Double & Triple Extortion Ransomware: Pressure Model (2D)

Incident Controls

Lateral-movement speed 1.0×

Network segmentation 30%

Backup / IR readiness 40%

Live Readouts

Systems encrypted

0 / 144

Records leaked

Modeled ransom-payment probability

Elapsed incident time

0.0 h

How it works

Each of the 144 nodes is one system on the network graph, laid out on a flat 12×12 grid you can drag to pan and scroll/pinch to zoom. Encryption starts at one compromised host and spreads by lateral movement: each tick, every already-encrypted node tries to infect its orthogonal neighbours with probability

p_spread = p_base · speed · (crossing a segment boundary ? (1 − segmentation) : 1)

Segmentation splits the grid into 3×3 blocks (drawn as brighter dividing lines); a move that crosses a block boundary is throttled by the segmentation slider — this is literally what VLAN/zone segmentation buys you during a real incident: it doesn't stop the first compromise, it slows the spread.

Data exfiltration (double extortion) runs a second, slower infection front once enabled — leaked systems get an amber ring on top and count toward "records leaked". A DDoS layer (triple extortion) adds a third, independent pressure source drawn as a pulsing red dashed ring around the grid.

The three pressure sources combine into a single score, and the modeled payment probability is a logistic function of pressure minus defensive readiness — plotted live in the strip chart below the grid:

P = 0.55·encFrac + 0.30·leakFrac + 0.15·ddosLevel
readiness = 0.7·backup + 0.3·(segmentation·0.5)
payProb = 1 / (1 + e^−6·(P − readiness − 0.15))

Higher backup/IR readiness and stronger segmentation both push the modeled payment probability down — the two levers real incident-response playbooks recommend investing in before an incident, not during one.

Safe system Encrypted Data exfiltrated (ring) DDoS pressure ring

drag to pan · scroll/pinch to zoom