Consider an illustrative scenario: a healthcare organization is hit with ransomware. The attackers encrypt its patient records, its backup server, and its disaster recovery environment, using backup credentials they compromised months earlier during an initial access phase that nobody noticed. The organization pays a multimillion-dollar ransom. The decryptor recovers only part of the files. The rest are gone.
Key Takeaway
A backup that an attacker can reach, or that you've never restored from, isn't a recovery plan.
I've responded to ransomware incidents where immutable backups were the only thing that stood between a 3-week outage and a 3-day recovery. The difference is planning.
KELA's report on escalating ransomware threats to national security documents a 34% year-on-year increase in attacks on critical industries in the first nine months of 2025. Manufacturing, healthcare, energy, transportation, and finance are the primary targets. The attack pattern has evolved from simple encryption to double extortion — encrypt data and threaten to leak it — and now to triple extortion: encrypt, leak, and attack the organization's supply chain partners and customers.
Why is ransomware getting worse?
Because ransomware-as-a-service has industrialized the attack. Groups like LockBit popularized affiliate programs where developers build the malware, affiliates handle distribution, and the developers take a cut of every ransom. This separation of concerns means more actors, more attacks, and faster iteration on tactics: KELA tracked 103 active groups over the same period, with Qilin, Clop, Akira, Play, and SafePay behind nearly a quarter of incidents. Verizon's 2026 DBIR found ransomware in 48% of breaches, up from 44% the year before.
The supply chain dimension multiplies the damage. The 2021 Kaseya VSA attack showed the playbook: compromise software that managed service providers use, and reach their customers downstream. Compromise one MSP, reach every customer it manages. The economics are irresistible, and Verizon's 2026 DBIR found third-party involvement in 48% of breaches, up 60% year on year. That's why software supply chain security is part of ransomware defense.
What is ransomware resilience?
Ransomware resilience is the combination of preventive controls, detection capabilities, and recovery infrastructure that allows an organization to survive a ransomware attack without paying the ransom. It has three pillars:
Prevent. Reduce the attack surface that ransomware needs: endpoint protection, email filtering, network segmentation, patch management, and MFA. The goal is to make initial access harder than the attacker's expected ROI.
Detect. Identify the early stages of a ransomware campaign: initial access, credential dumping, lateral movement, and data staging. Ransomware doesn't encrypt everything instantly. There's a window — sometimes hours, sometimes days — between initial access and encryption, and that window is what AI-assisted SOC tooling is meant to exploit.
Recover. Ensure that backups exist, are isolated from the production environment, and can be restored quickly. If backups are compromised, recovery is impossible.
Immutable backups: the foundation
An immutable backup is one that cannot be modified, deleted, or overwritten for a defined retention period. Object storage with object lock, air-gapped tape, and write-once cloud storage all provide immutability.
The critical rule: backups must be isolated from the same network that ransomware uses to propagate. If your backup server is on the same Active Directory domain as your production servers, a compromised domain admin can delete your backups. Put backups on a separate network with separate credentials. CISA's #StopRansomware Guide makes the same point: keep offline, encrypted backups of critical data and test them regularly, because many ransomware variants try to find and delete or encrypt accessible backups.
| Backup Type | Immutability | Isolation | Restoration Speed | Cost |
|---|---|---|---|---|
| Local disk | None | None | Fast | Low |
| Network-attached storage | Low | Low | Medium | Medium |
| Cloud object storage (immutable) | High | Medium | Medium | Medium |
| Air-gapped tape | Complete | Complete | Slow | Medium |
| Immutable cloud + air gap | Complete | Complete | Fast | High |
The table shows why most organizations fail: they rely on backups that are accessible from the same network the attacker controls. Immutability without isolation is theater.
Incident response orchestration
When ransomware hits, speed matters. Every hour of downtime costs money and erodes customer trust. Incident response orchestration automates the response playbook: isolate infected systems, preserve forensic evidence, notify stakeholders, and initiate recovery.
The key is having the playbook ready before the incident. Run tabletop exercises quarterly. Test your backup restoration process. Know who makes the "pay or don't pay" decision and what criteria they'll use. Waiting until the encryption is complete to decide is too late.
FAQ
Should I pay the ransom?
The FBI does not support paying a ransom. Paying funds criminal operations and doesn't guarantee decryption. But every situation is different, and some organizations have no viable alternative.
How do I test my ransomware resilience?
Run purple team exercises: have your red team simulate a ransomware campaign and see if your blue team detects it. Test backup restoration quarterly. Measure recovery time objective against your business requirements.
How much does a ransomware attack cost?
IBM's Cost of a Data Breach Report 2026 puts the global average cost of a data breach at $4.99 million. Ransom payments vary widely depending on the target and the data at stake; Verizon's 2026 DBIR puts the median ransom paid at $139,875, and 69% of ransomware victims in its dataset didn't pay.
How do I prevent ransomware from reaching my backups?
Isolate backups on a separate network with separate credentials. Use immutable storage with object lock or write-once semantics. Require MFA for backup system access. Monitor backup systems for unusual access patterns.
What insurance covers ransomware?
Cyber insurance increasingly covers ransom payments, recovery costs, and business interruption. Read the policy carefully: many insurers now require evidence of preventive controls before they'll pay out.
Sources
- KELA: Global Ransomware Attacks Against Critical Industries Surge 34% in 2025
- Verizon: 2026 Data Breach Investigations Report, Executive Summary
- CISA: #StopRansomware Guide
- CISA: Kaseya VSA Supply-Chain Ransomware Attack
- FBI Internet Crime Complaint Center: Ransomware
- IBM: Cost of a Data Breach Report 2026