of

• What attackers do: Recon, persistence, disruption, and extortion 

• How to respond: Key decisions leading to full recovery