Ransomware Defence and Recovery (IMCS-017) Training Course

Ransomware Defence and Recovery

Ransomware is one of the most damaging cyber threats facing organisations, capable of halting operations for weeks and exposing sensitive data. Defence requires…

5 daysClassroom or online

14Upcoming dates

7Cities

£2,250Fees from

Course overview

Why Attend

Ransomware is one of the most damaging cyber threats facing organisations, capable of halting operations for weeks and exposing sensitive data. Defence requires prevention, detection, resilient backups and rehearsed response.

This LLMI course explains how ransomware attacks unfold, initial access vectors, hardening and prevention, detection of early indicators, backup and recovery architectures, response decision-making including extortion demands, communication and lessons learned. Participants take part in a ransomware response exercise.

The course serves both technical and management audiences.

Course Objectives

Explain the ransomware attack life cycle

Reduce initial access and lateral movement risks

Detect early indicators of ransomware

Design resilient backup and recovery

Plan response and decision-making

Recover operations and learn from incidents

Target Audience

IT and security managers

System administrators

Business continuity professionals

CISOs

Risk managers

Senior managers

Course Methodology

Threat briefings

Hardening workshops

Backup design exercise

Response simulation

Case studies

Course outline

1Day 1: Understanding Ransomware

Ransomware business model
Attack life cycle
Double extortion
Notable incidents
Threat actors
Case study: Major ransomware attack

2Day 2: Prevention

Initial access vectors
Patching and hardening
Identity protection
Email and endpoint controls
Segmentation
Workshop: Hardening plan

3Day 3: Detection

Indicators of compromise
Monitoring
Endpoint detection
Threat hunting
Early containment
Exercise: Detection review

4Day 4: Backup and Recovery

Backup strategies
Immutable backups
Recovery testing
Recovery priorities
Business continuity
Workshop: Backup architecture

5Day 5: Response

Response plan
Decision-making on demands
Legal and regulatory
Communication
Lessons learned
Capstone: Ransomware simulation

Frequently asked questions

How long is the Ransomware Defence and Recovery course?

The course runs over 5 days of classroom training, usually Monday to Friday.

When is the next Ransomware Defence and Recovery course?

The next public date is 16 - 20 Nov 2026 in Kuala Lumpur. There are 14 upcoming dates in total.

Where is this course held?

Upcoming sessions run in Kuala Lumpur, Barcelona, Cape Town, Frankfurt, London, Rome, Paris.

Can I take Ransomware Defence and Recovery online?

Yes. Every date can also be joined live online in a virtual classroom with the trainer, for £1,280 per participant. Choose "Live online" in the dates table when you register.

How much does the course cost?

Fees start from £2,250 per delegate, depending on the city. Fees include tuition and course materials.

Do participants receive a certificate?

Yes. Delegates who complete the course receive a London Leadership Management Innovation certificate of completion.

Can this course be delivered in-house for our team?

Yes. LLMI can tailor and deliver this course privately for your organisation at your premises or in one of our training cities.

Course information last updated 14 November 2026.

Ransomware Defence and Recovery

Course overview

Course outline

Dates and fees

Frequently asked questions

More IT Management and Cyber Security courses

AI Security: Protecting Machine Learning Systems

Application Security and Secure Software Development

Artificial Intelligence (AI) in Cyber Forensics: Investigating Advanced Cyber Crimes

Training a team?