[](https://www.paloaltonetworks.com/?ts=markdown) * [](https://www.paloaltonetworks.com/?ts=markdown) * Products Products AI Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-AIRS-logo-nav.svg)](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) [AI Security Platform](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Gateway](https://www.paloaltonetworks.com/ai-security/ai-gateway?ts=markdown) * [AI Supply Chain Security](https://www.paloaltonetworks.com/ai-security/ai-supply-chain-security?ts=markdown) * [AI Red Teaming](https://www.paloaltonetworks.com/ai-security/ai-red-teaming?ts=markdown) * [AI Runtime Security](https://www.paloaltonetworks.com/ai-security/ai-runtime-security?ts=markdown) * [Agent Identity Security](https://www.paloaltonetworks.com/ai-security/agent-identity-security?ts=markdown) * [AI Posture Management](https://www.paloaltonetworks.com/prisma/cloud/ai-spm?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) Secure GenAI Tools * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) Network Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/strata-logo-nav.svg)](https://www.paloaltonetworks.com/network-security?ts=markdown) [Secure the Network](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [OT / Industrial Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [Device \& IoT Security](https://www.paloaltonetworks.com/network-security/device-security?ts=markdown) * [5G Security](https://www.paloaltonetworks.com/network-security/5g-security?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense?ts=markdown) * [Quantum Safe Security](https://www.paloaltonetworks.com/network-security/quantum-safe-security?ts=markdown) * [Next-Gen Trust Security](https://www.paloaltonetworks.com/network-security/next-gen-trust-security?ts=markdown) SASE [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-sase-logo-nav.svg)](https://www.paloaltonetworks.com/sase?ts=markdown) [Secure Access (SASE)](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma Access (ZTNA)](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) Security Operations [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-logo-nav.svg)](https://www.paloaltonetworks.com/cortex?ts=markdown) [Security Operations](https://www.paloaltonetworks.com/cortex?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Security Orchestration \& Automation](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown) * [Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown) * [Threat Intelligence Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown) * [Agentic-first Automation](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown) * [Identity Threat Detection and Response](https://www.paloaltonetworks.com/cortex/itdr?ts=markdown) [Endpoint Security](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) * [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown) [Data Security](https://www.paloaltonetworks.com/cortex/data-security?ts=markdown) Cloud Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-cloud-logo-nav.svg)](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [Application Security Overview](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Application Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/application-security-posture-management?ts=markdown) * [Software Supply Chain Security](https://www.paloaltonetworks.com/cortex/cloud/software-supply-chain-security?ts=markdown) * [Infrastructure-as-Code (IaC) Security](https://www.paloaltonetworks.com/cortex/cloud/infrastructure-as-code-security?ts=markdown) * [Software Composition Analysis](https://www.paloaltonetworks.com/cortex/cloud/software-composition-analysis?ts=markdown) * [Secrets Security](https://www.paloaltonetworks.com/cortex/cloud/secrets-security?ts=markdown) * [Open Partner Ecosystem](https://www.paloaltonetworks.com/cortex/cloud/appsec-partner-ecosystem?ts=markdown) [Cloud Posture Security Overview](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-security-posture-management?ts=markdown) * [Cloud Infrastructure Entitlement Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown) * [Data Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/data-security-posture-management?ts=markdown) * [AI Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/ai-security-posture-management?ts=markdown) * [Vulnerability Management](https://www.paloaltonetworks.com/cortex/cloud/vulnerability-management?ts=markdown) * [Cloud Attack Surface Management](https://www.paloaltonetworks.com/cortex/cloud/attack-surface-management?ts=markdown) [Cloud Runtime Security Overview](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Cloud Detection and Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Container \& Kubernetes Security](https://www.paloaltonetworks.com/cortex/cloud/kubernetes-and-container-security?ts=markdown) * [Cloud Workload Protection](https://www.paloaltonetworks.com/cortex/cloud/cloud-workload-protection?ts=markdown) * [API Security](https://www.paloaltonetworks.com/cortex/cloud/api-security?ts=markdown) * [Serverless Security](https://www.paloaltonetworks.com/cortex/cloud/serverless-security?ts=markdown) Observability ^NEW^ [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortex/xcor/cortex-xcor-logo-nav-2.svg)](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) Observability \& Remediation * [AI-Driven Observability](https://www.paloaltonetworks.com/cortex/xcor/ai-driven-observability?ts=markdown) * [Distributed Tracing](https://www.paloaltonetworks.com/cortex/xcor/distributed-tracing?ts=markdown) * [Log Management](https://www.paloaltonetworks.com/cortex/xcor/log-management?ts=markdown) * [Metrics Monitoring](https://www.paloaltonetworks.com/cortex/xcor/metrics-monitoring?ts=markdown) Identity Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/idira-logo-nav.svg)](https://www.paloaltonetworks.com/idira?ts=markdown) [Human Identities](https://www.paloaltonetworks.com/idira/human?ts=markdown) * [Modern PAM](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) [Machine Identities](https://www.paloaltonetworks.com/idira/machine?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) [See All Products](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [![Overview icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Overview](#products-panel-0) * [![AI Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-prisma-blue.svg) AI Security](#products-panel-1) * [![Network Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-strata.svg) Network Security](#products-panel-2) * [![SASE icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-prisma-blue.svg) SASE](#products-panel-3) * [![Security Operations icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Security Operations](#products-panel-4) * [![Cloud Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Cloud Security](#products-panel-5) * [Observability ^NEW^](#products-panel-6) * [![Identity Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-idira.svg) Identity Security](#products-panel-7) [See All Products](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) [![AI Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-AIRS-logo-nav.svg) AI Security Discover, assess and protect AI apps, agents and employee use of GenAI tools](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) [![Network Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/strata-logo-nav.svg) Network Security AI-powered NetSec with next-gen firewalls, inline defense and unified management](https://www.paloaltonetworks.com/network-security?ts=markdown) [![Security Operations icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-logo-nav.svg) Security Operations Stop cyberattackers with the industry's premier platform for autonomous security operations](https://www.paloaltonetworks.com/cortex?ts=markdown) [![Observability \& Remediation NEW icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortex/xcor/cortex-xcor-logo-nav-2.svg) Observability \& Remediation ^NEW^ Prevent downtime with the AI-driven platform that delivers autonomous remediation](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) [![SASE icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-sase-logo-nav.svg) SASE Protect with AI, secure AI use and operate with AI using agentic Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) [![Identity Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/idira-logo-nav.svg) Identity Security Identity security platform to secure every identity: human, machine and agentic](https://www.paloaltonetworks.com/idira?ts=markdown) [![Cloud Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-cloud-logo-nav.svg) Cloud Security Prevent risks from code to cloud with the leading agentic cloud security platform](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [![AI Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-AIRS-logo-nav.svg)](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) [AI Security Platform](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Gateway](https://www.paloaltonetworks.com/ai-security/ai-gateway?ts=markdown) * [AI Supply Chain Security](https://www.paloaltonetworks.com/ai-security/ai-supply-chain-security?ts=markdown) * [AI Red Teaming](https://www.paloaltonetworks.com/ai-security/ai-red-teaming?ts=markdown) * [AI Runtime Security](https://www.paloaltonetworks.com/ai-security/ai-runtime-security?ts=markdown) * [Agent Identity Security](https://www.paloaltonetworks.com/ai-security/agent-identity-security?ts=markdown) * [AI Posture Management](https://www.paloaltonetworks.com/prisma/cloud/ai-spm?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) Secure GenAI Tools * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) [![Network Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/strata-logo-nav.svg)](https://www.paloaltonetworks.com/network-security?ts=markdown) [Secure the Network](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [OT / Industrial Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [Device \& IoT Security](https://www.paloaltonetworks.com/network-security/device-security?ts=markdown) * [5G Security](https://www.paloaltonetworks.com/network-security/5g-security?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense?ts=markdown) * [Quantum Safe Security](https://www.paloaltonetworks.com/network-security/quantum-safe-security?ts=markdown) * [Next-Gen Trust Security](https://www.paloaltonetworks.com/network-security/next-gen-trust-security?ts=markdown) [![SASE logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-sase-logo-nav.svg)](https://www.paloaltonetworks.com/sase?ts=markdown) [Secure Access (SASE)](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma Access (ZTNA)](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) [![Security Operations logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-logo-nav.svg)](https://www.paloaltonetworks.com/cortex?ts=markdown) [Security Operations](https://www.paloaltonetworks.com/cortex?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Security Orchestration \& Automation](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown) * [Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown) * [Threat Intelligence Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown) * [Agentic-first Automation](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown) * [Identity Threat Detection and Response](https://www.paloaltonetworks.com/cortex/itdr?ts=markdown) [Endpoint Security](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) * [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown) [Data Security](https://www.paloaltonetworks.com/cortex/data-security?ts=markdown) [![Cloud Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-cloud-logo-nav.svg)](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [Application Security Overview](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Application Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/application-security-posture-management?ts=markdown) * [Software Supply Chain Security](https://www.paloaltonetworks.com/cortex/cloud/software-supply-chain-security?ts=markdown) * [Infrastructure-as-Code (IaC) Security](https://www.paloaltonetworks.com/cortex/cloud/infrastructure-as-code-security?ts=markdown) * [Software Composition Analysis](https://www.paloaltonetworks.com/cortex/cloud/software-composition-analysis?ts=markdown) * [Secrets Security](https://www.paloaltonetworks.com/cortex/cloud/secrets-security?ts=markdown) * [Open Partner Ecosystem](https://www.paloaltonetworks.com/cortex/cloud/appsec-partner-ecosystem?ts=markdown) [Cloud Posture Security Overview](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-security-posture-management?ts=markdown) * [Cloud Infrastructure Entitlement Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown) * [Data Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/data-security-posture-management?ts=markdown) * [AI Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/ai-security-posture-management?ts=markdown) * [Vulnerability Management](https://www.paloaltonetworks.com/cortex/cloud/vulnerability-management?ts=markdown) * [Cloud Attack Surface Management](https://www.paloaltonetworks.com/cortex/cloud/attack-surface-management?ts=markdown) [Cloud Runtime Security Overview](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Cloud Detection and Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Container \& Kubernetes Security](https://www.paloaltonetworks.com/cortex/cloud/kubernetes-and-container-security?ts=markdown) * [Cloud Workload Protection](https://www.paloaltonetworks.com/cortex/cloud/cloud-workload-protection?ts=markdown) * [API Security](https://www.paloaltonetworks.com/cortex/cloud/api-security?ts=markdown) * [Serverless Security](https://www.paloaltonetworks.com/cortex/cloud/serverless-security?ts=markdown) [![Observability NEW logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortex/xcor/cortex-xcor-logo-nav-2.svg)](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) Observability \& Remediation * [AI-Driven Observability](https://www.paloaltonetworks.com/cortex/xcor/ai-driven-observability?ts=markdown) * [Distributed Tracing](https://www.paloaltonetworks.com/cortex/xcor/distributed-tracing?ts=markdown) * [Log Management](https://www.paloaltonetworks.com/cortex/xcor/log-management?ts=markdown) * [Metrics Monitoring](https://www.paloaltonetworks.com/cortex/xcor/metrics-monitoring?ts=markdown) [![Identity Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/idira-logo-nav.svg)](https://www.paloaltonetworks.com/idira?ts=markdown) [Human Identities](https://www.paloaltonetworks.com/idira/human?ts=markdown) * [Modern PAM](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) [Machine Identities](https://www.paloaltonetworks.com/idira/machine?