Ransomware resilience
The time to survive ransomware is before it hits
Ransomware attacks create opportunities for prevention, detection and containment at several stages. Prepare backups, controls and response plans to reduce disruption and improve your recovery options.
- Based on Sophos & Verizon data
- Primary sources linked
- Updated 2026
What is ransomware
Not just encryption – extortion
Ransomware is malware that locks up your data and demands payment. Some attacks also steal data, so restoring files does not resolve every consequence.
A ransomware attack encrypts your files and systems, then demands a ransom for the decryption key. But the model has evolved: many groups use double extortion – they exfiltrate your data before encrypting, then threaten to publish it whether or not you can restore from backup.
It’s an industry. Ransomware-as-a-Service (RaaS) lets affiliates rent ready-made toolkits, so attacks are frequent, professional and aimed at organisations of every size.
The good news: an attack is a chain of stages, and layered controls can reduce opportunities at each one – prevent entry, contain spread, protect backups and support recovery.
The threat
How modern ransomware works
Four things that make today’s ransomware different from a decade ago.
- ENTRY
How it gets in
The common doors: phishing, stolen or reused credentials, exposed RDP and VPN, and unpatched internet-facing systems. Most attacks start with one of these.
- DOUBLE
Double extortion
Attackers steal data before encrypting it, then threaten to leak it. This is why backups alone aren’t enough – you also have to keep them from getting in.
- RaaS
Ransomware-as-a-Service
Criminal groups rent their toolkits to affiliates for a cut. It industrialises attacks and lowers the skill needed, driving up volume across every sector.
- TARGET
Who gets hit
About 96% of ransomware victims whose size Verizon could identify were small and medium-sized businesses (DBIR 2026) – the same attackers, met with far less capacity.
Get ready
Review your readiness priorities
Use these control areas as a starting point, then prioritise against your critical services, exposed systems and known gaps.
- Priority 1
Tested, offline backups
A core recovery control, alongside clean systems and a tested response plan. Keep offline or immutable copies, and actually test restoring them.
Why: In Sophos’s 2024 study, 94% of surveyed victims reported attempted backup compromise. Separate access and protected copies matter.
- Priority 2
MFA and patch the edge
Close the common front doors: enforce multi-factor authentication and patch internet-facing systems, VPNs and RDP fast.
Why: Malicious email (26%) and phishing (24%) are now half of all ransomware root causes, and 97% of credential-root-cause victims already had MFA somewhere (Sophos 2026).
- Priority 3
Segmentation and EDR
Contain the blast radius with network segmentation and least privilege, and detect intruders early with endpoint detection and response.
Why: A security gap, known or unknown, was the most-cited operational root cause for the second year running, at 62% (Sophos 2026). Segmentation and EDR only pay off where coverage and response have been tested.
- Priority 4
A rehearsed incident plan
Decide who does what – technical, legal, comms – before an incident, and practise it. A plan on paper isn’t the same as a tested one.
Why: NIS2 gives an in-scope entity 24 hours from awareness to submit an early warning (Article 23(4)(a)) – a clock you meet from a rehearsed plan, not from a document.
Break the chain
Where controls can interrupt an attack
Step through the five stages of a ransomware attack and review controls that can disrupt the chain at each one. Layer the controls: stopping encryption does not reverse data theft that has already occurred.
Interactive mode is not available. All five attack stages, and the controls that break the chain at each one, are listed in full below.
Initial access
Attacker: Gets a foothold via a phishing email, stolen or reused credentials, or an exposed, unpatched service like RDP or a VPN gateway.
Breaks the chain: Enforce MFA everywhere, train staff against phishing, and patch or remove internet-facing services. These measures reduce common entry paths, but detection and recovery controls remain necessary.
The cheapest place to stop ransomware is at the entrance.
Escalation & spread
Attacker: Escalates privileges and moves laterally, hunting for domain admin and mapping the network toward high-value systems.
Breaks the chain: Apply least privilege and tiered admin, segment the network, and run EDR to detect the recon and lateral movement before it reaches everything.
Data exfiltration
Attacker: Copies sensitive data out of the network to use for double extortion – the “pay or we leak it” threat.
Breaks the chain: Monitor and restrict outbound traffic, alert on large or unusual transfers, and block unknown cloud storage. Catching exfiltration limits the leverage.
Encryption
Attacker: Deploys the ransomware, tries to delete or encrypt backups first, then encrypts systems across the estate.
Breaks the chain: Keep offline or immutable backups with separate credentials, and test restores. Usable backups improve recovery options, but clean systems and dependencies must also be restored; backups cannot undo data theft.
Extortion & recovery
Attacker: Demands a ransom and threatens to leak the stolen data, applying time pressure and public naming.
Breaks the chain: Execute a rehearsed incident plan: contain, involve legal and comms, restore from clean backups, and report as required – without relying on paying.
Preparation here is what turns a crisis into a controlled recovery.
Gets a foothold via a phishing email, stolen or reused credentials, or an exposed, unpatched service like RDP or a VPN gateway.
