It's a Tuesday afternoon. Someone on your team is finishing up a report, and their screen suddenly locks. Instead of their spreadsheet, there's a message demanding payment to get their files back.
That moment is scarier than it needs to be, mostly because most employees have never been told what to do next. The instinct is to panic, click around trying to make it go away, or quietly try to fix it themselves before anyone finds out. All three reactions make a ransomware attack worse.
The good news: there are only three steps to remember, and none of them require technical skill.
The 3 Things to Do Immediately
1. Take a picture of it. Use your phone to photograph the ransom message on the screen. Don't try to copy the text or take a screenshot on the infected device itself. This picture gives your IT team useful information fast, like which type of ransomware you're dealing with and what it's asking for.
2. Disconnect the device, and every other device on that network, from the internet. Turn off WiFi on the affected device immediately. Then do the same for every other device sharing that network. Ransomware spreads fast across a shared network, and cutting the connection is the single most effective way to stop it from reaching other computers, servers, or shared files.
3. Call your IT team right away. Don't wait to "see how bad it is" first. Don't try to close the message, restart the computer, or run an antivirus scan on your own. Every one of those actions can destroy evidence your IT team needs, or accidentally trigger the ransomware to do more damage. Report it immediately and let the professionals take it from there.
Why This Matters More Than Most Businesses Realize
Most ransomware damage doesn't happen in the first few seconds of an attack. It happens in the minutes after, while an employee is deciding what to do. A few minutes spent trying to fix it alone, or hoping it will go away, is enough time for ransomware to spread from one laptop to an entire network, including servers, shared drives, and backups.
This isn't a reflection of any one employee's judgment. Almost nobody is taught what a ransomware attack looks like or what to do when it happens, so most people default to the instincts that make sense anywhere else at work: stay calm, don't make a big deal out of it, try to fix it quietly. With ransomware, those same instincts work against you.
The businesses that recover quickly from a ransomware incident almost always have one thing in common. Their team already knew the three steps above before anything happened.
How Vector Choice Helps
This is exactly why we build security awareness training into the way we support our clients, not as a one-time presentation, but as an ongoing habit. Simple, repeatable steps like the ones above are far more effective when your team has heard them more than once and knows exactly what to do without having to think it through in the moment.
Layered cybersecurity protection, including monitoring, backups, and incident response, matters. But the fastest way to limit damage during an active attack is still a trained employee who knows to disconnect and call for help instead of guessing. That's the kind of readiness we help our clients build, long before they ever need it.
What to Do Next
Don't wait for an incident to find out whether your team knows what to do. Share these three steps with them today, and make a plan for how your business would respond if it happened tomorrow.
If you're not confident your current IT support would catch this fast enough, or your team hasn't had real security training recently, schedule a Discovery Call with Vector Choice. We'll walk through where your business stands today and what a stronger, more proactive security plan would look like.
Want a tip like this in your inbox every week? Subscribe to our Tech Tip emails and never miss a Tech Tip Tuesday.
