Identity, Security & Compliance
Ransomware recovery and incident response.
And afterwards, you keep the keys.
Ransomware recovery services that contain the damage, bring systems back from backups you can trust, and rebuild identity so the attacker's access is gone. When it is over, the admin accounts, documentation and keys are yours, not ours.
Ransomware recovery and incident response from Pro IT NW, a Seattle-based security and Microsoft consultancy, is hands-on help to contain an attack, restore systems and rebuild identity. It is for mid-sized organizations and their IT teams, during an incident or before one. We do not promise a response time, negotiate with attackers or handle payments. After recovery, you hold the admin accounts, documentation and keys.
What should you do first after a ransomware attack?
Stop the spread, keep the evidence, and check your insurance before you hire anyone.
- Isolate. Disconnect affected machines from the network: unplug the cable, turn off Wi-Fi. Disconnect shared drives and backup targets you can still reach.
- Don't wipe. Don't reformat, rebuild or restore anything yet. Restoring too early can put the attacker straight back in and destroys what shows how they got in.
- Preserve evidence. Keep the ransom note, take photos or screenshots, save logs, and write down what happened and when.
- Talk out of band. Assume company email and chat may be watched. Use phones and agree who is speaking for the organization.
- Check your policy. If you have cyber insurance, read the policy or call the insurer before hiring anyone, including us. Some policies require early notice or vendors the insurer approves.
- Bring in your lawyer. Notification duties and the question of engaging with the attacker are legal decisions, not IT ones.
- Then call for help. Use the contact page or the phone number shown at the top of this site.
During an incident
How does Pro IT NW help with ransomware recovery?
We do the technical recovery work, alongside your insurer, your counsel and any firm they appoint.
Containment
Cut the attacker's access, work out which systems and accounts are affected, and stop the spread without destroying evidence.
Recovery from backups
Check backups are clean before trusting them, then restore in an agreed order: the systems the business needs first.
Rebuilding identity trust
After ransomware, treat the domain itself as suspect. We rebuild trust in Active Directory and Entra ID so no hidden admin access survives the recovery.
Credential resets and hardening
Reset admin, service and user credentials in a safe order, then close the route the attacker used so it does not work twice.
Who holds the keys after a ransomware recovery?
You do. A crisis is exactly when an organization hands over every password and admin account, and it is easy to come out of a recovery with someone else holding all of them. We work the other way round.
- Rebuilt admin and emergency access accounts are in your organization's name
- Passwords, recovery keys and any other access we used are handed to you in writing
- You get documentation of what was rebuilt, what changed and why
- We remove our own access at the end and show you that it is gone
Not sure who holds yours today? Take the ten-question could you take back the keys? self-check.
Can we prepare before a ransomware attack?
Yes: a written ransomware response plan and a tabletop exercise, as a fixed-scope project. The plan names who decides what, who calls the insurer and counsel, how staff communicate if email is down, and which systems come back first. The tabletop walks your leadership and IT team through a realistic scenario, so the first time you use the plan is not the real thing. It pairs naturally with backup and disaster recovery work, because a plan is only as good as a restore you have actually tested.
What is this service not?
It is technical recovery work, with clear limits. We don't promise a response time or a round-the-clock desk, and we can't promise every system or file comes back. We don't negotiate with attackers or handle payments, and we don't give legal or notification advice. We resell nothing, so any tool we recommend you buy from the vendor of your choice. The work is senior-led, labor-only and vendor-neutral, delivered across the US from Seattle.
Related: Backup & disaster recovery · Active Directory security assessment · Penetration testing · Virtual CISO
FAQ
Common questions about ransomware recovery.
What should we do first after a ransomware attack?
Disconnect affected machines from the network, but do not wipe, rebuild or restore anything yet. Keep the ransom note, screenshots and logs, and write down what you saw and when. Use phones or personal accounts to talk, because the attacker may be able to read company email. Then check your cyber insurance policy before hiring anyone, because some policies require you to notify the insurer first or to use vendors it approves.
What do your ransomware recovery services include?
Pro IT NW helps contain the incident, work out what was affected, recover systems from backups that are checked before they are trusted, rebuild Active Directory and Entra ID so the attacker's access is gone, reset credentials, and harden the environment so the same route does not work twice. When it is over, you hold the admin accounts, the documentation and the keys.
Do you promise a response time or a full recovery?
No. We do not sell a promised response time or a round-the-clock service, and nobody can honestly promise a full recovery before seeing the environment and the state of the backups. Contact us and we will tell you plainly whether we can take the work on and what a realistic recovery looks like.
Do you negotiate with attackers or handle ransom payments?
No. We do not negotiate with attackers or handle payments. Whether to engage with an attacker is a decision for you, your insurer and your legal counsel. Our work is containment, recovery and hardening.
Do you offer an incident response retainer?
Yes. An incident response retainer from Pro IT NW is agreed before anything goes wrong: we learn your environment, agree the terms and the contacts in advance, and write or update your response plan, so on the day you call us without a contract or onboarding in the middle of a crisis. It does not include a promised response time unless one is written into your agreement. The plan and documentation are yours to keep.
Who owns the admin accounts and documentation after recovery?
You do. Rebuilt admin and emergency access accounts are in your organization's name, the passwords and keys are handed to you, and you get written documentation of what was rebuilt and how. We remove our own access at the end. Helping in a crisis should never leave a provider holding the only keys to your systems.
Is this legal advice or breach-notification advice?
No. Our work is technical and operational. Questions about breach notification, regulators, contracts and liability belong with your legal counsel and your insurer, and we work alongside them and any firm they appoint.
Free checks
Not ready to talk yet? Start with one of these.
10 questions
Could you take back the keys?
Ten yes / no questions: could you remove your IT provider's access without their help and keep control? Admin accounts, domain, licenses, backups, contract dates.
Open →
Runs in your browser
Who controls your domain?
See who runs your domain's DNS, where your email goes, whether you publish DMARC, and whether on-prem Exchange is still visible. Nothing stored.
Open →
Sample report
See a Copilot readiness report
A sanitized sample assessment: findings scorecard, readiness ratings and remediation roadmap, so you can see what you would get.
Open →
Dealing with an incident, or want a plan before one?
Use the contact page or the phone number at the top of this site. Tell us what you are seeing, or what you want to be ready for, and we'll tell you plainly whether and how we can help.