DEV Community: Ryan Beglau

When Ransomware Hits, the District Stops

Ryan Beglau — Wed, 15 Jul 2026 18:55:03 +0000

A recovery playbook for schools and local government. Backups are not the plan. This is the sequence that gets identity, phones, payroll, transportation, and critical services back online in hours instead of weeks.

A few numbers to frame the problem: 82% of reporting K-12 organizations experienced cyber threat impacts per the CIS K-12 Cybersecurity Report; Uvalde CISD canceled four days of classes after ransomware; and federal support for MS-ISAC ended on 09.30.25.

01 — The bad morning

The ransomware call rarely starts with "our files are encrypted." It starts with something more immediate: "the phones are down, the door badges stopped working, and we cannot see the cameras."

When Uvalde CISD confirmed ransomware in September 2025, the district canceled four days of classes because the attack disrupted phones, air-conditioning controls, security cameras, visitor management, and Skyward. That is what a modern district attack looks like. It does not just take data hostage. It takes Tuesday hostage.

02 — The attack before the attack

Your backups are usually the first target. Modern ransomware crews do not encrypt on arrival. They map the environment, escalate access, and find the recovery infrastructure first. If the backup plane trusts the same identity system the attacker controls, one stolen administrator account can compromise production and recovery together.

The fix is architectural. At least one recovery copy must be immutable inside its retention window and inaccessible through production credentials. If every copy can be changed by the same administrator, every copy is inside the blast radius.

Three failure modes to check for:

Shared trust. Production and backup administration use the same identity plane. One compromise, two environments.
Untested recovery. A successful backup job proves data was written. It does not prove operations can return on time. Green check, unknown outcome.
Vendor blast radius. The PowerSchool incident showed how one third-party credential can expose data across many districts. Your plan must include their failure.

03 — The only numbers that matter

Backups answer whether. RTO and RPO answer when and how much. "We have backups" is not an operating commitment. Leadership needs two approved numbers for every critical workload, and IT needs a timed test proving the environment can meet them.

RTO — recovery time objective (hours): how long can the service stay unavailable before the district or municipality cannot operate?

RPO — recovery point objective (lost data): how much recent data can the organization accept losing between the last safe copy and the attack?

04 — Recover in a sequence. Not in a panic.

The first 72 hours decide whether this is a hard week or a lost month. These are illustrative targets, not promises: your real recovery time comes from rehearsing your own environment with a stopwatch.

T+0 — Contain and declare. Minutes, not meetings. Isolate the affected network. Call your insurer, counsel, and incident-response firm. Move communication to a channel the attacker cannot see. Cut lateral movement, preserve evidence, activate out-of-band communications.

T+0–4h — Restore the foundation (Tier 0). Recover identity and core networking into a clean environment. Nothing else can come back safely until trust and connectivity are restored: identity services, DNS, DHCP, core network, privileged access controls.

T+4–24h — Reopen operations (Tier 1). Bring back the systems that determine whether school opens and public services continue. Use the immutable copy as the source of truth: SIS and payroll, phones and transportation, safety and visitor systems.

T+24–72h — Recover in order (Tier 2). Restore the remaining environment in a business-approved sequence. Validate every workload before reconnecting it to production: department applications, file services, validation and monitoring.

T+72h+ — Validate and close. Service comes back before trust does. Confirm eradication with your forensics team, rotate every credential, and keep heightened monitoring in place until the environment has re-earned normal operations.

Recovery principle: isolate affected systems and restore from a clean, offline backup. CISA's StopRansomware guidance recommends maintaining offline backups and regularly testing their availability and integrity.

05 — Back online is not the same as recovered

The restore sequence ends in days. Full recovery takes weeks, and most of it is invisible: proving the attacker is out, proving the data is right, and closing the door they came through. Re-entry through leftover access is how a two-day outage becomes a repeat incident.

Full recovery is declared, not assumed. It ends with evidence:

Eradication proven. Forensics closes the entry point, persistence is hunted down, every credential is rotated, and monitoring watches for re-entry.
Data validated. System owners check restored records against known-good points. Grades, payroll, permits: the departments confirm the data is correct, not just present.
Readiness rebuilt. A fresh immutable baseline, replication re-enabled, the runbook rewritten with what the incident taught, and the next timed failover on the calendar.

06 — Recovery already standing by

A district can build all of this in-house. The honest question is whether a lean IT team can maintain a second recovery environment, protect it from the production blast radius, rehearse it on a schedule, and keep the documentation current while still running everything else. That is why ModernOps runs recovery two ways.

Model A — Managed DR: your infrastructure, run with discipline. Keep the backup and DR investment you already own. ModernOps operates and documents it: immutability verified, restore order written down, restores tested and timed on a schedule, and evidence reports that leadership and insurers can read.

Model B — Hosted DRaaS: we run the recovery side for you. Replication flows to a recovery environment ModernOps hosts and operates: pre-staged, isolated from district credentials, and rehearsed with your team. On the bad morning, failover starts with a call to an engineer who already knows the environment.