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * Solutions Solutions By Use Case [![Drive AI Transformation icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/ai-page/teaser-block/teaser-icon-2.svg) Drive AI Transformation Scale enterprise AI adoption across employees, applications and agents with confidence and control](https://www.paloaltonetworks.com/ai-security?ts=markdown) [![Accelerate Cloud Transformation icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Accelerate Cloud Transformation Build fast and innovate fearlessly with AI-driven protection from code to cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [![Secure AI Coding icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Secure AI Coding Let AI coding do more, with you in control. Protect data, govern agents and control AI costs](https://www.paloaltonetworks.com/secure-ai-coding?ts=markdown) [![Secure Every Identity icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-idira.svg) Secure Every Identity Stop identity-led breaches: Secure human, machine, and agentic identities with zero trust](https://www.paloaltonetworks.com/idira?ts=markdown) [![Enable Autonomous SOC icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Enable Autonomous SOC Fight AI with AI to stop threats at machine speed with the power of analytics and automation](https://www.paloaltonetworks.com/cortex/fight-ai-with-ai?ts=markdown) [![Secure Critical Infrastructure icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Secure Critical Infrastructure Stop machine-speed threats across OT, 5G and IoT with AI-driven cyber defense](https://www.paloaltonetworks.com/securing-critical-infrastructure?ts=markdown) [![Secure the Hybrid Network icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-strata.svg) Secure the Hybrid Network Stay ahead of AI-driven attacks with unified network security across hybrid environments](https://www.paloaltonetworks.com/network-security?ts=markdown) [![Automate Root-Cause Analysis icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Automate Root-Cause Analysis Respond autonomously to incidents and accelerate remediation with agentic AI](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) [![Frontier AI Defense icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-Unit42.svg) Frontier AI Defense Use defender-grade models to stop AI-speed attacks before they start](https://www.paloaltonetworks.com/unit42/ai-advantage?ts=markdown) * Services Services Security Services [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/unit-logo-dark.svg)](https://www.paloaltonetworks.com/unit42?ts=markdown) Prepare for Emerging Risks * [AI Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ai-security-assessment?ts=markdown) * [Frontier AI](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Respond to Cyber Attacks](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/unit42/respond/digital-forensics?ts=markdown) * [Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed Threat Hunting](https://www.paloaltonetworks.com/cortex/managed-threat-hunting?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Attack Surface Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/attack-surface-assessment?ts=markdown) * [Breach Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/breach-readiness-review?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/cloud-security-assessment?ts=markdown) * [Compromise Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/compromise-assessment?ts=markdown) * [Ransomware Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ransomware-readiness-assessment?ts=markdown) * [Supply Chain](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/supply-chain-risk-assessment?ts=markdown) * [Tabletop Exercises](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/tabletop-exercises?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Cyber Risk](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/cyber-risk-assessment?ts=markdown) * [IR Plan Development](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/IR-plan-and-development-review?ts=markdown) * [Security Program Design](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/security-program-design?ts=markdown) * [SOC Assessment](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/soc-assessment?ts=markdown) * [Virtual CISO](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/virtual-ciso?ts=markdown) * [Zero Trust](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/zero-trust-advisory?ts=markdown) Understand the Adversary * [Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Offensive Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/offensive-security-services?ts=markdown) Managed Firewalls Managed Firewalls * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) Customer Services [Global Customer Services](https://www.paloaltonetworks.com/services?ts=markdown) * [Education \& Training](https://www.paloaltonetworks.com/services/education?ts=markdown) * [Professional Services](https://www.paloaltonetworks.com/services/consulting?ts=markdown) * [Success Tools](https://www.paloaltonetworks.com/services/customer-success-tools?ts=markdown) * [Support Services](https://www.paloaltonetworks.com/services/solution-assurance?ts=markdown) * [Customer Success](https://www.paloaltonetworks.com/services/customer-success?ts=markdown) [Under Attack?](https://www.paloaltonetworks.com/unit42/contact-unit42?ts=markdown) * [Services Overview](#services-panel-0) * [Security Services](#services-panel-1) * [Managed Firewalls](#services-panel-2) * [Customer Services](#services-panel-3) [Under Attack?](https://www.paloaltonetworks.com/unit42/contact-unit42?ts=markdown) [![Security Services logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/unit-logo-dark.svg)](https://www.paloaltonetworks.com/unit42?ts=markdown) Prepare for Emerging Risks * [AI Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ai-security-assessment?ts=markdown) * [Frontier AI](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Respond to Cyber Attacks](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/unit42/respond/digital-forensics?ts=markdown) * [Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed Threat Hunting](https://www.paloaltonetworks.com/cortex/managed-threat-hunting?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Attack Surface Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/attack-surface-assessment?ts=markdown) * [Breach Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/breach-readiness-review?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/cloud-security-assessment?ts=markdown) * [Compromise Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/compromise-assessment?ts=markdown) * [Ransomware Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ransomware-readiness-assessment?ts=markdown) * [Supply Chain](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/supply-chain-risk-assessment?ts=markdown) * [Tabletop Exercises](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/tabletop-exercises?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Cyber Risk](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/cyber-risk-assessment?ts=markdown) * [IR Plan Development](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/IR-plan-and-development-review?ts=markdown) * [Security Program Design](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/security-program-design?ts=markdown) * [SOC Assessment](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/soc-assessment?ts=markdown) * [Virtual CISO](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/virtual-ciso?ts=markdown) * [Zero Trust](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/zero-trust-advisory?ts=markdown) Understand the Adversary * [Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Offensive Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/offensive-security-services?ts=markdown) Managed Firewalls * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) [Global Customer Services](https://www.paloaltonetworks.com/services?ts=markdown) * [Education \& Training](https://www.paloaltonetworks.com/services/education?ts=markdown) * [Professional Services](https://www.paloaltonetworks.com/services/consulting?ts=markdown) * [Success Tools](https://www.paloaltonetworks.com/services/customer-success-tools?ts=markdown) * [Support Services](https://www.paloaltonetworks.com/services/solution-assurance?ts=markdown) * [Customer Success](https://www.paloaltonetworks.com/services/customer-success?ts=markdown) * Industries Industries [![Financial Services icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/financial-icon-2.svg) Financial