Claranet launches Ransomware Readiness Simulation to turn control assumptions into evidence

Claranet has launched Ransomware Readiness Simulation, a controlled technical assessment that gives customers evidence of how their security controls detect, investigate, and respond to selected ransomware activity. The service turns observed gaps into practical, risk-prioritised improvements, helping security and business leaders make better-informed decisions about cyber resilience.

The assessment uses ransomware families relevant to the customer's sector. Our specialists execute selected live samples and behaviour-based techniques against a copy of the customer's standard gold-build image in an isolated sandbox. No production encryption or destructive impact takes place.

Working within a collaborative purple team, our offensive specialists work alongside the customer's defensive team to validate detection, alerting, and triage. Every executed technique is mapped to MITRE ATT&CK, the framework of adversary tactics and techniques, and classified as detected, partially detected, or not detected.

The assessment examines telemetry availability, endpoint detection effectiveness, alert quality, event correlation, analyst triage, and containment readiness. Time to detect and time to investigate are captured only where data is available. Findings link observed gaps to the behaviours that exposed them, supporting remediation decisions based on evidence rather than assumptions.

Customers receive a single consolidated report containing an executive summary and detection maturity rating, technical findings, a detection-response matrix, and a prioritised 30/60/90-day improvement roadmap. A senior colleague reviews the report before release. The output gives practitioners a focused improvement plan and business leaders a clearer basis for prioritising security investment.

The simulation is a scoped, point-in-time assessment of the test environment and the techniques executed. It does not guarantee the absence of other weaknesses. It is not a backup recovery test, an always-on monitoring service, or an incident response service.

Customers can purchase a defensive detection workshop, additional ransomware family coverage, recurring simulations, or findings debrief separately. Recurring simulations are booked as separate engagements.

Claranet will introduce the assessment at a launch webinar on Thursday 26 November 2026, from 11:00 to 11:30 GMT. Register to explore how evidence from a controlled simulation can inform detection and response priorities: Webinar registration link