Last week, federal agents arrested a cybersecurity executive at a conference in Pennsylvania. His specialty was helping businesses that had been hit by ransomware negotiate with the attackers. He co-founded a firm built around that work.
According to court records, he’s now charged with conspiracy to commit extortion, and multiple reports have linked the arrest to the FBI’s investigation into the hacking group that recently claimed a breach of the bureau’s own systems. He has not been convicted, and the facts will be decided in court.
Whatever the outcome, the case has the security industry asking an uncomfortable question. When a business is at its most vulnerable, how carefully does it actually choose who it lets in?
What you hand over in the first 24 hours
When a ransomware attack or serious breach hits, the business suddenly needs outside help, and it needs it fast. The people brought in during those first hours typically get:
- Access to compromised systems and administrator credentials
- Visibility into exactly what was taken and how damaging it is
- A role in communicating with the attackers
- Influence over whether, when, and how much money changes hands
That’s an extraordinary level of trust. In most situations, a business would never give that kind of access to a provider it had known for a few hours.
Why crisis decisions get made with the least vetting
It isn’t careless to call the first credible name you find when systems are down. It’s human. The phones are ringing, operations have stopped, and every hour feels expensive. Under that pressure, the questions you’d normally ask, references, ownership, how they get paid, who on their team will actually touch your systems, tend to get skipped.
This is the core problem. The most consequential vendor decision a business might ever make is usually made in the worst possible conditions.
Questions worth answering before anything happens
The fix isn’t to distrust incident response firms. The vast majority do honest, difficult work. It’s to make the decision calmly, ahead of time, when you can actually evaluate your options.
- Who is our first call? A named firm and a named contact, written into your incident plan.
- How are they paid? Fee structures tied to the size of a ransom payment create the wrong incentive. Flat or hourly fees keep everyone pointed at your interests.
- Who owns them, and who will actually do the work? The firm you vetted and the people who show up should be the same.
- What does our cyber insurance require? Many policies expect you to use pre-approved responders. Finding that out mid-incident is a problem.
- What access will they need, and how is it removed afterward? Temporary access that’s never revoked becomes its own risk.
Where to start
The businesses that recover well from incidents usually aren’t the ones with the biggest security budgets. They’re the ones that already knew who to call, why they trusted them, and what that partner would and wouldn’t have access to.
If your incident plan doesn’t yet have a vetted name on it, that’s worth fixing while things are quiet. One Request connects you with a network of 700+ vetted specialists, including incident response and security partners, so the choice gets made on your terms, not under pressure.