Contain ransomware in seconds, keep public services running and have the evidence ready for your next assessment.
Ransomware in the public sector puts more than systems at risk. Councils, agencies and other public bodies run services people depend on every day, often across many sites, on older systems and with small teams. Helm contains ransomware at the data layer, so public services can keep running and builds the record your auditors, regulators and elected members expect.
Councils, agencies and other public bodies run services people use every day, from housing and benefits to social care and libraries. Many do it across several sites, on systems that have been in place for years, with small IT teams.
Ransomware attacks on government reach those systems. In Sophos’s 2024 survey of US state and local government, 98% of ransomware attacks ended in data encryption. Attackers tried to compromise backups in 99% of attacks and succeeded in 51% of them, and the average cost of recovery more than doubled to $2.83 million.
98%
of ransomware attacks on government ended in data encryption, up from 76% a year earlier.
When the British Library was hit by the Rhysida ransomware group in October 2023, attackers encrypted or destroyed large parts of its server estate. The less that is encrypted, the less there is to restore, and that matters most where older systems are involved. Helm contains encryption as it starts, on the servers where it happens, so recovery has less to rebuild. The Library’s own review put the lesson plainly.
‘Legacy’ systems are not just hard to maintain and secure, they are extremely hard to restore.
British Library, “Learning lessons from the cyber-attack”, incident review, 8 March 2024, p. 18
In the UK, GovAssure assesses government’s critical systems against the NCSC Cyber Assessment Framework (CAF). The CAF covers managing risk, protecting against attack, detecting events and minimising the impact of an incident.
NHS trusts, integrated care boards and other NHS bodies in England have used a CAF-aligned Data Security and Protection Toolkit since September 2024, so ransomware in the NHS is assessed in the same terms.
In the EU, NIS2 brings public administration into scope, and member states can extend it to regional and local bodies. Our NIS2 overview explains what that means in practice.
What these frameworks share is a focus on outcomes. Services that keep running, and a clear account of how an incident was handled. Helm supports both. It helps keep services running during an incident and records every step, mapped to frameworks including CAF and NIS2, as evidence for your next assessment.
Helm protects the file servers and shares where public data lives, on your own sites and in Microsoft 365. It works alongside older systems rather than requiring them to be replaced, with no agents on endpoints.
When encryption starts, Helm detects it in under a second and responds automatically on rules your team sets, with no AI involved and no one needed at a screen at night or at the weekend. It isolates the compromised accounts and devices, so the rest of the organisation keeps serving the public.
Recovery is not done until it is verified clean. Helm verifies that systems are clean before they come back, so services return on a sound footing, not with the attack still inside.
Every detection, containment action and recovery check is logged as it happens, with a timestamp. That record helps your team report to regulators and the data protection authority, brief elected members and answer an assessor.
Control starts before an attack, by knowing where it could spread. When it hits, the attack is contained in seconds and services can keep running. Afterwards, systems come back only once they are verified clean, with a record that shows how it was handled.
Public services keep their promise to the people who rely on them. Hospitals and health systems face the same. To see what this looks like for your organisation, talk to us.
