A crypto locker fires on a workstation at 4:02 on a Friday.
EDR flags encryption behaviour and isolates the machine from the network
A technician confirms, kills persistence, starts the wipe
Machine re-imaged from the standard build; files restored from backup
You get a report on where it came from, and the hole is closed
















