Karim Mesbah

Runs the incident response cell. On call the night most people are not.

Background

Karim Mesbah leads Norva’s CERT and its on-call rotation. Before joining in 2018 he spent six years in digital forensics, producing evidence packages used in both insurance claims and criminal proceedings.

He has led containment on more than sixty ransomware cases. His recurring observation: the organisations that recover fastest are not the ones with the best tooling, but the ones that rehearsed the decision-making.

Written by Karim Mesbah

2 August 2026

Ransomware

Anatomy of a double extortion, hour by hour

Seven days from initial access to the ransom note, reconstructed from an engagement where the client kept every log.