Ransomware Doesn’t Just Break Systems. It Breaks People.
Ransomware attacks are often discussed in terms of technical damage and financial loss, but their most profound impact is on people. The emotional and psychological tools for individuals and teams can be lasting. Early in my career, I flew to another city to help a company through a difficult ransomware attack. The company’s CEO met me at the airport. The moment he spotted me, he broke down in tears and cried on my shoulder. Over the years, I’ve learned that the most enduring impact of ransomware attacks is human: stress, fear, job loss, and long-term consequences that rarely show up in incident reports. Building true cyber resilience means prioritizing human resilience.
The Hidden Human Cost
Victims of ransomware attacks extend far beyond the immediate target. According to the FBI’s latest report on internet crimes, healthcare and public health were the top ransomware targets last year. Studies have shown that mortality rates increased in hospitals following a ransomware attack. While not all consequences are so severe, they can have a long-lasting impact. For example, I worked on a case in which a school was attacked and refused to pay. The threat actors personally threatened the parents of the students, warning that they would release the students' personal information.
During ransomware workshops, I am often surprised to learn that organizations often fail to build human resilience into their response plans. The workshops are built around a countdown: 48, 24, and zero hours. Around the 24-hour mark, I will ask: Did you send your team home to sleep? The silence is telling. The company has not planned for food, rest, or safe transportation; you cannot let someone safely drive home after being awake for 30 hours straight. Unfortunately, many IR plans are made by people who work 9 AM to 6 PM PT and have never tested the process at 2 AM on a Saturday.
Leadership’s Role in Building Human Resilience
Cyber resilience, which includes human resilience, is not the responsibility of IT or security teams alone. It must be a board-level responsibility, with the CEO accountable. The consequences touch the entire business. Emerging titles like Chief Resilience Officer are getting traction, but these leaders need real cross-functional authority across HR, facilities, and legal. A CISO alone cannot drive the cultural and organizational changes required for true resilience.
The three things organizations can do right now to improve human resilience:
- First, and most important, train, train, train. Go beyond tabletop exercises. Conduct realistic simulations at inconvenient times to expose gaps in plans and build muscle memory. Teams should know the plan and their roles instinctively. When you respond to an attack, it should be muscle memory.
- Second, define a clear chain of communication. I have watched a CISO stand over a responder’s shoulder and say, “Are you sure about that command?” That is a nightmare scenario: everyone needs to know their role and trust the person executing it before the pressure hits.
- Third, run a lessons-learned process after every simulation, not just real incidents. Training and improving in a continuous cycle builds muscle memory, which removes friction and stress exactly when it matters. If you are well-prepared, you remove human friction and stress.
Supporting People Under Pressure
Your employees, your security team, and impacted third parties, such as customers, all need human support during an incident. Stress is inevitable during an incident, but it can be managed. For those employees working the incident, encourage them to take breaks, even if only for a short walk or a glass of water. Returning with a fresh perspective can make a significant difference. Foster an environment where people can talk openly about their experience, so they don’t feel alone or helpless. Many responders find it difficult to share their work-related stress with family or friends who may not understand the pressure they face.
For example, cooking is one way that helps me deal with stress when managing incidents. I like inviting friends and family over to try new food from other countries. When I'm traveling, I also like to try different restaurants and then try to reproduce the menu items at home.
Remember, ransomware attacks test not just systems, but people. While AI can be an effective tool in managing incidents, humans must be at the center of improving human resilience. Incident response is a human process. Organizations that invest in human resilience through realistic training, clear communication, and ongoing support are better equipped to withstand and recover from these crises.
