Decide the response before you need it.
Ransomware readiness means knowing, before an attack, which servers, file shares and virtual machines ransomware could reach, how it would move between them, and what happens when it tries.
Helm watches those systems from day one, across physical and virtual infrastructure including VMware environments, and your team sets the containment rules to match. When an attack starts, the response is already decided and your team carries out a plan it has seen before.
Ransomware readiness is the work done before an attack that decides how the attack ends. It covers three things. A clear picture of where ransomware could spread, rules that set what happens when it does, and a team that knows those rules before it needs them.
It starts from the assumption that an attacker will get in at some point, through a stolen password, an unpatched server or a trusted account. Readiness covers what happens after an attacker gets past prevention tools such as EDR and email filtering. In the first minutes of an incident, a team that still has to work out which systems matter, and who can isolate them, loses time. A team with that picture and tested rules acts at once, and the business keeps running while it does.
Once inside, ransomware rarely stays where it landed. Attackers move laterally, from one system to the next, through the credentials and connections the organisation already relies on, the same access your staff and systems use every day. File shares that many people can open, service accounts with wide permissions and remote-access tools each give them a way to reach the next system. The aim is to reach as much data as possible before encryption starts, so the damage lands across the business at once.
Virtual infrastructure raises the stakes. A hypervisor is an attractive target, because access to the hypervisor layer gives an attacker privileged access to many servers at once.
That is why readiness starts with knowing those paths. Sensible containment rules depend on it.
Helm works from a clear picture of your environment. The servers, file shares, SAN and NAS storage, Microsoft 365 and the virtual machines on your hypervisors that you nominate, and the identities that can reach them. Your team knows how ransomware could move from one to the next, and that knowledge is the basis for the containment rules.
Your team decides in advance which systems are isolated, which identities are disabled and which services stay online, and Helm applies those rules the moment active encryption starts. The rules are fixed and auditable, so every action can be explained afterwards to the board, an auditor or a regulator.
Agreeing the response in advance means no one has to work it out in the middle of an incident. That is the difference between a human in the loop and a human on the loop. Even a fully staffed security operations centre still needs an analyst to assess and act, and encryption runs faster than that assessment takes. With Helm, your team sets the rules and watches over them, and the rules act at the speed of the attack, at three in the morning as readily as at three in the afternoon.
On VMware vSphere and ESXi, readiness also means closing the routes attackers use to reach the hypervisor. Attackers who reach an ESXi host usually log in over SSH with stolen administrator credentials, and in 63% of the breaches Sophos investigated in 2024, MFA was not configured. Helm’s Virtual Server Protection adds a one-time code to every SSH login, so a password alone does not open the host. You can keep SSH available, as Broadcom recommends limiting rather than removing it, while protecting the hypervisor layer against ransomware.
Virtual Server Protection also watches the host from the inside. It monitors running processes and the files on datastores, virtual disks and NFS storage, detects encryption or corruption of VMware system files as it starts, stops the malicious process and alerts your team and your SIEM. Together with Ransomware Containment it covers the hypervisor and the data it holds. Every access to the host is logged, which supports incident investigation, audits and cyber insurance reviews, and shows the controls were in place before anything happened.
When ransomware starts encrypting in a ready organisation, the paths are already known, the rules are set and the team knows them. Containment follows the plan, unaffected systems stay online, and your team deals with a contained incident.
Readiness also gives you something to show before any incident. A documented plan, and evidence that the controls on your virtual layer are in place. Boards, auditors and insurers ask for both.
Readiness is the first of four outcomes in how Helm works. The next is containment, which contains the spread in seconds and keeps the business running. To see what readiness would look like for your own estate, talk to us.
