As of 13 August 2026, AI can only partly respond to a ransomware attack.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open your incident log and record when the attack was noticed, what is confirmed, which systems are affected, what has already been disconnected and who is making decisions.
   2. Use a separate trusted device or phone to contact your cyber insurer, managed security provider or incident-response firm, and your IT lead; do not rely on the suspected environment for those contacts.
   3. Preserve the ransom note, alerts, relevant emails and system details in their original form, and do not paste credentials, private keys, personal data or unredacted logs into a chatbot.
   4. Paste the redacted facts and the prompt into a chatbot to produce a fact summary, action checklist, evidence list, handover brief and draft messages.
   5. Have the incident-response lead compare each proposed action with your business continuity plan, insurer instructions and current UK official guidance before anyone changes networks, accounts, backups or devices.
   6. Send only the approved staff, customer or supplier messages, keep the incident log updated, and let the qualified responder and data-protection solicitor decide on containment, restoration, ransom contact and any notifications.

   Prompt

   Act as a planning and documentation assistant during a suspected ransomware incident in a UK business. Do not claim that you have investigated the systems, do not diagnose the intrusion, and do not give destructive commands or instructions to pay a ransom. Do not invent facts, deadlines, legal duties or technical findings. Treat every proposed technical action as requiring approval from our incident-response lead or qualified security professional.
   
   Using only the information below, produce:
   1. A fact-only incident summary, separating confirmed facts, unverified reports and unknowns.
   2. A prioritised checklist for the next actions, with the owner, dependency and risk of each action.
   3. A list of evidence to preserve, without altering affected systems.
   4. Questions to ask our cyber insurer, incident-response provider, IT administrator and data-protection solicitor.
   5. A short internal message telling staff what to do and what not to do.
   6. A short holding message for customers or suppliers only if one is appropriate, clearly marked for professional approval.
   7. A list of decisions that must not be made by the chatbot, including containment, restoration, ransom payment, notification and public statements.
   8. A handover brief that a qualified incident responder can use.
   
   Use plain British English. Do not include credentials, passwords, private keys, personal data or unredacted logs in your answer. Where UK reporting or data-protection obligations may apply, say that the responsible professional must check current GOV.UK and ICO guidance rather than stating an unverified rule.
   
   Business: [business name and sector]
   Incident started or was noticed: [time and date]
   Confirmed symptoms: [symptoms]
   Affected devices, accounts or services: [list]
   Systems still available: [list]
   Backups and recovery information: [known facts only]
   Ransom note or attacker contact: [redacted text or description]
   Actions already taken: [list]
   People and suppliers available: [roles and contact routes]
   Existing incident-response plan: [paste relevant redacted section]
   Known personal or commercially sensitive data involved: [known facts only]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.