Detect the encryption. Isolate the identity. Keep the rest running.
Ransomware containment is how you stop ransomware spreading once it is inside. The attack is contained where it touches your data, before it reaches the next server, file share or account. Helm detects active encryption in under a second and isolates the compromised identity, using fixed rules your team can read and audit. The rest of the organisation keeps working while your team deals with a contained incident.
Ransomware often spreads faster than a team can read, confirm and act on an alert. CrowdStrike’s 2026 Global Threat Report puts the average eCrime breakout time in 2025, from first access to the first move to another system, at 29 minutes. The fastest took 27 seconds.
Encryption is quicker still. In 2022, Splunk’s SURGe team timed ten ransomware families encrypting close to 100,000 files. The median was 42 minutes 52 seconds, and LockBit’s was 5 minutes 50 seconds. A response that waits for an analyst to triage and get approval gives much of that window away. At the fastest rate measured, a thirty-minute human loop is 750,000 files.
Containment therefore has to be agreed in advance and carried out automatically, and measured on two clocks. How quickly malicious writes are stopped, which sets how much data is affected, and how quickly containment is complete, which closes the route back in.
750,000 files encrypted
What a thirty-minute human loop costs at the fastest measured encryption rate
Helm watches the places where ransomware does its damage. File servers, shared drives, SAN and NAS storage, Microsoft 365 including SharePoint Online and OneDrive, and server infrastructure. Machine learning and behavioural sensors separate normal file activity from encryption, and Helm detects active encryption in under a second.
Containment follows straight away. Helm isolates the compromised identity, revokes its sessions and access permissions, disables the account and contains lateral movement across identity and file systems, and through your endpoint tool where it is supported, with the actions running in parallel. Each containment decision runs on fixed rules your team can read, with no AI making the call, so every action can be explained afterwards to the board, an auditor or a regulator.
In a documented incident in March 2026, Helm reached full containment 8.9 seconds after the first malicious file event, with 14 files encrypted and 10 containment actions running in parallel. That is a demonstrated result from one incident, not a service level. The figure for your own estate starts with knowing where you stand today. Ask for an assessment of your security posture, and we will show you how your current controls would handle live encryption, and what containment would look like in your infrastructure.
Many attacks begin well before encryption, with a valid username and password used over a remote desktop (RDP) session to reach a server. Sophos found RDP abused in 90% of the attacks its incident responders handled in 2023. Server Intrusion Protection adds device-free multi-factor authentication to RDP sessions on your servers, so a stolen password on its own is not enough to log in.
Each server login is recorded, which helps your team investigate an incident and answer audit and cyber insurance questions about how remote access is controlled.
Virtual infrastructure needs the same attention, because one compromised VMware ESXi host can hold many servers. Virtual Server Protection covers VMware vSphere and ESXi environments, and how Helm protects that virtual layer is set out under Prepare for the attack.
Helm acts on the identity and access paths involved in the attack and leaves the business online, so the organisation does not have to shut down every server to stop the spread.
Helm works alongside the tools you already run, with no rip and replace. Containment events flow into SIEM platforms such as Splunk and Microsoft Sentinel, and Helm works with EDR tools including Microsoft Defender, CrowdStrike and SentinelOne, so analysts see what happened where they already work.
Every action is logged as it happens, which gives your team a forensic timeline of the incident without assembling it by hand. That record is the starting point for verified recovery and for the evidence regulators ask for.
A security operations team receives the alert with containment already complete and starts work from a contained incident. The CISO can answer the board's question about what happened with a timestamped record of each action. For the CIO or CTO, the systems the attack did not touch stay online throughout.
Containment is the second of four outcomes in how Helm works, after readiness and before verified recovery and proof. To see how fast containment runs on your own infrastructure, talk to us about a containment test in your estate.
