Ransomware is rarely a single event. It is a chain of steps over days or weeks, and each step is a chance to stop it.
Attackers gain access, raise their privileges, move through the network, steal data and only then encrypt. Most of that time is spent quietly.
Key points
- Access often comes through phishing or an exposed service
- Attackers usually spend days inside before encrypting
- Data theft now comes before encryption in most cases
How this guide is organised
The guide has 11 chapters. Each one stands on its own, so you can read them in order or go straight to the topic you need.
- Initial access: phishing, exposed services and stolen credentials
- Privilege escalation and lateral movement
- Data theft before encryption: double extortion
- Hardening identity: MFA, privileged access and service accounts
- Patching and exposure management that keeps pace
- Endpoint detection and 24/7 monitoring
- Backups that survive an attack
- Network segmentation that limits the blast radius
- Testing your defences with simulated attacks
- A ransomware readiness checklist for the next quarter
Who this guide is for
It is written for IT and security leads, risk and compliance owners and the managers who sign off on the work. The chapters follow the chain in order, then cover the controls that break it.