8 Ways to Protect Your Organization from Ransomware

Ransomware is still the attack most likely to shut an office down for days. In Verizon's 2026 Data Breach Investigations Report, ransomware showed up in 48% of breaches, up from 44% the year before (Insurance Journal). Sophos surveyed 2,158 organizations hit in the past year and found attackers managed to encrypt data in 56% of cases. The average recovery bill was $1.7 million per incident (Sophos).

The FBI received 3,611 ransomware complaints in 2025 with more than $32 million in reported losses. That number leaves out downtime, replacement equipment and cleanup, which is where most of the real cost lands (HIPAA Journal on the FBI IC3 report).

The good part is that the ways in are predictable. Verizon found that 31% of breaches now start with an exploited vulnerability, the first time in 19 years that has beaten stolen passwords (Verizon). Sophos puts malicious email and phishing at half of all ransomware root causes, with compromised credentials close behind at 23%.

Smaller companies take the worst of it. Only 34% of organizations with 100 to 250 employees stopped an attack before data was encrypted or stolen, compared with 46% of the largest firms in the Sophos survey. Here are eight things that close those doors, in roughly the order we'd tackle them in a typical office. None of them needs a big security team. Most come down to configuration and follow-through.

1. Keep backups the attacker can't reach, and prove they restore

Attackers go after backups first, because a company that can restore doesn't pay. In Veeam's 2024 study of 1,400 organizations, 96% of ransomware attacks targeted backup repositories (Vanson Bourne). The UK's National Cyber Security Centre has seen ransomware encrypt the connected USB drives, network storage and cloud folders holding backups, right along with the live data (NCSC).

What holds up in practice:

• At least one copy offline or immutable at all times. CISA's guide calls for offline, encrypted backups of critical data, since many strains hunt for reachable backups and delete them (CISA). For cloud copies, object lock or write-once storage does the same job.
• The 3-2-1 rule. Three copies, on two different devices, with one offsite (NCSC).
• Separate backup credentials. If your backup console logs in with the same domain admin account as everything else, one stolen password takes both. Keep backup admin accounts separate, and don't let regular user devices modify backups.
• Test restores, on a schedule. Pick a real server and restore it end to end, and time how long it takes. A backup job that says "success" every night tells you nothing about whether the restore works.

This is the control that pays off most when everything else fails. In Sophos's 2026 survey, 66% of organizations whose data was encrypted got it back from backups, up 12 points from the year before (Sophos).

2. Lock down remote access and anything facing the internet

Your firewall and VPN are the front door, and attackers try the handle all day. Sophos asked victims where attacks began when the cause was an exploit, a stolen password or brute force: 21% started at a firewall and 8% at a VPN. Firewall break-ins were the expensive ones. When the attack began with a firewall vulnerability, 59% of ransom demands were $1 million or more (Sophos).

Coveware, which handles ransomware negotiations for victims, saw remote access compromise become the leading way in over the past year (BleepingComputer). The Akira group is a textbook case. The FBI and CISA found it mostly got in through VPNs with no multifactor authentication, using known Cisco flaws, and it had taken about $42 million from more than 250 organizations by early 2024 (FBI and CISA advisory).

What to do:

• Never expose Remote Desktop to the internet. CISA says not to publish RDP on the web at all, to close unused ports, and to put remote access behind a VPN with MFA (CISA).
• MFA on every VPN login and on the firewall's own admin page. Sophos found MFA was often on cloud apps but missing from VPNs and firewall admin consoles, which is exactly where attackers walked in.
• Keep firewall and VPN firmware current. Follow your vendor's security advisories and treat an exploited edge flaw as same-week work, not next quarter's.
• Take management interfaces off the public internet. Admin access should come only from inside the network or a dedicated management segment.
• Check what you're actually exposing. Scan your own public IP addresses and compare the results to what you think is open. CISA offers free vulnerability scanning for this.

3. Put phishing-resistant MFA on email, VPN and every admin account

Most ransomware starts with someone logging in, not breaking in. Sophos found that 79% of the attacks in its 2026 survey began with an identity-based approach (Sophos). Microsoft reports that more than half of attacks with a known motive were extortion or ransomware, and that phishing-resistant MFA can block over 99% of identity-based attacks (Microsoft).

Having MFA somewhere isn't the finish line. In the Sophos data, 97% of victims whose attack began with stolen credentials had MFA enabled in some form. The damage happened in the gaps.

• Find the gaps first. List every place someone can log in from outside: email, VPN, remote support tools, the firewall, the backup console, cloud admin portals. Confirm MFA is enforced on each one. CISA says any system that can't do MFA should be escalated to senior management (CISA).
• Use phishing-resistant methods for the accounts that matter most. CISA names FIDO and WebAuthn (security keys and passkeys) as the only widely available phishing-resistant MFA. It says to start with system administrators, executives, email, file servers and remote access (Cybersecurity Dive). Text-message codes are better than nothing, but they're not in that class.
• Cut down what reaches the inbox. Malicious email and phishing were half of all ransomware root causes in the Sophos survey. CISA recommends attachment filtering, tagging external email, DMARC on your domain, and disabling macros in Office files that arrive by email.

