Ransomware restore drills

Restores a real server from backup on a schedule and times the rebuild, so recovery time is measured rather than assumed.

macOS — coming soonSee the 4 automations
IT / AUTOMATE.md

On the 15th, restore one file from the newest backup, check that it opens, and log the result against the recovery objective for that server.

Ready-made: File Restore Test

The job, and what good looks like.

Backup jobs report success because the job finished, not because a file came back. The first real restore test happens during an outage, when the missing credential, the slow link, the wrong file selection and the undocumented dependency all surface at the same time. The workflow runs the drill on a schedule and treats it as a measured event. It picks a representative server for each tier, restores it to an isolated network, and records the time for each step separately: finding the right restore point, fetching the data, rebuilding the host, and bringing the service back. Anything missing is written into the runbook the same day rather than at the next review. It also opens the break-glass credentials a real recovery would depend on, because a vault nobody has used in a year is not a plan. The result is a written recovery time per tier with an owner against every open gap. A human approves the drill scope and signs the result.

When it is handled

  • Measured recovery time per server tier
  • Documented dependencies and credentials
  • Drill evidence attached to the result

Works with tools like

  • Veeam
  • Cohesity
  • CrowdStrike Falcon
  • Jira Service Management

Ready-made automations. Pick the one that fits.

Each one is a plain-language document. Run it as it is, or change the timing, the rules and the tools to match your team.

File Restore Test

On the 15th, restore one file from the newest backup, check that it opens, and log the result against the recovery objective for that server.

On the 15th of each month

Quarterly Restore Drill

Every quarter, restore one representative server to an isolated network, time each step, and write the runbook with whatever turned out to be missing.

Every quarter, two weeks before the audit window

Recovery Readiness Check

When a ransomware alert fires, pull the newest clean restore point, open the break-glass credentials in the vault, and post the recovery options to the incident lead.

When a ransomware alert is raised

Restore Drill Report

When a drill is signed off, put the open gaps and the timings into a one-page report and attach it to the compliance evidence record for that quarter.

When a restore drill is signed off

You stay in charge.
At every step.

It triages and sweeps. People approve every change.

  • No change without approval

    Blocking, revoking and purging wait for an analyst's OK.

  • Every run on the record

    What it read, what it did and what it is waiting on, kept for review and audit.

  • Scoped per automation

    Each automation gets only the access you grant it, and a local model can keep processing on your machine.

File Restore Test

Approve before it files the ticket?

ReviewApprove

Before you download.

Where does it run?
On your Mac or Windows computer, in the background. It keeps working after you close its window, and only reaches the folders and apps you connect for each automation.
How does it connect to our CRM and other tools?
Through each app's own connection where it offers one, signed in once by you, or by using the app in a browser the way you would. Each automation gets only the connections you give it, and the tools a page names are examples you can swap for your own.
Does it run when my computer is asleep?
It keeps your computer awake while a job runs and just before a scheduled one. While the computer is closed or off, nothing runs; when it wakes, it checks the inbox, calendar and other sources it watches for anything that arrived meanwhile.
How does my team use it?
Each person who runs automations installs the app. Keep a project in a shared folder, such as Google Drive or a network drive, and teammates can open it and follow every run, while one person owns it and runs it.
Do I need anyone technical to set it up?
No. Download the app, add an automation in plain words, and connect only what that job needs. Nothing runs until you switch it on.

Already have tools for this? Here is the difference.

Scripts and scheduled jobs

Precise, repeatable system tasks.

They break on the unexpected, and only their author can read or change them.

Security automation platforms

High-volume response playbooks in large teams.

They need a project to set up and an engineer to maintain each playbook.

AI chat assistants

Explaining an alert when you paste it in.

Nothing runs on schedule, and there is no scoped access or record of what was done.

AUTOMATE.md

Your routine, written in plain words. It runs on its own, follows your rules, handles the exceptions a flowchart can't, and asks you when it matters. The file stays yours, whichever AI model runs it.

Related workflows.

Backup verification

Restores a real file and a real service on a schedule, so a green job status stops standing in for a proven recovery.

Write your own

Incident triage

Turns an incoming alert into one case with an owner, a severity and a first decision, so response starts while the detail is still arriving.

Write your own

Audit trails

Joins the scattered administrative change records into one timeline, so an auditor's question is a search rather than a fortnight of exports.

Write your own

Start with one job.
Make it your own.

macOS — coming soon
  1. 1

    Get the app

    It runs on your computer, next to your files.

  2. 2

    Add the automation

    Paste the instructions into the app, or save them as a file next to your work.

  3. 3

    Try it, then turn it on

    Run it once and check the result. It only runs on its own once you switch it on.

macOS — coming soon