Skip to content
flowss
Start freeChecking your session
Decision tree templates

Decision Tree — Ransomware Response: Restore, Pay or Rebuild

An incident-response cost tree: restoring from immutable backups, with a fallback rebuild if they were also encrypted, rolls back to an expected $676k against $1,980k for rebuilding and $1,995k for paying the ransom, whose tail runs to $4,000k when the decryptor fails. Illustrative values.

Decision treeOperations & OpsDecision tree syntax docs
Template previewDecision tree
Ransomware on the file servers — restore, pay or rebuild?Ransomware on the file servers — restore, pay or rebuild?Expected total incident cost, US$ thousands — downtime, recovery labour, legal and notification1 decision · 4 chance nodes · 9 outcomes · minimise E[cost]OPTIMAL STRATEGYRestore from immutable backups·E[cost] $676kPay the US$1.2M demandcost $1,200k · net $1,995kRebuild from scratchcost $400k · net $1,980kWorks fully65%Works partially20%Fails or re-extorts15%Three weeks60%Five weeks40%DecryptorE[cost] $795k$300knet $1,500k$900knet $2,100k$2,800knet $4,000kRebuild durationE[cost] $1,580k$1,300knet $1,700k$2,000knet $2,400kRestore from immutable backupscost $120k · net $676kClean restore point70%Partly corrupted25%Backups also encrypted5%On schedule60%Overruns40%Recovery routeE[cost] $676kBackup integrityE[cost] $556k$300knet $420k · P 70%$860knet $980k · P 25%Fallback rebuildE[cost] $2,620k$2,300knet $2,420k · P 3%$3,100knet $3,220k · P 2%DecisionChanceOutcomeOptimal strategyRejected alternativeRisk profile·cumulative probability by first choice0%25%50%75%100%$0$500k$1,000k$1,500k$2,000k$2,500k$3,000k$3,500k$4,000k$4,500kfinal costFIRST CHOICEE[COST]Restore from immutable backups$676kσ $538k · worst $3,220kPay the US$1.2M demand$1,995kσ $874k · worst $4,000kRebuild from scratch$1,980kσ $343k · worst $2,400kWhat the rollback showsBest first choice: “Restore from immutable backups”, E[cost] $676k — $1,304k below the next best, “Rebuild from scratch” ($1,980k).Following it, the cost ranges from $420k to $3,220k across 4 possible results, standard deviation $538k; a 30% chance the cost exceeds its expectation.“Restore from immutable backups” stochastically dominates “Pay the US$1.2M demand”: at every threshold it is at least as likely to do better, so no decisionmaker who prefers lower cost should choose “Pay the US$1.2M demand”, whatever their attitude to risk.Note: Paying a ransom may breach sanctions law and does not end a data-theft extortion; take legal advice first.Note: Illustrative values for a fictional 600-seat firm with immutable nightly backups.

Make it your own.

title "Ransomware on the file servers — restore, pay or rebuild?"
subtitle "Expected total incident cost, US$ thousands — downtime, recovery labour, legal and notification"
currency $
unit k
objective min
measure "E[cost]"
probabilities percent
branches orthogonal
risk-profile compare
note "Paying a ransom may breach sanctions law and does not end a data-theft extortion; take legal advice first."
note "Illustrative values for a fictional 600-seat firm with immutable nightly backups."

decision "Recovery route"
  "Restore from immutable backups" cost 120 -> chance "Backup integrity"
    "Clean restore point" p 70% -> 300
    "Partly corrupted" p 25% -> 860
    "Backups also encrypted" p rest -> chance "Fallback rebuild"
      "On schedule" p 60% -> 2,300
      "Overruns" p rest -> 3,100
  "Pay the US$1.2M demand" cost 1,200 -> chance "Decryptor"
    "Works fully" p 65% -> 300
    "Works partially" p 20% -> 900
    "Fails or re-extorts" p rest -> 2,800
  "Rebuild from scratch" cost 400 -> chance "Rebuild duration"
    "Three weeks" p 60% -> 1,300
    "Five weeks" p rest -> 2,000