Colonial Pipeline paid $4.4 million in ransom. They got a decryption tool so slow they ended up restoring from backups anyway. The ransom bought them nothing.
That's the reality of ransomware defense in 2026. Paying doesn't guarantee recovery. Preparation does.
How Ransomware Gets In
It's rarely sophisticated. The top three entry points haven't changed in years:
- Phishing emails - A malicious attachment or link. Still the #1 vector.
- Exposed RDP - Brute-forced credentials on internet-facing Remote Desktop. Easy money for attackers.
- Unpatched vulnerabilities - Known CVEs that nobody bothered to fix. WannaCry spread through a vulnerability Microsoft had patched two months earlier.
The pattern is clear: attackers take the easiest path in. Your job is to close those paths.
The Defenses That Actually Work
The 3-2-1 Backup Rule
Three copies of your data. Two different storage types. One copy offsite and offline. If ransomware can reach your backups, they're not backups - they're another target.
Test your restores monthly. A backup you've never tested is a backup that might not work.
Network Segmentation
Ransomware spreads laterally. If your accounting department and production servers share a flat network, one infected laptop takes down everything.
Segment your network. Limit what each segment can access. The blast radius of an infection should be one department, not the entire company.
Patch Management
WannaCry hit 200,000 systems across 150 countries. The patch had been available for 59 days. Critical vulnerabilities need patching within 72 hours, not "next quarter."
EDR on Every Endpoint
Modern Endpoint Detection and Response tools catch ransomware behavior - mass file encryption, shadow copy deletion, privilege escalation. Traditional antivirus won't cut it anymore.
Email Filtering and MFA
Block malicious attachments before they reach inboxes. Require multi-factor authentication everywhere, especially on VPN and RDP. MFA alone stops most credential-based attacks.
When You Get Hit
- Isolate immediately - Disconnect infected systems from the network. Every second of delay means more encrypted files.
- Don't pay - FBI, CISA, and every major security agency says the same thing. Payment funds more attacks and doesn't guarantee recovery.
- Activate your incident response plan - You have one, right?
- Report it - Law enforcement agencies sometimes have decryption keys from previous operations.
- Restore from backups - This is why you tested them.
The Bottom Line
Ransomware isn't going away. But most attacks succeed because of basic hygiene failures: weak passwords, missing patches, no network segmentation, untested backups.
Start here:
- Verify your backups are offline and tested
- Enable MFA on all remote access
- Segment your network
- Patch critical vulnerabilities within 72 hours
- Deploy EDR on every endpoint
- Create and drill an incident response plan
The companies that survive ransomware aren't the ones with the biggest security budgets. They're the ones that did the basics right before the attack happened.