Services Secure with AI cybersecurity, fraud and ransomware prevention, compliance, and customer data protection](https://www.paloaltonetworks.com/industry/financial-services?ts=markdown) [![Manufacturing icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/manufacturing-icon-2.svg) Manufacturing Secure with OT security, ransomware defense, industrial cybersecurity, supply chain resilience, and continuity](https://www.paloaltonetworks.com/industry/manufacturing?ts=markdown) [![Retail and Hospitality icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/retail-icon-2.svg) Retail and Hospitality Secure with payment security, PCI compliance, ransomware and fraud prevention, and data protection](https://www.paloaltonetworks.com/industry/retail?ts=markdown) [![Healthcare and Life Sciences icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/healthcare-icon-2.svg) Healthcare and Life Sciences Secure patient and clinical data, medical device security, ransomware defense, and HIPAA compliance](https://www.paloaltonetworks.com/industry/healthcare?ts=markdown) [![Public Sector icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/public-sector-icon-2.svg) Public Sector Secure with Zero Trust, cyber defense, compliance, infrastructure protection, and citizen data security](https://www.paloaltonetworks.com/industry/public-sector?ts=markdown) [![Utilities icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/utilities-icon-2.svg) Utilities Secure with power grid protection, OT network security, ransomware defense, and critical infrastructure security](https://www.paloaltonetworks.com/industry/electric-utilities?ts=markdown) [![Transportation icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/transportation-icon-2.svg) Transportation Secure OT and connected infrastructure protection, ransomware defense, supply chain security, compliance](https://www.paloaltonetworks.com/industry/transportation-security?ts=markdown) [![Small and Medium Business icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/smb-icon-2.svg) Small and Medium Business Secure against cyber threats using AI-powered endpoint, network, browser, cloud, and MDR](https://www.paloaltonetworks.com/industry/small-medium-business-portfolio?ts=markdown) * Partners Partners NextWave * [Partner Program](https://www.paloaltonetworks.com/partners/nextwave-partner-portal-login?ts=markdown) * [Become a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=becomepartner) * [Request Partner Portal Access](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=requestaccess) * [Partner Portal Login](https://www.paloaltonetworks.com/partners/nextwave-partner-portal?ts=markdown) * [Find a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerlocator) Partner Ecosystem [Explore All Partners Find the right partner network tailored to your business needs, cloud environments, and security requirements](https://www.paloaltonetworks.com/partners?ts=markdown) [Cloud Service Partners Bring cloud native security and compliance to the entire development lifecycle](https://www.paloaltonetworks.com/partners/nextwave-for-csp?ts=markdown) [Frontier AI Alliance Outpace today's cyberattacks through a global ecosystem of leaders orchestrating unified defenses](https://www.paloaltonetworks.com/frontier?ts=markdown) [Global System Integrators Speed and secure digital transformation with the industry's best technology, people and intelligence](https://www.paloaltonetworks.com/partners/nextwave-for-gsi?ts=markdown) [Managed Security Service Providers Gain valuable resource oversight to help your businesses administer security strategies](https://www.paloaltonetworks.com/partners/managed-security-service-providers?ts=markdown) [Resellers Deliver the most comprehensive cybersecurity portfolio while expanding opportunities and profitability](https://www.paloaltonetworks.com/partners/resellers?ts=markdown) [Service Providers Protect mobile users, devices and applications with effective, flexible and easy to deploy cybersecurity](https://www.paloaltonetworks.com/partners/service-providers?ts=markdown) [Technology Partners Advance security and transformation with innovative technology partner integrations](https://www.paloaltonetworks.com/partners/technology-partners?ts=markdown) * Resources Resources ![Learn icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/resource-library-icon.svg) Learn * [Resource Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Analyst Reports](https://www.paloaltonetworks.com/resources/research?ts=markdown) * [Customer Stories](https://www.paloaltonetworks.com/customers?ts=markdown) * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Threat Vector Podcast](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [Unit 42 Threat Research](https://unit42.paloaltonetworks.com/) * [Knowledgebase](https://knowledgebase.paloaltonetworks.com/) * [Technical Documentation](https://docs.paloaltonetworks.com/) ![Engage icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/engage-icon-2.svg) Engage * [Webinars](https://www.paloaltonetworks.com/resources/webinars?ts=markdown) * [Demos](https://www.paloaltonetworks.com/demos?ts=markdown) * [Test Drive](https://www.paloaltonetworks.com/resources/test-drives?ts=markdown) * [On-Demand](https://www.paloaltonetworks.com/ondemand?ts=markdown) ![Connect icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/connect-icon-2.svg) Connect * [Executive Briefings](https://www.paloaltonetworks.com/about-us/executive-briefing-program?ts=markdown) * [Events](https://events.paloaltonetworks.com/) * [Live Community](https://live.paloaltonetworks.com/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) ![Discover icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/discover-icon-2.svg) Discover * [Why Palo Alto Networks?](https://www.paloaltonetworks.com/why-paloaltonetworks?ts=markdown) * [Platform Approach](https://www.paloaltonetworks.com/why-paloaltonetworks/platformization?ts=markdown) * [Awards \& Recognition](https://www.paloaltonetworks.com/about-us/awards?ts=markdown) * [Global Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Cloud Locations](https://www.paloaltonetworks.com/products/regional-cloud-locations?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Trust 360 Program](https://www.paloaltonetworks.com/resources/whitepapers/trust-360?ts=markdown) ![Company icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Management Team](https://www.paloaltonetworks.com/about-us/management?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en) * [Culture \& Benefits](https://jobs.paloaltonetworks.com/en/culture/) * [Ethics \& Compliance](https://www.paloaltonetworks.com/company/ethics-and-compliance?ts=markdown) * [Office Locations](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * ![search magnifying glass](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg) * us Language * USA (ENGLISH) * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au/cyberpedia/ransomware-response-and-recovery) * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br/cyberpedia/ransomware-response-and-recovery) * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca/cyberpedia/ransomware-response-and-recovery) * [CHINA (简体中文)](https://www.paloaltonetworks.cn/cyberpedia/ransomware-response-and-recovery) * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr/cyberpedia/ransomware-response-and-recovery) * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de/cyberpedia/ransomware-response-and-recovery) * [INDIA (ENGLISH)](https://www.paloaltonetworks.in/cyberpedia/ransomware-response-and-recovery) * [ITALY (ITALIANO)](https://www.paloaltonetworks.it/cyberpedia/ransomware-response-and-recovery) * [JAPAN (日本語)](https://www.paloaltonetworks.jp/cyberpedia/ransomware-response-and-recovery) * [KOREA (한국어)](https://www.paloaltonetworks.co.kr/cyberpedia/ransomware-response-and-recovery) * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat/cyberpedia/ransomware-response-and-recovery) * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx/cyberpedia/ransomware-response-and-recovery) * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg/cyberpedia/ransomware-response-and-recovery) * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es/cyberpedia/ransomware-response-and-recovery) * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw/cyberpedia/ransomware-response-and-recovery) * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk/cyberpedia/ransomware-response-and-recovery) * Accounts \& Support Accounts \& Support * Accounts * Customer * Partner * Employee * [Login to Download](https://www.paloaltonetworks.com/login?ts=markdown) * [Become a Member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown) * Support * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [What's New](https://www.paloaltonetworks.com/resources?ts=markdown) * [Get Support](https://support.paloaltonetworks.com/SupportAccount/MyAccount) [Under Attack?](https://www.paloaltonetworks.com/unit42/contact-unit42?ts=markdown) * [Demos and Trials](https://www.paloaltonetworks.com/get-started?ts=markdown) [Introducing Cortex XCOR: Observability, reimagined. Discover now.](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) [](https://www.paloaltonetworks.com/?ts=markdown) Search All * [Tech Docs](https://docs.paloaltonetworks.com/search) Close search modal 1. [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) 2. [Threats](https://www.paloaltonetworks.com/cyberpedia/threat?ts=markdown) 3. [Ransomware](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware?ts=markdown) 4. [What is Ransomware Response and Recovery?](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery?ts=markdown) Table of Contents * [What Is Ransomware?](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware?ts=markdown) * [Ransomware Key Takeaways](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#ransomware?ts=markdown) * [Why Ransomware Matters](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#why?ts=markdown) * [Stages of a Ransomware Attack](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#stages?ts=markdown) * [How Ransomware Uses Psychological Pressure](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#how?ts=markdown) * [Types of Ransomware](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#types?ts=markdown) * [Example Ransomware Strains](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#example?ts=markdown) * [Role of Human Behavior in Cybersecurity](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#role?ts=markdown) * [Ransom Payment and Prevention](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#prevention?ts=markdown) * [Creating and Testing an Incident Response Plan](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#creating?ts=markdown) * [Understanding if You Have a Ransomware Infection](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#infection?ts=markdown) * [Difference Between Malware and Ransomware](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#difference?ts=markdown) * [What is Multi-Extortion Ransomware?](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#what?ts=markdown) * [Why Ransomware Is Illegal](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#illegal?ts=markdown) * [Recovery from Ransomware Attacks](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#recovery?ts=markdown) * [Is Ransomware Still a Threat?](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#threat?ts=markdown) * [Future-Proofing Against Ransomware](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#future?ts=markdown) * [Ransomware FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware#faqs?ts=markdown) * [What Are the Most Common Types of Ransomware?](https://www.paloaltonetworks.com/cyberpedia/what-are-the-most-common-types-of-ransomware?ts=markdown) * [Ransomware Types and How They Work](https://www.paloaltonetworks.com/cyberpedia/what-are-the-most-common-types-of-ransomware#ransomware?ts=markdown) * [How to Prevent Ransomware Attacks](https://www.paloaltonetworks.com/cyberpedia/what-are-the-most-common-types-of-ransomware#how?ts=markdown) * [The Evolution of Ransomware Attacks](https://www.paloaltonetworks.com/cyberpedia/what-are-the-most-common-types-of-ransomware#attacks?ts=markdown) * [Notable Ransomware Families](https://www.paloaltonetworks.com/cyberpedia/what-are-the-most-common-types-of-ransomware#notable?ts=markdown) * [The Emergence of Ransomware Groups](https://www.paloaltonetworks.com/cyberpedia/what-are-the-most-common-types-of-ransomware#groups?ts=markdown) * [How Nation-State Actors Have Embraced Ransomware](https://www.paloaltonetworks.com/cyberpedia/what-are-the-most-common-types-of-ransomware#actors?ts=markdown) * [Types of Ransomware FAQs](https://www.paloaltonetworks.com/cyberpedia/what-are-the-most-common-types-of-ransomware#faqs?ts=markdown) * What is Ransomware Response and Recovery? * [How to Respond to a Ransomware Attack](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#how?ts=markdown) * [How Do Ransomware Attacks Begin?](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#do?ts=markdown) * [Reducing Dwell Time](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#reducing?ts=markdown) * [Common Threat Actor Techniques](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#common?ts=markdown) * [Data Theft and Multi-extortion Ransomware](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#what?ts=markdown) * [How to Uninstall Ransomware and Retrieve Data](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#uninstall?ts=markdown) * [Steps to Recovery After a Ransomware Attack](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#steps?ts=markdown) * [® Incident Response Methodology](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#unit42?ts=markdown) * [Ransomware Removal and Recovery FAQs](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#faqs?ts=markdown) * [What are Ransomware Attacks?](https://www.paloaltonetworks.com/cyberpedia/ransomware-common-attack-methods?ts=markdown) * [How Do Ransomware Attacks Happen?](https://www.paloaltonetworks.com/cyberpedia/ransomware-common-attack-methods#how?ts=markdown) * [What Are the 5 Main Ransomware Attack Vectors?](https://www.paloaltonetworks.com/cyberpedia/ransomware-common-attack-methods#what?ts=markdown) * [How to Protect Against Ransomware Attacks](https://www.paloaltonetworks.com/cyberpedia/ransomware-common-attack-methods#protect?ts=markdown) * [How to Assess Your Ransomware Readiness](https://www.paloaltonetworks.com/cyberpedia/ransomware-common-attack-methods#readiness?ts=markdown) * [Ransomware Attacks FAQs](https://www.paloaltonetworks.com/cyberpedia/ransomware-common-attack-methods#faqs?ts=markdown) * [What is Ransomware Prevention?](https://www.paloaltonetworks.com/cyberpedia/ransomware-prevention-what-your-security-architecture-must-do?ts=markdown) * [Step 1: Reduce the Attack Surface](https://www.paloaltonetworks.com/cyberpedia/ransomware-prevention-what-your-security-architecture-must-do#step1?ts=markdown) * [Step 2: Prevent Known Threats](https://www.paloaltonetworks.com/cyberpedia/ransomware-prevention-what-your-security-architecture-must-do#step2?ts=markdown) * [Step 3: Identify and Prevent Unknown Threats](https://www.paloaltonetworks.com/cyberpedia/ransomware-prevention-what-your-security-architecture-must-do#step3?ts=markdown) # What is Ransomware Response and Recovery? 