Insurance Carrier Wrote Its Own Ransomware. SecuritySnares Stopped Every Variant.

At a Glance

• Industry: Insurance and Reinsurance
• Environment: 1,900+ IT endpoints
• Time to deploy: 3 weeks
• Zero-day strains tested: 4 AI-generated variants, all stopped
• Coverage: Endpoints, servers and file shares
• Validation: Deployment, policy, simulation, SOC
• Result: 4 of 4 variants stopped and zero files encrypted

Background

The insurance carrier underwrites cyber risk for its customers, and its teams price ransomware exposure for other companies every day, which sets a high bar for the controls they run themselves: "We verify every vendor claim."

The Challenge

The Global Head of IT Operations and CISO needed protection they could test against live, unknown threats without disrupting endpoint performance, critical applications, or SOC workflows.

"We underwrite this risk, so we know exactly what a bad outcome looks like from the outside," the CISO says. "I was not going to sign off on a control that had only ever been tested against samples someone else picked."

The Solution

The Carrier's team used AI to write four zero-day ransomware variants to test RansomSnare. Malware that had never existed before, built by the people who would have to live with the results. The Carrier detonated the ransomware on a server protected by SecuritySnares alongside the current security stack already in production. Over three weeks, the evaluation covered deployment, policy testing, simulations, and SOC integration exercises across file shares, scripts, PowerShell activity, and encrypted archives.

Instead of deploying RansomSnare company-wide, they staged the rollout so it protected the most critical areas first. The agents were deployed to the IT team's endpoints first, which meant the people who would support it were the first to live with it. The Carrier then expanded location by location, checking stability, performance, and SOC alert routing at each site before moving on. By the end of the third week, RansomSnare was running on more than 1,900 endpoints, and the Carrier approved it for full release.

"We put it on ourselves first. If it was going to be a problem, we wanted to be the ones who found out," the CISO says. "It never became one, so we just kept moving site to site."

Once the test results were in, the internal case was easy to make. The CISO didn't ask the executive team to evaluate a product. He showed them four pieces of malware written by their own engineers, and none encrypted a single file. The Carrier's underwriters assess this exact risk at other organizations, so for its leadership, that evidence settled the question, and approval came quickly.

Results

• 4 of 4 custom variants stopped: Every zero-day sample the Carrier's own team authored was detected and blocked.
• Zero files encrypted: No unauthorized encryption on any endpoint or file share at any point in the evaluation.
• Zero unplanned downtime: No outage, agent failure, or measurable performance impact since rollout.
• Production-ready in 3 weeks: All release criteria met for protection, performance, stability, and SOC workflow, across 1,900+ endpoints.
• No recovery required: Nothing encrypted, so the Carrier never restored a file or invoked incident response.
• Evidence instead of assurance: The Carrier answers the ransomware question with results from malware it wrote itself, not a vendor's test data.

The outcome the team talks about internally is not on a dashboard. For years, "would we hold against something nobody has seen before" had only an opinion for an answer. Writing four of those variants and watching every one fail turned it into a result.

"The part of this job that keeps you up is the unknown variant, the one nobody has a signature for," the CISO says. "We built four of them, and none of them landed. That is a very different kind of quiet than a clean dashboard."

Why SecuritySnares

• Proven against novel malware, not samples. Most ransomware tools are validated against known signatures or vendor-supplied simulations. The Carrier proved SecuritySnares against AI-generated variants that had never been seen before.
• Tested alongside a live stack, not instead of one. The evaluation ran with the Carrier's existing endpoint controls in place and in production conditions, not just on isolated systems with other protections switched off.
• Built to pass a security team's own bar. The Carrier set the release criteria: stable deployment, agent recovery, endpoint visibility, event forwarding, alert routing, and SIEM integration. SecuritySnares met all of them.
• Prevention, not damage control. Recovery-based approaches depend on catching a key exchange they can observe, so an actor who generates keys offline or uses a method the tool doesn't recognize defeats the premise. Even when interception works, the files were already encrypted and the clock was already running. RansomSnare stops the write before it happens. The Carrier restored nothing, because nothing was lost.

About SecuritySnares

SecuritySnares develops RansomSnare, a microsensor that reinforces existing endpoint protection to stop ransomware before it encrypts a single file. RansomSnare works alongside endpoint security tools and supports legacy and modern operating systems.

See how RansomSnare would protect your environment. Request a live demo or run the ZeroDay Ransomware Simulation Test against your own systems.