Skill UI

Plans, designs, and facilitates ransomware tabletop exercises that simulate multi-phase incidents with injects covering double extortion, backup destruction, and regulatory notification, enabling teams to practice decision-making and communication per NIST CSF/CISA guidance.

Guides structured recovery after a ransomware incident using NIST/CISA playbooks, covering environment isolation, Active Directory rebuild, backup validation, prioritized restoration, credential resets, and verification to prevent reinfection.

Deploys honeytoken decoy files across critical shares and endpoints, watches them with file-integrity or OS-level observers, and alerts SOCs when ransomware modifies, encrypts, or renames a canary, offering a precise detection layer that complements backups and EDR.