Recovery requirement	Built during the incident	Run by ModernOps
Clean environment	Designed under pressure	Pre-staged and isolated in advance
Recovery copy	May share production trust	Locked, immutable snapshots
RTO and RPO	Assumed until tested	Defined, tested, and timed
Bad-morning support	Start with a new ticket	Call an engineer who knows the environment
Documentation	In one engineer's head	Runbooks and test evidence kept current

In either model, recovery stops being a binder and becomes an operation. Replication runs continuously. Restores are tested on a schedule and timed. Documentation stays current because keeping it current is the job. Backup is delivered as BaaS on enterprise storage with immutability built in, and failover is covered by DRaaS with defined RTO and RPO.

07 — The 60-second check

Any unchecked item belongs in the recovery plan. This is a quick screen, not a resilience score:

One recovery copy is immutable and isolated from production credentials.
RTO and RPO are written, approved, and tied to specific systems.
A clean restore has been completed and timed in the last six months.
Identity, network, payroll, SIS, and safety systems have an approved restore order.
The incident team has an out-of-band way to communicate.

08 — Sources

09 — Find your real recovery window before someone else does

The free Rapid Infrastructure Resiliency Assessment scores backup, recoverability, immutability, and failure tolerance in a few hours. It is remote-first, carries no obligation, and ends with a prioritized gap list you can act on.

Originally published at modernops.com.

Disclosure: I work for ModernOps, and sections 06 and 09 describe our own managed recovery services. The incident reporting and statistics cited are drawn from the public sources listed above.

The 3-Host VMware Trap, and the Escape Hatch That Costs About Half

Ryan Beglau — Wed, 08 Jul 2026 15:09:04 +0000

Broadcom went subscription-only, hardware prices are spiking, and small clusters now pay enterprise rates. Here's the math, and what a hosted alternative actually looks like.

I work for ModernOps, a VAR and MSP outside Philadelphia. Every week I see renewal quotes land on the desks of IT managers running the most common infrastructure footprint in the mid-market: three VMware hosts, shared storage, somewhere between 20 and 80 VMs. And every week the reaction is the same. Someone forwards the quote with a one-line email: "Is this right?"

It's right. Here's what changed, what it actually costs now, and the escape hatch we built for exactly this situation.

01 — What Broadcom actually did

When Broadcom closed the VMware acquisition, it ended perpetual licensing entirely and collapsed roughly 168 products into four subscription bundles. The two SKUs small shops actually bought are gone: the Essentials Plus kit was retired, and vSphere Standard hit end-of-sale on July 31, 2025. If you're a three-host shop, the product you're being quoted today is vSphere Foundation (VVF), a bundle priced per core, with a 16-core minimum per CPU, packed with features you may never touch.

The renewal increases being reported publicly range from 150% to over 1,000%, and analyses focused on small business specifically put the typical jump at 350–450%. Miss your renewal anniversary and there's a 20% late penalty waiting.

02 — The 72-core asterisk

In April 2025, Broadcom announced a 72-core minimum per order, meaning a small shop buying licensing for one modest server could be forced to license 72 cores. Reporting since then conflicts: some sources say it took effect and drove 200–350% increases on small and edge deployments; others say it was walked back after backlash, leaving the 16-core-per-CPU floor.

Here's the thing: it almost doesn't matter. Even at the 16-core floor, per-core subscription pricing punishes small clusters. Do the math on yours.

03 — The math on your three hosts

Take the standard build: three hosts, dual socket, 16 cores per socket. That's 96 licensable cores.

Your renewal, itemized:

hosts × sockets × cores: 3 × 2 × 16 = 96 cores
VVF, reported list: $150–$190 /core/yr
your renewal: $14,400 – $18,240 /yr
same cluster, old Standard: ≈ $3,600 /yr

VVF list pricing has been reported at $150–$190 per core per year depending on term. So your three boxes now cost $14,400 to $18,240 a year in licensing alone.

What did the same cluster cost on the old vSphere Standard model? On the order of $3,600 a year. Same three servers. Same workloads. Four to five times the licensing bill, before you've bought a single piece of hardware.

04 — The refresh doesn't save you

The usual answer is "fine, we'll refresh the hardware and ride it out." That plan got expensive too, because AI demand is eating the component supply chain.

TrendForce reported conventional DRAM contract prices up roughly 93–98% quarter-over-quarter in Q1 2026, the largest quarterly jump on record, with another 58–63% projected for Q2 and NAND up 70–75%. Gartner projects DRAM up around 130% year-over-year for 2026.

+93–98% — DRAM contract price, Q1 2026, QoQ · largest jump on record
+17% — Dell list-price increase, Mar 2026 · Cisco, Lenovo, HP & HPE followed at 10–15%
24+ wks — Lead times on popular server configs, up from ~10 weeks

Server vendors passed it through fast. Dell raised list prices roughly 17% effective March 30, 2026 across its lines including PowerEdge; Cisco raised compute pricing in early March; Lenovo, HP, and HPE followed with increases in the 10–15% range. Memory now represents as much as a quarter to a third of a server's bill of materials (a 32GB DDR5 server module that sold for about $149 was quoted near $239 roughly two months later), and lead times on popular configs stretched from around 10 weeks to 24 or more.

