Double & Triple Extortion Ransomware: Pressure Model

Incident Controls

Lateral-movement speed 1.0×

Network segmentation 30%

Backup / IR readiness 40%

Live Readouts

Systems encrypted

0 / 144

Records leaked

Modeled ransom-payment probability

Elapsed incident time

0.0 h

How it works

Each of the 144 nodes is one system on the network graph. Encryption starts at one compromised host and spreads by lateral movement: each tick, every already-encrypted node tries to infect its orthogonal neighbours with probability

p_spread = p_base · speed · (crossing a segment boundary ? (1 − segmentation) : 1)

Segmentation splits the grid into 3×3 blocks; a move that crosses a block boundary is throttled by the segmentation slider — this is literally what VLAN/zone segmentation buys you during a real incident: it doesn't stop the first compromise, it slows the spread.

Data exfiltration (double extortion) runs a second, slower infection front once enabled — leaked systems glow amber on top and count toward "records leaked". A DDoS layer (triple extortion) adds a third, independent pressure source shown as the pulsing ring above the grid.

The three pressure sources combine into a single score, and the modeled payment probability is a logistic function of pressure minus defensive readiness:

P = 0.55·encFrac + 0.30·leakFrac + 0.15·ddosLevel
readiness = 0.7·backup + 0.3·(segmentation·0.5)
payProb = 1 / (1 + e^−6·(P − readiness − 0.15))

Higher backup/IR readiness and stronger segmentation both push the modeled payment probability down — the two levers real incident-response playbooks recommend investing in before an incident, not during one.

Safe system Encrypting Encrypted Data exfiltrated

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.