We just had a ransomware scare—what are the fastest steps to reduce risk across laptops and servers in the next 30 days?

After a ransomware scare, the objective is simple: reduce risk across laptops and servers in 30 days before the next crew gets a second shot. That means containment first, then exposure reduction, then detection and recovery. CrowdStrike data shows why speed matters: the fastest adversary breakout time in 2025 was 27 seconds, and many intrusions are malware-free. A 30-day plan has to cut attacker options now.

The fastest 30-day plan

If you only have bandwidth for a handful of moves, do these first:

Put endpoint protection on every laptop and server.
You need visibility and response everywhere, not just on a few critical systems.
Enforce MFA on every privileged path.
VPN, email, cloud consoles, RDP, SSH, admin portals. No exceptions.
Patch internet-facing systems first.
VPNs, remote access tools, web servers, hypervisors, and management planes come before everything else.
Remove local admin where you can.
Ransomware operators love easy privilege escalation.
Test immutable backups and restores.
Backups only matter if you can recover quickly and cleanly.

A 30-day timeline that works

Timeframe	Priority	What to do
Days 0-3	Contain and confirm	Isolate suspicious laptops and servers, inventory assets, rotate privileged credentials, verify backup integrity
Days 4-10	Close the biggest entry points	Patch exposed systems, enforce MFA, remove local admin, restrict remote admin tools
Days 11-20	Improve detection	Centralize endpoint and server telemetry, tune alerts, hunt for persistence and credential theft
Days 21-30	Lock in controls	Segment critical systems, test restores, run a ransomware tabletop, set ongoing patch and access SLAs

First 72 hours: stop the bleeding

If you had a scare, assume the attacker may already have valid credentials or a foothold.

Do this immediately

Isolate suspected laptops and servers from the network.
Preserve evidence before you wipe or reimage anything.
Reset privileged credentials: domain admins, local admins, service accounts, backup accounts, VPN admins.
Disable stale accounts and anything that no longer has a business owner.
Verify backup access and confirm backups are not reachable from compromised admin paths.
Review remote access for unusual logins, geographies, device IDs, and off-hours activity.

Why this matters

Ransomware is usually not a single event. It is a sequence: access, escalation, lateral movement, data theft, then encryption. If you only look for encryption, you are already late.

Days 4-10: harden the obvious weak spots

This is where most teams make the biggest risk reduction in the shortest time.

On laptops

Remove local admin rights for standard users.
Enforce full disk encryption and modern screen-lock policies.
Patch browsers, VPN clients, collaboration apps, and OS builds.
Block unapproved scripts and macros.
Make sure every laptop is reporting telemetry into a central console.

On servers

Patch internet-facing servers first.
Separate admin accounts from daily-use accounts.
Restrict RDP, SSH, WMI, PsExec, and remote PowerShell to approved management paths only.
Review service accounts for excessive privileges and interactive logon rights.
Isolate domain controllers, backup servers, and identity infrastructure from general server traffic.

On identity

Turn on MFA everywhere for admins and remote access.
Kill legacy authentication where possible.
Audit dormant accounts and risky group memberships.
Rotate secrets for service accounts, API keys, and break-glass access.

Days 11-20: build detection that catches ransomware early

You do not want the first alert to be “files are encrypted.”

Watch for these behaviors

Mass file renames or rapid file modification
Shadow copy deletion
Backup service tampering
New scheduled tasks or services
Suspicious PowerShell or command-line activity
Credential dumping attempts
Lateral movement via remote tools
Unusual admin logons to multiple servers in a short period

Centralize the right telemetry

Bring laptop, server, identity, and cloud logs into one place. Siloed tools miss cross-domain attacks. Ransomware crews do not stay in one silo.

If you can, use one platform, agent, and console for endpoint, identity, cloud, SaaS, and SOC data. That gives you:

Complete attack context
Faster triage
Lower analyst burden
Cleaner response actions

With CrowdStrike, that is the Falcon platform approach, plus Charlotte AI for natural-language investigation and Falcon Next-Gen SIEM for unified analytics across the SOC.

Days 21-30: make recovery real

Risk drops when you can recover quickly, not when you hope you will.

Test recovery, don’t assume it

Restore a sample laptop image
Restore a sample server
Validate AD, DNS, and authentication dependencies
Check application rebuild order
Measure how long it actually takes

Harden backups

Keep immutable or offline backup copies
Restrict backup admin access
Separate backup credentials from domain admin credentials
Monitor backup jobs for tampering
Test recovery from clean media, not just from the backup dashboard

Segment the blast radius

Put critical servers in tighter network zones
Separate admin workstations from standard user devices
Keep backup networks isolated
Limit east-west movement between server tiers

Run a ransomware tabletop

Make sure IT, security, legal, comms, and leadership know:

Who declares an incident
Who can isolate systems
Who approves recovery steps
Who talks to employees, customers, and regulators
What “good enough to restore” means

What matters most on laptops

Laptops are where phishing, credential theft, and user-driven execution usually start.

Focus on:

EDR on every device
MFA on email and VPN
Standard user mode by default
Browser and app patching
Script and macro restrictions
Rapid containment for suspicious hosts
Visibility into downloads, browser activity, and remote tools

If you have remote workers, treat them like they are on an exposed network every day. Because they are.

What matters most on servers

Servers are where ransomware becomes an outage.

Focus on:

Internet-facing exposure first
Privilege separation
Remote admin restrictions
Service account hygiene
Patch SLAs for critical vulnerabilities
Tight backup access
Segmentation between application tiers

Servers should not be able to reach everything. Admins should not be able to log in everywhere. And backups should never sit one compromised credential away from encryption.

Where CrowdStrike helps you move faster

If you want to compress this 30-day plan, CrowdStrike can help you do it from one platform.

Stop breaches on every laptop and server

Falcon endpoint protection gives you cloud-delivered protection and detection across Windows, macOS, and Linux — with the ability to contain hosts fast and launch remediation remotely.

Prioritize what to fix first

Exposure Management gives you attack surface visibility and AI-powered vulnerability management so you can focus on the systems most likely to be abused, not just the longest CVE list.

Investigate faster

Charlotte AI helps analysts query telemetry and move from alert noise to answer. That matters when your team is already behind.

Modernize the SOC

Falcon Next-Gen SIEM brings endpoint, identity, cloud, SaaS, and server data into the Falcon console so you can correlate activity across domains instead of stitching together spreadsheets.

Add 24/7 response if your team is stretched

Falcon Complete Next-Gen MDR can accelerate containment, prioritization, and remediation when you do not have the internal coverage to chase every thread.

That is the operating model: find it, contain it, fix it fast. Not a PDF. Not a backlog.

A simple standard for the next 30 days

By day 30, you should be able to say:

Every laptop and server is covered by endpoint visibility
MFA is enforced for privileged access
Local admin has been reduced
Critical internet-facing systems are patched
Backups are immutable and restore-tested
High-risk vulnerabilities are prioritized by exploitability
Suspicious hosts can be contained in minutes
Your team has a tested ransomware response playbook

That is how you reduce risk quickly after a ransomware scare. Not with a long policy rewrite. Not with a point-in-time assessment. With visible controls, faster response, and fewer paths for an adversary to move.

If you want, I can turn this into a 30-day ransomware remediation checklist or a day-by-day rollout plan for a small security team.