4. Patch what attackers are actually exploiting, first

Patching everything right away isn't realistic, and the numbers show it. Verizon found organizations fully fixed only 26% of critical vulnerabilities in 2025, 12 points worse than the year before (Insurance Journal). With exploitation now the top way into a network, the answer is to patch in the right order, not just faster.

• Start with CISA's Known Exploited Vulnerabilities catalog. It lists flaws confirmed as exploited in the wild, 1,379 of them as of this writing, and flags the ones known to be used in ransomware campaigns. CISA tells organizations to use it to set patch priorities (CISA KEV). If an entry matches your firewall, VPN, backup server or email server, that's this week's work.
• Set deadlines by exposure. Australia's Essential Eight asks for internet-facing servers and network devices to be patched within 48 hours when the vendor rates a flaw critical or a working exploit exists. Workstations and internal servers get up to a month at the higher maturity levels (ASD).
• Include the boxes nobody logs into. Firewalls, switches, storage units and hypervisors need firmware updates too. CISA warns that ransomware crews increasingly go after VMware ESXi and other hypervisors, because hitting one host encrypts every server on it (CISA).
• Retire what can't be patched. End-of-life gear stops getting fixes. Replace it, or at least cut it off from the rest of the network.

5. Segment the network so one infected PC can't reach everything

Once inside, attackers move fast. CrowdStrike measured average breakout time for criminal groups, from first foothold to a second system, at 29 minutes in 2025, and the fastest case took 27 seconds (CrowdStrike). Mandiant found the median handoff from the crew that breaks in to the crew that runs the attack dropped to 22 seconds (Security Point Break on M-Trends 2026). On a flat network, where every PC can talk to every server, that's all the time they need.

Segmentation is the network's answer, and most of it is configuration on switches and firewalls you already own:

• Separate traffic by function. Users, servers, management, backups, phones, cameras and other IoT, and guest Wi-Fi each get their own VLAN, with firewall rules deciding what can cross. CISA recommends segmenting departments and keeping IT and operational technology apart, because it limits how far an intruder can move (CISA).
• Block workstation-to-workstation traffic. CISA points out that most Windows PCs need file-sharing (SMB) access to domain controllers and file servers, not to each other. Shutting that path down stops one of the most common ways ransomware spreads.
• Wall off backups and management. Mandiant reports ransomware crews now deliberately go after backup systems, identity services and virtualization management to block recovery. Those systems belong on segments that user VLANs can't reach at all.
• Keep a current network diagram, with a copy offline. CISA asks for one that shows systems and data flows. During an incident, it's how responders decide what to cut off first.

6. Cut admin rights and guard the accounts that run everything

Ransomware needs admin rights to do real damage. That's how attackers switch off security tools, delete shadow copies and push the encryptor to every machine at once. CISA notes that attackers often use privileged accounts for network-wide attacks (CISA). In Akira cases, the FBI saw attackers create new domain accounts, dump passwords with tools like Mimikatz, and run scripts built to pull saved credentials out of Veeam backup servers (FBI and CISA advisory).

• Keep admin accounts separate from everyday accounts. Nobody should read email or browse the web while signed in as a domain admin. CISA wants designated admin accounts used only for admin work, and Australia's Essential Eight strictly limits which privileged accounts can reach the internet at all (ASD).
• Take local admin away from regular users. Where a local admin account has to exist, give each machine its own random password. CISA recommends Microsoft's Local Administrator Password Solution (LAPS) for this.
• Grant admin rights only when they're needed. The FBI and CISA recommend time-based, just-in-time access, where admin accounts stay disabled until someone requests them for a specific task.
• Review accounts every quarter. CISA says to look for inactive or unauthorized user and admin accounts quarterly, including remote management tools and access given to MSPs. That includes us. Your IT provider's access should be held to the same standard as anyone else's.

7. Watch the network, and make sure someone answers the alerts

Prevention fails sometimes, so the next question is how fast you notice. In Kroll's Akira cases, attackers reached a domain admin account within two days of getting in, and the ransomware went off shortly after (Kroll). The Center for Internet Security points out that many organizations keep logs but rarely look at them, which is how attackers sometimes sit inside a network for months (CIS Controls).

