A finance staff member at a manufacturer opens a malicious attachment, and ransomware begins encrypting files. On a flat network, it spreads from the office to the servers running the ERP and then toward the systems scheduling production — the line stops, orders go unshipped, and penalty clauses loom. For a manufacturer we protect, network segmentation contains the attack to the office environment, 24/7 SOC monitoring flags the attack early so it can be isolated quickly, and immutable backups with instant recovery bring affected servers back — while the production line, separated and protected, never stops. Containment by design is what keeps a bad day from becoming a bad quarter. For the stage-by-stage version, see what happens during a ransomware attack.