The challenge
It was 2:17 AM on a Monday when ransomware began its attack. The small professional services firm's employees were sleeping, unaware that a sophisticated threat actor had bypassed their traditional antivirus and was actively encrypting files on an endpoint.
Like many small businesses, the firm faced a familiar set of constraints: limited security budget for a 30-person team, reliance on traditional antivirus with no behavioral detection, and no IT staff monitoring systems overnight. A successful ransomware attack could have destroyed the business entirely.
Their local MSP wanted to provide better protection but lacked 24/7 SOC capabilities. That changed when they partnered with Vijilan and deployed managed monitoring across their client base.
The approach
At 2:19 AM — two minutes after the ransomware began encrypting — Vijilan's SOC detected the suspicious behavioral pattern. Signature-based tools had missed it entirely; behavioral analysis did not.
By 2:22 AM, a SOC analyst had isolated the infected endpoint from the network, cutting lateral spread before it could reach additional systems. At 2:45 AM, the malware was fully removed and the attack vector identified.
At 3:30 AM, the MSP received a comprehensive incident report with full timeline, recovery recommendations, and the hardening steps the SOC had already taken. The SOC then coordinated restoration from clean backups.
The outcome
By 6:00 AM — less than four hours after the attack began — affected files were restored, systems verified clean, and the business was ready to open. Employees arrived Tuesday morning to an alert that an attack had been stopped while they slept.
The MSP delivered a documented incident report to their client within hours: timeline, indicators of compromise, and cyber-insurance-ready evidence. Zero ransom was paid. Zero data was lost.
The client renewed at a higher service tier. The MSP, having demonstrated 24/7 SOC capability they could not have built alone, used the case to win additional clients in the same vertical.
"We came in Tuesday morning to an alert that we had been saved from a ransomware attack overnight. Our MSP and Vijilan stopped it before we even knew it was happening. They didn't just save our data; they saved our business."