Crisis Negotiators Outline How Firms Should Fight Ransomware Attacks
Crisis negotiators Michael Sjøberg and Peter Skovbo outline practical steps companies must take immediately after ransomware attacks to avoid costly early mistakes and restore control while limiting data loss.
Experienced negotiators describe the threat
Michael Sjøberg, a former Danish military hostage negotiator, and Peter Skovbo, who leads Delta Crisis in Switzerland, say ransomware attacks now resemble complex hostage situations rather than simple IT incidents.
They warn that attackers combine technical sabotage with psychological pressure to force rapid, costly decisions from executives and incident teams.
Their current guidance emphasizes coordinated action across legal, technical, communications and executive functions to prevent chaos in the first hours.
Critical errors made in the first hours
Both experts identify the opening hours after an intrusion as the most dangerous period for victims of ransomware attacks.
Common mistakes include rushed payments, premature public statements, and uncoordinated attempts to reconnect systems that destroy forensic evidence.
Sjøberg and Skovbo stress that those errors often increase leverage for extortionists, raise regulatory exposure, and prolong operational disruption.
Immediate steps recommended by crisis teams
Negotiators recommend an initial, predefined checklist activating technical containment, legal counsel, and a crisis communications lead within the first 60–90 minutes.
Containment should isolate affected networks while preserving logs and snapshots to enable forensic analysis and law enforcement collaboration.
At the same time, a single executive spokesperson should be appointed to maintain consistent external messaging and reduce opportunistic misinformation.
Negotiation strategy and communication discipline
Sjøberg draws on hostage-negotiation principles to advise that companies avoid direct emotional responses and never engage in ad-hoc bargaining with attackers.
Skovbo adds that keeping channels open to neutral third parties, such as specialized crisis brokers or independent negotiators, can help manage demands without conceding unnecessary terms.
Clear rules of engagement—who speaks to whom and what information may be disclosed—are essential to avoid escalating leverage for the threat actor.
Technical containment and evidence preservation
IT teams must prioritize containment over immediate system recovery, according to the crisis advisers, because premature restoration can overwrite volatile forensic data.
They recommend creating forensic images of infected systems, documenting chain-of-custody for evidence, and preserving backups in immutable storage to support later recovery and potential legal action.
Working with independent forensic firms and notifying relevant authorities early improves the chances of identification and recovery while meeting regulatory obligations.
Regulatory and legal obligations to consider
Skovbo warns that companies may face reporting duties under data-protection and national security rules depending on the scale and nature of the breach.
Legal teams should assess notification timelines, preserve privileged communications, and evaluate liability exposures related to customer or employee data.
Prompt legal advice helps align crisis response with compliance requirements and can reduce fines and civil risk in many jurisdictions.
Restoration priorities and rebuilding resilience
Once containment is confirmed, companies should prioritize restoring critical services, validating system integrity, and deploying hardened configurations to reduce repeat incidents.
Sjøberg and Skovbo urge organizations to treat the episode as a learning opportunity, conducting structured post-incident reviews to revise playbooks and governance.
Investments in segmented networks, resilient backups, tabletop exercises, and cross-disciplinary incident teams significantly shorten recovery time and reduce long-term costs.
Cost-benefit view on ransom payments
The advisers caution that payments should never be the default option and that the decision must be evaluated by multidisciplinary teams with law enforcement input when possible.
Payments can incentivize further attacks, offer no technical guarantee of full data recovery, and complicate regulatory compliance depending on sanctions regimes.
Where organizations consider payment, negotiators recommend engaging certified intermediaries and documenting all steps to preserve legal defensibility.
Companies facing ransomware attacks, the two crisis negotiators conclude, regain the best chance of control by combining disciplined negotiation principles with sound technical forensics and clear legal oversight.
The presence of trained negotiators, early preservation of evidence, coordinated communications, and an agreed chain of decision-making reduce error-driven costs and speed recovery.
Executives who prepare in peacetime—establishing roles, playbooks and trusted external advisors—significantly increase the odds of an effective, compliant response.
Preparedness now determines outcomes later: firms that integrate negotiation discipline, forensic rigor, and legal compliance into their ransomware response plans will limit disruption and protect value when incidents occur.
