How to Protect Your Organisation from Ransomware

Ransomware is prevented by layered controls: phishing-resistant MFA, fast patching of internet-facing services, network segmentation, tested offline backups, and behavioural detection. No single control is sufficient.

Why Is Ransomware So Dangerous?

Direct costs: downtime, data theft, forensics, regulatory fines. Downtime typically costs more than the ransom itself. The Sophos State of Ransomware 2025 report put average recovery cost at $1.53 million, down from $2.73M in 2024 but still severe.

How Serious Is the Ransomware Threat Right Now?

The Verizon 2025 DBIR, analysing over 12,000 confirmed breaches, found ransomware in 44% of all breaches, up from 32% the prior year, and in 88% of SMB breaches. Sophos 2025 found 32% of incidents started with an exploited vulnerability, the most common root cause three years running. No credible GCC-specific figure exists in current published reports.

Real Ransomware Attacks and What They Teach

Colonial Pipeline (2021, CISA advisory): One compromised VPN credential with no MFA. Phishing-resistant MFA on that account would have stopped the intrusion.

Kaseya VSA (2021, CISA advisory): An unpatched zero-day in on-premises VSA software let attackers push ransomware to roughly 1,500 downstream customers. Timely patching and platform isolation were the absent controls.

Change Healthcare (2024, company statement): Stolen credentials on a Citrix portal with no MFA caused weeks of disruption to US pharmacy claims processing. Same missing control as Colonial.

Warning Signs of a Ransomware Attack

• Mass file modification across endpoints or file shares in a short window
• Unusual admin credential use outside business hours
• Bulk outbound data transfer to unknown destinations
• New scheduled tasks created by non-standard accounts
• Ransom note files appearing in directories

How to Prevent Ransomware

Email Security and Phishing Resistance

Configure DMARC, SPF, and DKIM with reject policies. Sandbox executable attachments and scan links at click-time. Run simulations with measured click rates and keep a no-blame reporting channel open. One client staff member spotted a mismatched sender address on a financial request and reported it, stopping the attempt before any technical control could even fire.

Identity and Multi-Factor Authentication

Use phishing-resistant MFA (FIDO2 hardware tokens) on all remote access, not SMS or push. Separate privileged accounts from day-to-day use. One retail organisation’s hardware token requirement stopped a credential stuffing attack cold; the attackers had valid credentials from a third-party breach and still got nowhere.

Patching and Reducing Exposed Surface

Prioritise internet-facing services: VPN gateways, file transfer appliances, and edge devices are the most commonly exploited entry points. Use the CISA Known Exploited Vulnerabilities (KEV) catalogue as your patch prioritisation list.

Network Segmentation

A compromised endpoint should not reach backup servers or domain controllers. Micro-segmentation for critical clusters is the control that decides containment versus total encryption.

Backups That Actually Survive an Attack

Follow the 3-2-1-1 rule: three copies, two media types, one offsite, one immutable or air-gapped. Modern ransomware targets backup platforms first. An untested backup is not a backup.

Detection and Response

EDR with behavioural detection catches mass file encryption and credential abuse before a ransom note appears. Pair it with NDR and SIEM correlation. Tooling no one watches does not help.

Ransomware Readiness Checklist