5 min. read Table of Contents * * [How to Respond to a Ransomware Attack](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#how?ts=markdown) * [How Do Ransomware Attacks Begin?](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#do?ts=markdown) * [Reducing Dwell Time](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#reducing?ts=markdown) * [Common Threat Actor Techniques](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#common?ts=markdown) * [Data Theft and Multi-extortion Ransomware](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#what?ts=markdown) * [How to Uninstall Ransomware and Retrieve Data](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#uninstall?ts=markdown) * [Steps to Recovery After a Ransomware Attack](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#steps?ts=markdown) * [® Incident Response Methodology](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#unit42?ts=markdown) * [Ransomware Removal and Recovery FAQs](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#faqs?ts=markdown) 1. How to Respond to a Ransomware Attack * * [How to Respond to a Ransomware Attack](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#how?ts=markdown) * [How Do Ransomware Attacks Begin?](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#do?ts=markdown) * [Reducing Dwell Time](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#reducing?ts=markdown) * [Common Threat Actor Techniques](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#common?ts=markdown) * [Data Theft and Multi-extortion Ransomware](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#what?ts=markdown) * [How to Uninstall Ransomware and Retrieve Data](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#uninstall?ts=markdown) * [Steps to Recovery After a Ransomware Attack](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#steps?ts=markdown) * [® Incident Response Methodology](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#unit42?ts=markdown) * [Ransomware Removal and Recovery FAQs](https://www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery#faqs?ts=markdown) Ransomware response and recovery involves identifying [malware](https://www.paloaltonetworks.com/cyberpedia/what-is-malware?ts=markdown) and minimizing the harm inflicted on affected systems as a result of [ransomware attacks](https://www.paloaltonetworks.com/cyberpedia/ransomware-common-attack-methods?ts=markdown). Although data recovery from ransomware is often possible, the more difficult task is preventing the subsequent loss of productivity and revenue, damage to brand reputation, and potential exposure of sensitive information. ## How to Respond to a Ransomware Attack \  *BlackCat Ransomware Case Study - Palo Alto Networks* So much of the ransomware discussion centers on prevention that the hard realities regarding actual attacks, and the actions taken to affect ransomware removal and recovery, can get obscured. Knowing what to do when your organization falls victim to a ransomware attack and your best efforts fail is critical. Time is of the essence in ransomware attack situations. Knowing how to act quickly to halt the attack's progression, prevent it from spreading, and communicate with attack groups in the event you need to negotiate are all important skill sets. Organizations need to evolve defenses to address the various methods threat actors use to apply pressure. Today's [incident response plans](https://www.paloaltonetworks.com/cyberpedia/incident-response-plan?ts=markdown) need to involve not only technical considerations but also safeguards for an organization's reputation and how to protect employees or customers who may become targets for some of the extortionists' more aggressive tactics. Quick access to an [incident response team](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown) and legal advisors is vital during extortion attempts. An effective response plan and crisis communication strategy will lessen uncertainty and clarify stakeholder roles and decision-making, such as payment approvals. Training employees on ransomware harassment and conducting a thorough post-incident review is essential to prevent future attacks. ## How Do Ransomware Attacks Begin? Ransomware attacks typically begin through the following vectors: ### [Phishing](https://www.paloaltonetworks.com/cyberpedia/what-is-phishing?ts=markdown) Emails Attackers send emails that appear to be from legitimate sources but contain malicious attachments or links. When the attachment is opened or the link is clicked, the initial payload is downloaded and installed on the user's device. ### [Exploit Kits](https://www.paloaltonetworks.com/cyberpedia/what-is-an-exploit-kit?ts=markdown) These are tools that cybercriminals use to exploit known vulnerabilities in software and operating systems. If a user's system is not updated with the latest security patches, exploit kits can provide an easy way for ransomware to infiltrate. ### Remote Desktop Protocol (RDP) Exploits RDP is a popular way to access computers remotely. Attackers can use brute-force attacks or stolen credentials to gain access to a network via RDP and then deploy ransomware. ### Drive-by Downloading Merely visiting a compromised website without interaction can lead to a ransomware infection if the site has a drive-by download setup to exploit browser vulnerabilities. ### Malvertising Malicious advertising can redirect users to ransomware distribution sites or trick users into downloading malicious software disguised as legitimate software. ### [Social Engineering](https://www.paloaltonetworks.com/cyberpedia/what-is-social-engineering?ts=markdown) Attackers use psychological manipulation to trick users into breaking security procedures, such as giving away sensitive information or granting access to critical systems. ### Software Vulnerabilities Attackers can also exploit unpatched vulnerabilities in widely used software, deploying ransomware without any user interaction. ### Supply Chain Attacks By compromising a software provider or a vendor, attackers can use the trust relationship between businesses to deploy ransomware. For instance, a malicious update from a vendor could contain ransomware. ### Network Propagation Once inside a network, some ransomware variants can move laterally across connected systems, using various techniques to identify and compromise additional machines. Understanding these vectors is crucial in developing effective defenses against ransomware. Regular security training, system patching, and vigilant monitoring of networks and emails are vital in preventing such attacks. Also, consider mitigating ransomware risk by performing targeted assessments and attack simulations designed to identify hidden vulnerabilities, weak security controls, or signs of compromise in your environment. \  ## Reducing Dwell Time Dwell time is the period of time a threat actor spends in your environment before being detected. If you can stop threat actors in the earlier stages of their attack, you can avoid downstream ransomware in your environment. To reduce dwell time and identify threat actor activity, ensure you monitor unusual indicators in your system. Look out for: * The installation and usage of unauthorized remote access tools * Unauthorized discovery activity (e.g., scanning, enumeration) * Atypical file access or downloads * Unusual network traffic ## Common Threat Actor Techniques As ransomware groups have evolved and maximized the effectiveness of [ransomware as a service](https://www.paloaltonetworks.ca/cyberpedia/what-is-ransomware-as-a-service) in recent years, multi-extortion techniques have allowed ransomware groups to increase leverage and maximize profit. Threat actors will look for any opportunity to gain the upper hand. With multi-extortion techniques, attackers do more than encrypt files and disrupt business operations. For example, they often post information about breached organizations on [dark web leak sites](https://www.paloaltonetworks.ca/cyberpedia/what-is-a-dark-web-leak-site) and threaten to release or sell stolen data if a ransom is not paid. The goal is to get you to pay more money faster. To minimize ransomware attacks, follow a defense-in-depth approach, implementing safeguards throughout all layers of your infrastructure (e.g., email, web applications, and network). You can also employ services that monitor your brand and associated communications (e.g., communications on the dark web). ![Common Threat Actor Techniques](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/ransomware-response-and-recovery/common-threat-actor-techniques.png "Common Threat Actor Techniques") ![BlackCat Ransom Note](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/ransomware-response-and-recovery/blackcat-ransom-note.png "BlackCat Ransom Note") *This is an example of a BlackCat ransom note that was dropped on a comprised system.