Behaviour-based detection and containment, mapped to your CIS controls.
The CIS 18 controls give you a prioritised path to defend against ransomware, but a safeguard only counts if it works once encryption starts. Helm adds behaviour-based detection and automatic containment to the controls an attack tests hardest, verifies data recovery and records every step, so you can show auditors, insurers and your board that your controls work in practice.
CIS has measured how well its own controls stand up to ransomware. The essential safeguards in Implementation Group 1 defend against 78% of ransomware ATT&CK techniques, and the full set against 92%. That is strong coverage, with a gap that attackers aim for.
Speed narrows it further. In Splunk’s tests, ten ransomware families took a median of 42 minutes to encrypt nearly 100,000 files, and the fastest, LockBit, under six minutes.
A control that relies on someone noticing an alert and acting by hand cannot keep that pace. The safeguards that matter in an attack need to act in seconds, and leave proof that they did.
The CIS Critical Security Controls, often called CIS18, are a prioritised set of security practices from the Center for Internet Security, a non-profit. The current version, v8.1 from June 2024, has 18 controls and 153 safeguards.
Safeguards are grouped into three Implementation Groups. IG1 is essential cyber hygiene with 56 safeguards, IG2 adds 74 for organisations with more complex environments, and IG3 adds the final 23 for those holding the most sensitive data.
CIS is a framework, not a law. Organisations use it to set their baseline, to answer insurers and auditors, and as a practical route to other frameworks, since v8.1 maps to NIST CSF 2.0.
Every control plays a part, but five carry the weight once ransomware is running. Control 10, malware defences, includes behaviour-based anti-malware (safeguard 10.7) for threats that signatures miss. Control 13, network monitoring and defence, asks for security alerts to be centralised (13.1). Control 17, incident response management, asks for a working response process (17.4) and post-incident reviews (17.8).
Control 11, data recovery, asks for an isolated copy of recovery data (11.4) and for recovery to be tested (11.5). Control 18, penetration testing, checks that all of this works against a real attacker.
Helm does not replace your CIS programme. It strengthens the five controls above at the moment they are tested.
Control 10. Helm watches file activity for the behaviour of encryption rather than known signatures, and detects it in under a second, alongside your antivirus and EDR.
Controls 13 and 17. Helm isolates the compromised accounts and devices on fixed, readable rules, with no AI in containment. Detections and actions go to your SIEM, so alerts arrive where your team already works. Each step is timestamped for your post-incident review.
Control 11. Helm verifies that systems are clean before recovery, so restored data is data you can trust.
Control 18. Helm can be included in red-team and penetration tests that emulate ransomware, showing whether your team detects and contains live encryption. [TBC]
The CIS Controls set the priorities. When ransomware starts, Helm puts the safeguards for detection, response and recovery to work in seconds, and leaves a record that shows how each one performed.
If you also report against NIST CSF, the same evidence carries across. To see how Helm maps to your own CIS safeguards, talk to us.