So the "keep vSphere, buy new hosts" plan means: pricier boxes, a much pricier license attached to every core in them, and a wait measured in quarters.

05 — Why Proxmox changes the denominator

Proxmox VE is the open-source hypervisor platform that a lot of the VMware exodus is landing on: over 1.5 million hosts under management worldwide, twenty years of development, and a built-in import wizard that pulls VMs straight off ESXi. Its developers estimate the large majority of typical vSphere environments migrate cleanly.

The economics are structurally different: Proxmox is licensed per socket, not per core, and the software itself is free. Enterprise repository support runs about €550 per socket per year on the Standard tier.

6 sockets × €550 ≈ €3,300 (~$3,600) /yr — clustering · live migration · HA · backup · SDS included

Six sockets across your three hosts is roughly €3,300 (~$3,600) a year, with clustering, live migration, HA, backup integration, and software-defined storage in the box.

That's the old vSphere Standard number. The one Broadcom took away.

06 — The part nobody tells you

Here's the honest catch: a two- or three-person IT team doesn't want to become a Proxmox operations team. Migrating a hypervisor is real work, and running one well (patching, clustering, storage tuning, backup verification, capacity planning) is a permanent job, not a project.

That's the gap we built for. ModernOps runs Proxmox at scale in our own infrastructure, behind a custom front end that gives your team the cloud experience (a self-service portal, fast provisioning, monitoring, predictable monthly billing) without you owning a single host. Compute lands on our IaaS. Recovery is covered by DRaaS with defined RTO and RPO. Backup is delivered as BaaS on enterprise storage with immutability built in.

Because it's one platform serving many clients, you get economies of scale a three-host shop can't reach alone. And when something breaks at 2 a.m., you call a phone number and an engineer answers. Not a chatbot. Not a ticket queue in another hemisphere.

07 — Where the savings actually come from

People assume hosted means marked up. It's the opposite, and the reasons are structural.

Start with redundancy math. A three-node cluster running N+1 keeps a full third of its hardware in reserve: you bought three hosts to safely use two, and you're paying to power, license, patch, and warranty all three either way. A ten-host platform cluster running N+2 reserves 20% instead of 33%, and that reserve is shared across every workload on the platform rather than parked for one company's bad Tuesday. Less idle iron per VM is a real, recurring saving.

Then there's the boring part, which is the point. Every host in our fleet runs one extremely by-the-book configuration: same firmware, same network layout, same storage design. Upgrades follow a defined cadence with documented, repeatable procedures, validated before they touch production. Predictable systems fail less, and when something does misbehave, troubleshooting a known configuration takes minutes instead of a weekend of archaeology. Operations hours are one of the biggest hidden costs of self-hosting, and standardization removes most of them.

And nothing sits stranded. We fill racks properly and share what was built to be shared: a switch port that would sit dark in your closet serves another workload here, so nobody is buying a 48-port switch to light up 12. Rack space, PDUs, UPS capacity, and cooling are bought once, at data-center rates, and spread across the platform instead of one three-host island. Hardware refreshes happen on our schedule at volume pricing, spares are stocked once for the fleet, and patching and host upgrades are simply our problem, not yours.

You get VMs and backups in a cloud-like format. We sweat the racks, power, cooling, refreshes, and upgrades behind them. Add up the idle redundancy you no longer buy, the ops hours you no longer burn, and the ports and racks you no longer strand, and hosted genuinely comes in under buying and self-hosting the gear.

08 — About "half the price"

I'll be straight about this number: it's our modeled TCO, not somebody's published study. For the typical three-host refresh scenario, the hosted model avoids the VVF subscription ($14K–$18K a year), avoids the refresh capex (three servers at 2026 prices plus the switch refresh that usually rides along), and avoids the idle N+1 host, power, cooling, UPS maintenance, and staff hours that on-prem quietly consumes. Run over a five-year horizon against a monthly hosted plan, most of the models we build land at or below half the all-in cost of staying on-prem with VMware.

There's precedent at much larger scale for the underlying idea: that predictable workloads on the right platform beat sticker assumptions. 37signals famously moved off the public cloud, bought its own storage for a fraction of its annual S3 bill, and reported cutting its overall cloud spend from over $3 million a year to well under $1 million. The direction of the math holds at three hosts too; it just points toward a shared platform instead of your own racks.

09 — Bring us your quote: free 3-host TCO teardown

If your VMware renewal or hardware refresh is on the table this year, don't sign it on autopilot. Send us the quote and we'll model your current licensing and refresh costs, line by line, against a hosted IaaS/DRaaS/BaaS plan on our platform.

Request a 3-Host TCO Teardown →

You'll talk to the engineer who would actually run your environment.

Originally published at modernops.com.

Disclosure: I work for ModernOps, and sections 06-09 describe our own hosted platform and services. The market figures in sections 01-05 are drawn from public reporting; run them against your own quotes.