A system for assessing ransomware impact, comprising: one or more processors; and a memory coupled to the one or more processors and including instructions executable by the one or more processors to cause the system to: based on an identification of a ransomware attack and an indication of a first plurality of files stored on a user device, determine a second plurality of files stored in a remote storage, wherein the second plurality of files corresponds to an indication of files stored on the user device at a first prior time; determine a third plurality of files including files included in the first plurality of files and not included in the second plurality of files; calculate a risk assessment based on a classification for each of the third plurality of files, the classification retrieved from a system signature storage of the system, the classification based on multiple characteristics of files included in the third plurality of files, wherein the characteristics comprise a resource intensiveness of the files included in the third plurality of files; wherein the risk assessment indicates a total calculated risk of loss based on the files included in the third plurality of files, wherein the risk assessment is calculated by an incident recovery analyst of the system; and output the risk assessment representing the third plurality of files for remediation of the third plurality of files based on the risk assessment. one or more processors; and a memory coupled to the one or more processors and including instructions executable by the one or more processors to cause the system to: based on an identification of a ransomware attack and an indication of a first plurality of files stored on a user device, determine a second plurality of files stored in a remote storage, wherein the second plurality of files corresponds to an indication of files stored on the user device at a first prior time; determine a third plurality of files including files included in the first plurality of files and not included in the second plurality of files; calculate a risk assessment based on a classification for each of the third plurality of files, the classification retrieved from a system signature storage of the system, the classification based on multiple characteristics of files included in the third plurality of files, wherein the characteristics comprise a resource intensiveness of the files included in the third plurality of files; wherein the risk assessment indicates a total calculated risk of loss based on the files included in the third plurality of files, wherein the risk assessment is calculated by an incident recovery analyst of the system; and output the risk assessment representing the third plurality of files for remediation of the third plurality of files based on the risk assessment. based on an identification of a ransomware attack and an indication of a first plurality of files stored on a user device, determine a second plurality of files stored in a remote storage, wherein the second plurality of files corresponds to an indication of files stored on the user device at a first prior time; determine a third plurality of files including files included in the first plurality of files and not included in the second plurality of files; calculate a risk assessment based on a classification for each of the third plurality of files, the classification retrieved from a system signature storage of the system, the classification based on multiple characteristics of files included in the third plurality of files, wherein the characteristics comprise a resource intensiveness of the files included in the third plurality of files; wherein the risk assessment indicates a total calculated risk of loss based on the files included in the third plurality of files, wherein the risk assessment is calculated by an incident recovery analyst of the system; and output the risk assessment representing the third plurality of files for remediation of the third plurality of files based on the risk assessment.