* The ransomware landscape has continued to evolve, with specific extortion tactics becoming more prevalent. While the frequency of tactics can vary depending on the targets and attackers, the following were among the most commonly reported: ### [Encryption of Data](https://www.paloaltonetworks.com/cyberpedia/data-encryption?ts=markdown) The fundamental tactic of encrypting a victim's data and demanding a ransom for the decryption key remains very common, as it directly impacts the victim's operations and creates a clear incentive to pay. ### Data theft Attackers often steal sensitive data before or during encryption and then threaten to release it publicly if the ransom is unpaid. ### Multi-Extortion Ransomware In addition to encrypting the victim's files, [multi-extortion ransomware](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-extortion-ransomware?ts=markdown) adds additional layers to the cyberattack involving the ransomware operator exfiltrating files and threatening to publicly release the victim's data unless the ransom is paid. The added threat increases the pressure on the victim to pay the ransom quickly and makes it more difficult for them to refuse to pay. These attacks can be particularly damaging because they disrupt the victim's ability to access their own data while also potentially exposing sensitive or confidential information to the public. ### Harassment of Employees and Customers Attackers increasingly contact employees and customers of the affected organization, pressuring the company from multiple angles to pay the ransom to avoid damage to its reputation and relationships. ### Time-Sensitive Ultimatums Many ransomware groups use countdown timers that threaten irreversible consequences if the ransom isn't paid within the given timeframe, exploiting the urgency to force quick decision-making. [![Download the 2023 Unit 42 Ransomware and Extortion Report](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/ransomware-response-and-recovery/banner-2023-unit-42-ransomware-and-extortion-report.jpg "Download the 2023 Unit 42 Ransomware and Extortion Report")](https://start.paloaltonetworks.com/2023-unit42-ransomware-extortion-report) The commonality of these tactics underscores the importance of comprehensive preventative measures, strong backup strategies, and incident response plans to mitigate the risks before an attack occurs and respond effectively if one does happen. It's also worth noting that the landscape can shift rapidly, and new tactics can emerge at any time, so continuous monitoring of cybersecurity trends is crucial. ## Data Theft and Multi-extortion Ransomware ![Industries most heavily impacted by extortion attacks](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/ransomware-response-and-recovery/industries-most-heavily-impacted-by-extortion-attacks.png "Industries most heavily impacted by extortion attacks") *Manufacturing, Professional and Legal Services and Wholesale and Retail are the most heavily impacted industries targeted by ransomware extortion.* Ransomware groups often threaten to leak data stolen from victims. Due to the efficacy of this tactic, many threat actors target regulated data sets or highly commercially sensitive information for maximum leverage. ### What is Data Theft? Data theft is the unauthorized taking or intercepting of files and personal information from a computer system. This can be accomplished through various means, such as hacking, malware, phishing, or [insider threats](https://www.paloaltonetworks.com/cyberpedia/insider-threat?ts=markdown). The stolen data may include sensitive personal information, intellectual property, business documents, customer databases, and other valuable digital assets. Cybercriminals can use this data for various malicious purposes, including identity theft, financial fraud, corporate espionage, or selling information on the dark web. ### What is Multi-Extortion Ransomware? Multi-extortion ransomware is an advanced attack that combines encrypting a victim's data with threats of leaking it, harassing stakeholders, launching additional attacks, and demanding further ransoms. This strategy amplifies the pressure on victims to pay to avoid greater damage, such as operational disruption, public exposure, and legal consequences. This multi-pronged approach significantly increases the pressure on victims to pay the ransom, as they face multiple potential consequences beyond losing access to their data. It also complicates the recovery process and increases possible damages, including reputational harm and regulatory issues, mainly if sensitive customer data is involved and privacy laws such as [GDPR](https://www.paloaltonetworks.com/cyberpedia/gdpr-compliance?ts=markdown) are violated. ## How to Uninstall Ransomware and Retrieve Data Uninstalling ransomware from a compromised system can be a challenging and complex task, but it is not impossible. To remove ransomware from your systems, follow these steps: 1. **Isolate the infected system:** Disconnect the compromised computer from the network to prevent the ransomware from spreading to other devices. 2. **Identify the ransomware:** Identify the ransomware type affecting your system. This is crucial for two reasons: to explore decryption tools and to understand the malware for effective removal. If available, trustworthy decryption tools can help recover encrypted files resources. 3. **Remove the ransomware:** Use reputable antivirus or anti-malware software to scan and remove the ransomware from your system. Make sure your antivirus definitions are up to date. Some ransomware variants may be resistant to removal. In such cases, you may need to consult with a professional computer security team, such as [Unit 42](https://start.paloaltonetworks.com/incident-response-checklist-unit42?utm_source=google-jg-amer-unit42-unrc-unpt&utm_medium=paid_search&utm_campaign=google-unit42-unit42_port-amer-multi-lead_gen-en-brand&utm_content=7014u000001VQ5nAAG&utm_term=unit%2042&cq_plac=&cq_net=g&gad_source=1&gclid=EAIaIQobChMIhtD004-jjAMVIM7CBB2gmwWrEAAYASAAEgJpAvD_BwE), or use specialized removal tools. 4. **Restore your files:** Restore files from a clean backup source if you have backups. Do not use backups made while the system is infected, as they may contain encrypted files, or the malware will restart the infection. If you don't have backups, you can recover your files using decryption tools if they are available for your specific ransomware variant. Law enforcement agencies, cybersecurity companies, and community-driven initiatives sometimes release such tools. 