Enforce MFA everywhere, train staff against phishing, and patch or remove internet-facing services. These measures reduce common entry paths, but detection and recovery controls remain necessary.
The cheapest place to stop ransomware is at the entrance.
Escalates privileges and moves laterally, hunting for domain admin and mapping the network toward high-value systems.
Apply least privilege and tiered admin, segment the network, and run EDR to detect the recon and lateral movement before it reaches everything.
Copies sensitive data out of the network to use for double extortion – the “pay or we leak it” threat.
Monitor and restrict outbound traffic, alert on large or unusual transfers, and block unknown cloud storage. Catching exfiltration limits the leverage.
Deploys the ransomware, tries to delete or encrypt backups first, then encrypts systems across the estate.
Keep offline or immutable backups with separate credentials, and test restores. Usable backups improve recovery options, but clean systems and dependencies must also be restored; backups cannot undo data theft.
Demands a ransom and threatens to leak the stolen data, applying time pressure and public naming.
Execute a rehearsed incident plan: contain, involve legal and comms, restore from clean backups, and report as required – without relying on paying.
Preparation here is what turns a crisis into a controlled recovery.
Find out where your chain would break
OffSeq can test each stage against your own environment – entry points, privilege paths, exfiltration and backup protection – and report which controls actually hold. Your selections in the tool are not attached to this request.
Thank you – your request has arrived.
We will reply to the email address you gave.
Sending failed. Try again or email support@offseq.com.
The numbers
The cost and recovery context
Ransomware is common, expensive, and specifically targets the thing that saves you: your backups.
Each figure links to its primary source. Numbers are approximate and updated as new reports are published.
For security teams
Readiness is now a regulatory expectation
Under the EU NIS2 Directive, in-scope organisations must handle incidents, maintain business continuity and backups, and submit an early warning of a significant incident within 24 hours of becoming aware of it.
The measures … shall be based on an all-hazards approach … and shall include at least the following: … incident handling; business continuity, such as backup management and disaster recovery, and crisis management
-
Backups you’ve actually restored
Offline or immutable backups with tested restores can improve recovery options without relying on a ransom payment. Untested backups may be incomplete, inaccessible or too slow to restore.
-
Contain the blast radius
Segmentation, least privilege and EDR can limit spread and help detect a compromise before more systems are affected.
-
A rehearsed response
Tabletop the incident: roles, decision-makers, legal, comms and the 24-hour reporting clock – before it’s real.
-
Test it like an attacker
A penetration test or ransomware-readiness assessment provides evidence about how the tested controls behave, before a real group finds out for you.
Guides
Go deeper
Plain-English guides to preparing for, resisting and recovering from ransomware.
-
Ransomware readiness checklist: the controls that matter most
A prioritised checklist to prepare for ransomware – covering tested recovery, access controls, detection and response.
Read guide -
Should you pay the ransom? What to weigh before deciding
Paying rarely delivers what victims hope. Here’s what to consider – and how preparation can improve your recovery options.
Read guide -
Building a ransomware recovery plan that works under pressure
A recovery plan is what turns a ransomware crisis into a procedure. Here’s what belongs in one – and why rehearsal matters.
Read guide
Frequently asked questions
Short, clear answers
What is ransomware?
Ransomware is malicious software that encrypts an organisation’s data and demands payment for its release. Some attacks also steal data and threaten to leak it – known as double extortion.
Should we pay the ransom?
Authorities generally advise against it. Payment funds further crime, doesn’t guarantee a working decryptor, and doesn’t ensure stolen data won’t be leaked. Tested offline backups and an incident plan are a far more reliable route to recovery.
How do we prepare for ransomware?
Start with tested, offline or immutable backups; enforce MFA and patch internet-facing systems; segment the network and deploy EDR; and rehearse an incident-response plan – the readiness checklist works through each in order.
Why are backups so important against ransomware?
Usable backups can support recovery without relying on a decryption key from an attacker. Attackers may target those copies too, so protect backup access, keep offline or correctly configured immutable copies and test restoration. Backups do not reverse data theft.
What is double extortion?
Attackers exfiltrate your data before encrypting it, then threaten to publish it. It means good backups alone won’t fully protect you – you also have to prevent the intrusion and detect data theft.
How does ransomware usually get in?
Most commonly through phishing, stolen or reused credentials, and exposed or unpatched internet-facing services such as RDP and VPNs. Closing these entry points stops many attacks at stage one.
What is ransomware-as-a-service (RaaS)?
A criminal business model where groups develop ransomware and rent it to affiliates for a share of the proceeds. It industrialises attacks and lowers the skill needed, increasing their frequency.
Does NIS2 require ransomware preparedness?
NIS2 requires in-scope organisations to have incident handling, business continuity and backup measures, and to report significant incidents quickly – with an early warning within 24 hours. Ransomware readiness is central to meeting it.
Tell us where you are
Say what is already in place and what worries you. OffSeq will reply with a suggested next step and the likely scope of work.
Thank you – your request has arrived.
We will reply to the email address you gave.
Sending failed. Try again or email support@offseq.com.