Patient Zero — A Single Phishing Click
Every outbreak in this model starts the same way: one workstation in one department clicks a malicious attachment. From that single node, the malware begins probing every network edge it can reach.
- 1 node: Typical initial foothold from a phishing email
- ~2.4s: Time this model gives a node to fully encrypt its files once infected
- Star topology: Each department's workstations connect through one hub/switch
- Full mesh: The five department hubs are all directly reachable from each other by default
Why the hub matters
A workstation that gets encrypted is a local loss. A workstation that infects its department's hub turns a local incident into a department-wide one — and an unsegmented hub can reach every other hub directly.
Patch Level Slows, But Does Not Stop, Spread
Raising the patch/endpoint-hygiene slider lowers the per-edge infection probability on every link in the graph, intra-department and backbone alike.
- Up to 90%: Maximum per-edge infection-rate reduction from full patch coverage in this model
- Applies everywhere: Patch level discounts both workstation-to-hub and hub-to-hub attempts
- Not immunity: Even at maximum patch level, some probability of spread remains
Defense in depth
Patching closes the vulnerabilities malware exploits to jump between machines, but zero-day and social-engineering paths mean no patch level alone brings the spread rate to zero.
Network Segmentation Targets the Backbone
The segmentation slider specifically throttles the dashed hub-to-hub backbone links, the ones this simulation draws in purple — leaving intra-department spread untouched.
- 0%: Fully open backbone — infection crosses departments almost as easily as within one
- 100%: Backbone effectively firewalled — an outbreak can still burn through its own department, but struggles to jump to the next
- Visual feedback: Backbone links visibly dim and shift color as segmentation rises
Why segmentation is the highest-leverage control
Real ransomware playbooks explicitly hunt for flat, unsegmented networks because one compromised host can then reach everything. VLANs, firewalled subnets, and zero-trust policies exist precisely to turn this simulator's dense purple mesh into a set of disconnected islands.
Detection and Response Time Decides the Final Toll
Once the configured response time elapses since detonation, this model isolates every node that is still actively infecting or already encrypted, cutting them off from the rest of the network in one action.
- Shorter response time: Fewer nodes reach "encrypted" before containment
- Longer response time: More time for the outbreak to reach additional departments before it is cut off
- One-time event: Containment in this model isolates the infected set at the moment it triggers — it does not retroactively undo already-encrypted damage
Real-world incident response
Security operations teams race against exactly this clock: detect the outbreak, then isolate affected segments before the ransomware's own timer finishes encrypting more of the estate.
Segmentation contains the blast radius; response time decides how much damage happens before containment.