5. **Strengthen your security:** After removing the ransomware, improving your system's security is essential to prevent future infections. Update your operating system and software, and install a reliable security suite. Be cautious about email attachments, downloads, and links from untrusted sources. ## Steps to Recovery After a Ransomware Attack Even after a ransomware incident is resolved, it takes time for an organization to fully restore operations, remediate security issues, improve security controls, and recover the financial and reputational ground lost. After ransomware has been removed, the following steps should be taken to recover. ### Investigation Conduct a thorough investigation to understand how the ransomware entered your systems, the scope of the impact, and any data that might have been compromised or exfiltrated. ### Restoration and Recovery Restore data from backups, ensuring you do not reintroduce ransomware into the network. Validate that backups are clean before restoration. This should be done systematically and with caution to avoid reinfection. ### Communication Communicate with internal and external stakeholders about the incident, what is being done in response, and what steps will be taken to prevent future incidents. ### Enhancement of Security Posture Based on the findings from the investigation, enhance your security protections to prevent similar attacks. This may include patching vulnerabilities, improving email filtering, and enhancing [endpoint protection](https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-protection?ts=markdown). ### Training and Awareness Provide training for employees to recognize and respond to phishing attempts and other malicious activities that could lead to a ransomware infection. ### Continuous Monitoring Implement continuous monitoring strategies to detect and respond to future incidents quickly. ### Compliance and Reporting Follow any necessary compliance regulations regarding [data breaches](https://www.paloaltonetworks.com/cyberpedia/data-breach?ts=markdown), including reporting the incident to government bodies or notifying affected individuals. Specific recovery steps can vary depending on the nature of the attack, the type of data involved, and the affected organization's pre-existing incident response protocols. Consulting with cybersecurity professionals and legal experts during the recovery process is often crucial to ensure proper incident handling. ## Unit 42^®^ Incident Response Methodology ![Threat Intelligence-Unit 42 Incident Response Methodology](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/ransomware-response-and-recovery/threat-intelligence-unit-42-incident-response-methodology.png "Threat Intelligence-Unit 42 Incident Response Methodology") *Palo Alto Networks follows a proven methodology as outlined in this image.* Unit 42, the threat intelligence and incident response team at Palo Alto Networks, helps customers respond to and recover from ransomware attacks through a combination of expert-led services, threat intelligence, and proactive defense strategies. **Scope** For an accurate understanding of the incident, getting the scoping phase right is critical. This allows us to align the right resources and skill sets to get your organization back up and running as quickly as possible and accurately estimate the effort needed to assist you. **Investigate** We work to fully understand the incident as we investigate what happened, leveraging the available data and working alongside your team. **Secure** As the incident is contained and the threat actor and their tools are eradicated from your environment, we concurrently assist your organization with rapidly restoring operations. **Support and Report** Unit 42 will also assist you in understanding the incident's root cause and potential impact, including any unauthorized access or acquisition of sensitive information that may trigger legal obligations. **Transform** A key step in incident response is helping ensure an improved security posture going forward. We work with you to apply specific improvements and build out incident response plans that will help protect against future and similar attacks. Read [Mitigating Cyber Risks with MITRE ATT\&CK](https://start.paloaltonetworks.com/2023-unit42-mitre-attack-recommendations) for an in-depth set of recommendations by Unit 42 incident responders. ## Ransomware Removal and Recovery FAQs ### What immediate steps should be taken when ransomware is detected in a network? Isolate the infected system from the network to prevent the spread of ransomware. Turn off Wi-Fi and Bluetooth, and unplug any storage devices. Use antivirus software to scan and remove the ransomware from the system if possible. Contact a cybersecurity professional for assistance. ### Can ransomware files be decrypted without paying the ransom? It depends on the type of ransomware. Some decryption tools are available for certain ransomware strains, which can be found on websites like No More Ransom. However, there's only a guarantee for decryption with the specific key, and efforts should focus on restoring files from backups. ### Is paying the ransom recommended when affected by ransomware? Law enforcement agencies and cybersecurity experts generally advise against paying the ransom. Paying does not guarantee file recovery and may encourage future attacks. Instead, focus on removing the malware and restoring systems from backups. ### How can one ensure all traces of ransomware have been removed from the system? After removing the ransomware using antivirus or anti-malware tools, it's crucial to conduct a thorough scan of the entire network and validate the system's integrity. Engaging a cybersecurity firm for a post-mortem analysis is recommended to ensure all backdoors and malware traces are eradicated. Regularly update security patches and change all system passwords as a precaution. Related Content [What is multi-extortion ransomware? Multi-extortion ransomware is a malicious software that not only encrypts files to demand payment but also threatens victims with additional harm to coerce further payments.](https://www.paloaltonetworks.ca/cyberpedia/what-is-multi-extortion-ransomware) [Cortex XSOAR's Ransomware Content Pack Cortex XSOAR's ransomware content pack can help accelerate incident response and orchestrate threat intelligence by enab...](https://cortex.marketplace.pan.dev/marketplace/details/Ransomware/) [Rebuilding a Healthcare Provider's Environment After a Ransomware Attack Following a ransomware attack on a healthcare provider, the Unit 42 experts quickly jumped in to analyze, respond, recover data, and secure the network against future threats.](https://www.paloaltonetworks.ca/customers/rebuilding-a-healthcare-providers-environment-after-a-ransomware-attack) [Surviving Ransomware: How to Defend Against Today's Attacks Combat ransomware! Get insights on evolving tactics, common methods, vulnerable targets, new extortion forms, and proactive preventions.](https://start.paloaltonetworks.com/surviving-ransomware) ![Share page on facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/facebook-circular-icon.svg) ![Share page on linkedin](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/linkedin-circular-icon.svg) [![Share page by an email](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/email-circular-icon.svg)](mailto:?subject=What%20is%20Ransomware%20Response%20and%20Recovery%3F&body=Learn%20effective%20ransomware%20response%20and%20recovery%20tactics%20to%20secure%20your%20data%20and%20prevent%20future%20attacks.%20Expert%20tips%20for%20quick%20response%20and%20protection.%20at%20https%3A//www.paloaltonetworks.com/cyberpedia/ransomware-response-and-recovery) Back to Top [Previous](https://www.paloaltonetworks.com/cyberpedia/what-are-the-most-common-types-of-ransomware?ts=markdown) What Are the Most Common Types of Ransomware? [Next](https://www.paloaltonetworks.com/cyberpedia/ransomware-common-attack-methods?ts=markdown) What are Ransomware Attacks? {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center-subscribe.html) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language