The Next 250 Seconds: What to Do in the First Minutes of a Cyberattack
October is Cybersecurity Awareness Month, and this year the national theme from CISA is “Securing the Next 250,” a nod to the country’s 250th anniversary. The long view matters. But we want to talk about a much shorter window: the next 250 seconds.
By one widely cited estimate from Cybersecurity Ventures, a business falls victim to ransomware every 11 seconds. That works out to about 22 attacks in just over four minutes. When an attack reaches your business, those first few minutes decide whether you have a bad afternoon or a disaster, and the deciding factor is rarely your technology. It’s whether your people already know what to do.
How Cyberstone Helps You Own the First 250 Seconds
The companies that recover fastest from an attack have done three things before anything goes wrong:
- A written incident response plan. Cyberstone’s incident response planning gives your team a clear, plain-English plan: who does what, who gets called, and in what order.
- A plan that has been tested. Through ThreatXperience tabletop exercises, we walk your leadership and staff through a realistic attack scenario in a conference room, so the gaps show up in practice instead of during a real incident.
- Someone who owns it. A virtual Chief Information Security Officer (vCISO) keeps your plan current as people, vendors and systems change, so it still works the day you need it.
What Happens in the First 250 Seconds of an Attack
Every incident is different, but a typical ransomware attack often unfolds something like this:
- 0:00. Someone clicks a link or opens an attachment. Nothing looks wrong yet.
- 1:00. The attacker is inside, quietly looking for valuable data, backups and admin accounts.
- 2:00. Files begin to lock. The first employee notices something is off and wonders if it’s just a glitch.
- 3:00. The question everyone asks at once: “Who do we call?”
- 4:10. The difference between a contained incident and a company-wide shutdown is whether that answer was already written down.
Attackers count on that pause. The longer it takes a team to recognize and respond, the further an attack spreads.
Your First Moves When Something Goes Wrong
If you suspect an attack is underway, these steps protect your business in the first minutes:
- Isolate affected devices. Disconnect them from the network (unplug the cable or turn off Wi-Fi), but don’t power them off. Shutting down can destroy evidence investigators need.
- Alert your incident lead. Call the person named in your plan, not just whoever sits closest to IT.
- Preserve evidence. Don’t wipe, reinstall or “clean up” machines on your own. Take photos of ransom notes and error messages.
- Notify your cyber insurance carrier early. Many policies require prompt notice and may require you to use approved response firms.
- Don’t pay or negotiate yet. Decisions about ransom demands should wait until you understand what was taken and have expert and legal guidance.
- Communicate carefully. Use a phone call or an out-of-band channel if email may be compromised, and hold off on public statements until you know the facts.
Why a Plan on Paper Isn’t Enough
Many businesses have an incident response plan sitting in a shared drive. Far fewer have ever tested it. When we run tabletop exercises, the same gaps come up again and again: phone numbers that are out of date, backups that have never been restored, and no one who knows what the insurance policy actually requires.
A tabletop exercise finds those problems on a Tuesday afternoon with coffee, instead of at 2 a.m. with your data locked. It also builds the muscle memory that shortens the dangerous pause at the start of an attack.
Don’t Make It Easy for Them
The National Cybersecurity Alliance’s theme this year is “Don’t Make It Easy for Them,” and it pairs well with the 250-second mindset. A few basic habits reduce the odds that an attack gets started at all: turn on multi-factor authentication for email, install updates promptly, report suspicious messages instead of just deleting them, and use a password manager so every account has its own password. For a clear picture of where your business is most exposed, a vulnerability assessment is the fastest place to start.
Frequently Asked Questions
What is the theme of Cybersecurity Awareness Month 2026?
CISA’s 2026 theme is “Securing the Next 250,” tied to the country’s 250th anniversary. The National Cybersecurity Alliance is running “Don’t Make It Easy for Them.” Both focus on everyday habits like strong passwords, multi-factor authentication, spotting phishing and installing updates.
What should a business do in the first minutes of a cyberattack?
Disconnect affected devices from the network without powering them off, alert the person who owns your incident response plan, preserve evidence, and notify your cyber insurance carrier. Avoid paying or negotiating until you understand what happened and have expert guidance.
What is a tabletop exercise?
A tabletop exercise is a guided, discussion-based walkthrough of a realistic cyberattack scenario. Leaders and staff talk through how they would respond, which reveals gaps in the plan, contact lists and decision-making before a real incident does.
How often should an incident response plan be tested?
Most organizations should test their plan at least once a year, and again after major changes such as new systems, key staff turnover or a new cyber insurance policy. Regular testing keeps roles and contact details current.
The next 250 years will take care of themselves. The next 250 seconds are up to you. If you’re not sure your team would know exactly what to do, Cyberstone can help you build and test a plan that holds up. Talk with our team about incident response planning and tabletop exercises.