How Immune detects, contains, and heals a ransomware attack

The ransomware timeline, and where Immune intervenes

To understand how Immune works, it helps to understand how a modern ransomware attack actually unfolds. It rarely begins with an obvious explosion. It begins quietly. An attacker gains an initial foothold — often through a stolen credential or a compromised remote-access session — and then spends time moving carefully through the network, escalating privileges, mapping where the valuable systems and the backups live. Only at the end does encryption begin, and by then the attacker has usually already stolen data to use as extra leverage. The industry describes these phases as a kill chain: initial access, persistence, lateral movement, pre-encryption staging, and finally encryption.

Traditional defenses concentrate almost everything at the two ends of that chain — trying to block the initial intrusion, then reacting once encryption is obvious. The long, quiet middle, where the attacker is most vulnerable to detection, goes largely unwatched. Immune is designed to intervene across the whole chain, and especially in that middle, so that the attack is caught while there is still time to stop it without disruption.

Step 1 — See everything: continuous monitoring and deception

Immune begins with visibility. Its monitoring engines observe the network and the hosts continuously: the connections between systems, the protocols in use, the processes running on servers, and the rate at which files are being changed. This is where the quiet middle of the kill chain becomes loud. Lateral movement across internal systems, unusual remote-desktop or file-sharing activity, and the beaconing pattern of a command-and-control channel all stand out against a learned baseline of what normal looks like for your environment.

Alongside this passive watching, Immune plants deception. Decoy files that look exactly like real clinical or business documents are placed where an attacker is likely to go, but where no legitimate workflow ever will. Because a real user never touches these files, any interaction with them is almost certainly hostile. The moment ransomware tries to read or encrypt a decoy, Immune has a high-confidence signal — typically within about two seconds — that an attack is underway. Deception is one of the fastest and most reliable early-warning signals in security, and it is a first-class part of the platform rather than an afterthought.

Step 2 — Verify who is really there: continuous access checks

The hardest ransomware to catch is the kind that uses your own credentials and your own administrative tools. When an attacker logs in with a valid account and runs legitimate software, signature-based defenses see nothing wrong. Immune addresses this by verifying access continuously rather than trusting a login once. Every request to reach a protected system is scored for how well it matches the established behavior of that user, device, and credential. A backup service account suddenly browsing patient records at three in the morning, or an identity behaving nothing like its own history, is challenged or blocked even though the credential is technically valid.

Step 3 — Understand it: one clear diagnosis

Signals are only useful if someone can make sense of them quickly. Immune's detection engine fuses everything — behavioral anomalies, deception hits, network intelligence, and known-threat matches — into a single diagnosis. That diagnosis is not a cryptic alert code. It states, in plain language, whether this is ransomware, which stage of the attack it has reached, which systems are affected, how far it could spread, and what it recommends doing about it, all with a confidence score. This is what turns a flood of raw alerts into a decision a security team, or the platform itself, can act on immediately.

Step 4 — Stop the spread: contain within a safe boundary

When the diagnosis is confident and the action is safe, Immune acts on its own. It blocks the malicious source at the network boundary, revokes the compromised credentials and their active sessions, and isolates the affected host or segment so the attacker cannot move sideways to other systems. This microsegmentation is what turns a would-be hospital-wide event into a contained one. Crucially, any action that could interrupt live patient care is held for a one-click human approval, and the malicious source is blocked in the meantime. A security tool that shuts down a system in the middle of a procedure would be its own kind of harm; Immune is engineered to avoid that.

While containment runs, Immune can enter a continuity mode that keeps critical read-only access to records available where it is safe to do so, so that clinicians are not left completely blind during the response.

Step 5 — Undo the damage: self-healing recovery

Containment ends the attack; self-healing ends the incident. Immune maintains verified, immutable, air-gapped recovery points that ransomware cannot alter or delete — because attackers target ordinary backups first, ordinary backups are not enough. When it is time to recover, Immune confirms that a backup predates the attack and passes an integrity check, then restores systems in clinical dependency order: identity and network services first, then the electronic health record, then the imaging, laboratory, and pharmacy systems that rely on them. Each system is checked for any lingering compromise before it is returned to service, so recovery is provably clean rather than a hopeful guess.

Step 6 — Get smarter and change shape

After the incident, two things happen. The platform records what it learned, so its detection of that pattern becomes faster and more confident next time. And its moving-target defense rotates the decoys and shifts parts of the environment's observable layout, so that whatever reconnaissance the attacker performed is now stale. The immune-system analogy holds all the way through: isolate, neutralize, repair, and remember.

The loop, summarized

• Detect — behavioral monitoring plus deception surface the attack in seconds.
• Verify — continuous access scoring catches valid-credential abuse.
• Diagnose — one explainable verdict with confidence and blast radius.
• Contain — block, isolate, and revoke, gated for patient safety.
• Self-heal — restore clean, in clinical order, and validate.
• Learn & morph — sharpen detection and change the attack surface.