• Run EDR on every server and workstation. CISA recommends endpoint detection and response or application allowlisting on all assets. The FBI and CISA call EDR especially useful for spotting one machine reaching into another.
• Centralize your logs. Pull firewall, VPN, server and sign-in logs into one place. CISA suggests keeping logs for critical systems at least a year where possible, and Kroll recommends watching edge devices for repeated failed logins and brute-force attempts.
• Alert on the moves ransomware crews make. New admin accounts, domain admin logins at odd hours, sudden Remote Desktop between workstations, remote access tools nobody installed, and deleted shadow copies. All of them show up in CISA's threat-hunting checklist.
• Watch what leaves. Coveware found data theft in more than 76% of the attacks it handled in Q3 2025 (BleepingComputer). Large outbound transfers, especially through tools like Rclone or file-sync services, deserve an alert.
• Decide who answers at 2 a.m. An alert that fires Saturday night and gets read Monday morning is a report, not a detection. In-house or outsourced, someone needs to own the alerts and know what they're allowed to shut off.

8. Write the response plan now, and decide where you stand on paying

The worst time to work out who calls whom is while files are encrypting. CISA recommends a written incident response and communications plan, approved in writing by the CEO, with a printed copy and an offline copy, since your file server and email may be down (CISA). NIST's April 2025 rewrite of its incident response guidance treats response as part of everyday risk management, not a binder on a shelf (NIST SP 800-61 Rev. 3).

A plan you can actually use answers six questions:

1. Who decides? Name the person who can order systems offline, plus a backup.
2. How do we talk? Assume attackers can read your email. CISA advises phone calls and other out-of-band channels while isolating systems, so you don't tip them off.
3. How do we isolate? If several systems are hit, CISA says to take the network offline at the switch level. Know where your core switches are and who has console access.
4. Who do we call? Your IT provider, cyber insurer, outside counsel, and the FBI or CISA. In IBM's 2024 study, ransomware victims who brought in law enforcement saved about $1 million on average, not counting any ransom (IBM).
5. What comes back first? Keep a ranked list of critical systems so recovery order isn't decided under pressure.
6. Have we practiced? Run a tabletop exercise at least once a year with the people who'd be in the room. CISA offers free exercise packages.

On paying: fewer victims do it now. Chainalysis found only 28% paid in 2025, an all-time low (The Register). Paying doesn't guarantee recovery either. In Veeam's 2024 study, 27% of organizations that paid still couldn't get their data back (Vanson Bourne).

There's a legal side, too. The US Treasury's sanctions office strongly discourages payments and can impose civil penalties for paying a sanctioned group even if you didn't know who was on the other end. It counts prompt reporting to law enforcement and solid security practices as significant mitigating factors (OFAC). Work through this with your insurer and lawyer before an incident, not during one.

Where to start

You don't need all eight done by Friday. If you're starting from scratch, the order above is roughly the order we'd work in: backups you can restore, then remote access and MFA, then patching whatever faces the internet. Those three close most of the doors attackers are walking through right now.

InterDataLink designs, installs and manages the network side of this for offices across New York City, including firewalls, VPN and remote access, and switching and segmentation. If you'd like a second set of eyes on where your network stands, call us at 866-252-1860.

Sources

• Sophos, The State of Ransomware 2026
• Verizon, 2026 Data Breach Investigations Report press release, May 19, 2026
• Insurance Journal, Verizon DBIR Says Software Vulnerabilities Aren't Being Patched Quick Enough, June 1, 2026
• HIPAA Journal, 2025 Losses to Cybercrime Exceeded $20 Billion (FBI IC3 2025 report), April 8, 2026
• CISA, FBI, NSA and MS-ISAC, #StopRansomware Guide, September 2023
• CISA, Known Exploited Vulnerabilities Catalog
• FBI, CISA, Europol EC3 and NCSC-NL, #StopRansomware: Akira Ransomware (AA24-109A), April 18, 2024
• UK National Cyber Security Centre, Offline backups in an online world
• Vanson Bourne for Veeam, Ransomware Trends Report 2024
• BleepingComputer, Ransomware profits drop as victims stop paying hackers (Coveware Q3 2025 data), October 27, 2025
• Microsoft, Microsoft Digital Defense Report 2025: Extortion and Ransomware Drive Over Half of Cyberattacks, October 22, 2025
• Cybersecurity Dive, CISA demystifies phishing-resistant MFA, November 4, 2022
• Australian Signals Directorate, Essential Eight maturity model changes, November 2023
• CrowdStrike, 2026 Global Threat Report announcement, February 24, 2026
• Security Point Break, M-Trends 2026: Faster intrusions, higher stakes for defenders, March 23, 2026
• Kroll, Akira Ransomware Makes a Play for VPNs Without Multi-Factor Authentication, April 19, 2024
• Center for Internet Security, CIS Control 8: Audit Log Management
• NIST, SP 800-61 Rev. 3, Incident Response Recommendations and Considerations, April 2025
• IBM, Cost of a data breach: Cost savings with law enforcement involvement
• U.S. Treasury OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, September 21, 2021
• The Register, Ransomware payments cratered in 2025, but attacks surged to record highs (Chainalysis 2026 data), February 27, 2026

Sources checked November 2026. Each figure comes from the publisher's own survey, case data or guidance named above.