When David Koopmans' IT manager started sending strange messages to employees, David knew something was wrong. By then, threat actors had been inside his network for 30 days.

What followed was a ransomware nightmare that cost $14 million, put David in the hospital, and ended with him being let go—despite years of warning leadership they needed to invest in security.

In this episode, we follow David's story from chaos to recovery, with expert context from Fortinet's incident response team on what actually happens when the call comes in (spoiler: it's always Friday afternoon), the critical mistakes that make attacks worse, and why 30 minutes a week of preparation could be the difference between survival and catastrophe.

Key Takeaways:

• Why "we're not a target" is the most dangerous assumption in securit
• The common mistake that lets attackers hit you twice
• How tabletop exercises helped one company respond to a near-identical real incident
• The 30-minute weekly habit that separates prepared teams from overwhelmed ones

Featuring: 

David Koopmans (CIO, MMT Ambulance), Josh Brewer (Softchoice), John Simmons (FortiGuard IR Lead, Americas), John Hollenberger (FortiGuard Proactive Lead)

====

This episode is brought to you by Fortinet

When a cyber incident hits, the difference between chaos and recovery comes down to preparation. Learn how FortiGuard Incident Response Services can help your team respond faster and recover stronger at softchoice.com/fortinet

====

Resources

• FortiGuard Incident Response Services: softchoice.com/fortinet

• Book: "Cybersecurity Tabletop Exercises: From Planning to Execution" by John Hollenberger (No Starch Press, October 2024)

The Catalyst by Softchoice is the podcast dedicated to exploring the intersection of humans and technology.