How fast should your MSP respond to a ransomware alert?
Your MSP should contain a ransomware alert within 1 hour of detection — not 1 hour of you calling them. Detection, isolation, and containment must happen automatically and continuously, including at 2 AM on a Sunday. IDENETY MSP's P1 SLA is ≤1 hour from detection to containment, backed by a 24/7 SOC.
Response SLA benchmarks
IDENETY MSP SLA vs. industry average for on-call MSPs.
5-phase incident response playbook
Detection
T+0- SIEM correlation identifies anomalous behavior
- EDR/XDR flags lateral movement or ransomware indicators
- SOC analyst reviews and validates the alert
- P1 incident declared if ransomware confirmed
Containment
T+5 to T+22 min- Affected network segment isolated via firewall policy
- Compromised endpoint quarantined via EDR
- Lateral movement stopped — domain controller access blocked
- Client emergency contact notified by phone
Eradication
T+1 to T+3 hrs- Forensic analysis of compromised endpoints
- Initial attack vector identified
- Malware artifacts removed from all affected systems
- Credential reset for any compromised accounts
Recovery
T+3 to T+6 hrs- Immutable backup integrity verified — no ransomware contamination
- Endpoint restoration from clean backup
- Network segment brought back online after verification
- Full operations restored
Post-Incident
T+24 to T+72 hrs- Root cause analysis report delivered to client
- Attack vector remediated (phishing training, patch, policy change)
- Incident documented for compliance records
- Insurance notification if required
Real example: 2:14 AM ransomware containment
IDENETY MSP's SOC detected lateral movement at 2:14 AM. The compromised endpoint was quarantined at 2:19 AM — 5 minutes after detection. Ransomware was fully contained by 2:36 AM — 22 minutes from detection. Full operations were restored from immutable backup by 6:00 AM, before business hours. Zero data was exfiltrated.
Read the full case studyQuestions to ask your current MSP
If the answer is not in writing in the contract, it does not exist.
On-call means one engineer woken at 2 AM. A staffed SOC means active monitoring.
Detection without automated containment is just an alert. Ask for the mean time to contain (MTTC).
Network-attached backups can be encrypted by ransomware. Immutable off-site backup is the only guaranteed recovery path.
Any MSP claiming fast response should be able to show a documented incident timeline from a real event.
Frequently asked questions
What is mean time to detect (MTTD) for ransomware?
Industry average MTTD for ransomware is 24–72 hours — meaning attackers have been inside the network for days before detection. IDENETY MSP's 24/7 SOC with behavioral EDR/XDR reduces MTTD to minutes by detecting lateral movement before the ransomware payload executes.
What is mean time to contain (MTTC)?
MTTC measures the time from detection to isolation of the threat. IDENETY MSP's documented MTTC is under 30 minutes for P1 incidents, based on automated EDR quarantine and SOC-initiated network isolation.
Should I pay a ransomware ransom?
The FBI and CISA advise against paying ransoms. Payment does not guarantee data recovery, funds criminal organizations, and may violate OFAC sanctions if the attacker is a sanctioned entity. Immutable backup is the only reliable alternative to paying.
How do I know if my MSP's SOC is actually 24/7?
Ask for the SOC staffing model in writing. Ask what happens if you call at 3 AM on a holiday — will a live analyst answer? Ask for a documented incident from outside business hours. If they cannot provide one, their '24/7' claim is marketing.
Is your business protected at 2 AM?
IDENETY MSP's 24/7 SOC monitors your endpoints around the clock. P1 SLA: ≤1 hour detection to containment — in writing.
Book free security assessment