Many organizations have done many “right” things. They run penetration tests. They map adversary Tactics, Techniques, and Procedures (TTPS) to MITRE ATT&CK. They tune detections and feel reasonably confident in their security posture. And then ransomware happens anyway.
This session explains why that outcome is not a failure of pentesting or TTP-based defense, but a misunderstanding of what those practices are designed to deliver. Pentests show how an attacker could, maybe, break in. TTPS describe how attackers operate but doesn’t determine whether your organization can survive one.
No zero days. No novel techniques. Alerts fired. Tickets created. By the time humans were confident the attack was “real,” the attackers had already achieved irreversible impact. This session will walk through real-world ransomware campaigns, minute by minute: initial access, credential abuse, lateral movement, backup destruction, encryption, and extortion.
The session will focus on the decisive moments that actually change outcomes — and the ones that didn’t. Attendees will see why attackers go after recovery infrastructure first, how traditional and even offline backups fail under real pressure, and why organizations with properly orchestrated immutable data recovery processes are able to shut down negotiations and restore operations without paying.
Thus, the talk shifts from “How do we stop every attack” to “What actually limits blast radius and guarantees recovery?”
Key takeaways include:
• What pentests and TTPS did not predict in real ransomware incidents.
• The speed at which modern ransomware operations actually move.
• Why immutability and isolation alone are not enough.
• How guaranteed restore capability removes attacker leverage.
• How security controls should align with reality, not compliance checklists or maturity models.
• How organizations can recalibrate toward what actually matters when prevention inevitably fails.
