top of page

Ransomware incident response and threat actor engagement

STORM's ransomware specialists perform technical forensic investigations for the recovery of IT and coordinate expert ransomware negotiations and settlement to minimise losses.

Ransomware first responders

You’ve suffered a ransomware attack and need help

How do you negotiate with the attacker, restore your systems, and recover after the incident?

With over 25 years experience investigating cyber incidents, STORM Guidance helps businesses affected by cybercrime to coordinate an immediate and quality technical response. As part of this service, our ransomware specialists will perform a technical forensic investigation for the recovery of IT and coordinate expert ransomware negotiation to minimise loss. Alternatively, STORM provides individual aspects of our ransomware response service, propping up your existing teams.


What we do

When your business has suffered a breach, acting fast can be the difference between recovery and disaster.

You will need to secure a stable position with intelligence-based analysis of your risk and formulate tactical options to minimise loss. We work with clients and their legal advisors to obtain a clear picture of potential impact and how best to respond.


Our Ransomware First Responders will obtain the best position possible and drive the best attainable outcome.

STORM specialists determine what data has been encrypted, the path they took to gain entry, and negotiate with extortionists to recover it, enabling you the space to focus on internal recovery.

How can STORM help?

Ransomware response services

Investigation & response

  • 24/7 access to specialists

  • Coordinated investigative and restorative response

  • Procurement of decryption tools and execution of decryption process

Ransom settlement

  • Full sanctions checks and reporting with any necessary liaison with law enforcement & regulators

  • Facilitate payments in a range of cryptocurrencies

  • Complete financial accounting and interaction with insurers where required

  • Blockchain analysis & tracing

Threat actor engagement

  • Former Law Enforcement Agent extortion negotiators

  • Complete Operational Security (OpSec) compliance and identity protection

  • Formulation and execution of client sanctioned negotiation objectives to drive optimum outcomes

Recovery support

  • Legal and crisis advice

  • Fast decryption capability

  • Public relations support

  • Trauma counselling for victims of crime

Why STORM Guidance?

Effective processes, informed decisions and empathetic understanding

We work with you to ensure that an effective process is followed, and key decisions are informed, with quality intelligence and empathetic understanding. We have extensive experience of digital investigations in both commercial and law enforcement.

Our experts are former Law Enforcement Agents specialising in kidnap and ransom negotiations, bringing calm and rigor to assist in achieving the very best outcomes. We have extensive experience in digital investigations and crisis management, enabling you to maximise the quality of response to ransomware, and minimise losses.

bottom of page