Recovering from today's persistent malware and ransomware attacks requires a new approach to recover the environment with speed and precision to get back to business faster. The traditional approach of "tear down and rebuild everything" is too time consuming and costly for today's enterprise-wide attacks, exposing the organization to potential business interruption and downtime.

In this paper we discuss the value of an intelligence-led rapid recovery approach to quickly gain visibility to the full threat context across the entire environment and surgically remove all persistence mechanisms deployed in the attack across hundreds and even thousands of endpoints without the need to reimage, rebuild or replace systems.

The paper presents three use cases comparing the traditional approach to the intelligence-led approach, the relative cost and time of both approaches, and the potential cost of business interruption of using an inefficient recovery process.