If it feels like ransomware should be on the decline by now, you’re not alone. We all see the headlines: law enforcement takedowns of major operations, new regulations, advanced security tools. However, what we actually see is ransomware incidents continuing to rise.

If you think about it, all those new advances must mean that ransomware is not just a technical problem. Therefore, as a business risk problem, the system has to be weaker in other places.  After some investigation, it appears that attackers have become very good at exploiting the gaps between “having security” and actually being resilient.  Let me explain.

Why Ransomware Keeps Growing

Ransomware didn’t disappear; it evolved.  Today’s ransomware groups operate like businesses. They use Ransomware-as-a-Service (RaaS), where developers build the tools and their clients run the attacks from it. This lowers the skill barrier, which increases the number of attackers, and just like a business, it accelerates innovation on the criminal side.

At the same time, attackers have shifted tactics:

• Stolen credentials over malware: It’s often easier to log in than break in.
• Double and triple extortion: Encrypting systems is only part of the pressure; stolen data and public exposure increase leverage.
• Speed: Many attacks move from initial access to ransom in days, sometimes hours.
• Targeting operations: Attackers can focus on systems that disrupt the business fastest, not just IT.

In short, ransomware succeeds because it aligns perfectly with business impact.

The False Sense of Security That Makes Things Worse

Most organizations don’t ignore security.  However, they do tend to fall short in understanding how to best integrate it within their systems and processes.  For example, we often hear:

• “We have backups, so we’re covered.”
• “We passed our compliance assessment.”
• “Our IT provider handles that.”
• “We’re too small to be interesting.”

Unfortunately, the attackers are also very aware of these assumptions.

Backups may exist but haven’t been tested. Compliance controls may be documented but not effective in practice. Managed services often focus on uptime, not adversarial behavior. And small and mid-sized organizations are attractive precisely because they tend to have fewer layers of defense.

Ransomware thrives in environments where security looks good on paper but hasn’t been validated against real-world attacks.

What Actually Reduces Ransomware Impact

There is no magic shield or security tool that “stops ransomware” without stopping all traffic. A more realistic and effective defense will focus on limiting the blast radius and recovery time.  For example, consider best practices with these common controls:

• Strong identity protection: Multi-factor authentication (MFA) everywhere, with least-privilege access, and monitoring abnormal login behavior.
• Network segmentation: To prevent attackers from moving laterally and taking everything at once.
• Resilient backups: Offline or immutable backups that are regularly tested for restoration.
• Early detection: Monitoring for visibility into suspicious behavior, not just known malware signatures.
• Incident readiness: Clearly defined roles, communication paths, and decision authority before an incident occurs.

Taking this approach assumes something will eventually go wrong; so, let’s plan for it.

Compliance Helps, But It’s Not the Finish Line

I have said this many times before… compliance plays an important role, but it is not a guarantee of a secure system.

Most compliance frameworks measure control presence, not effectiveness.  They also don’t account for how attackers chain weaknesses together.  Plus, compliance checks are assessed infrequently and at a single point in time.  They are similar to an annual vulnerability assessment; it’s only good so long as nothing changes.

You have probably heard me say this before as well: a risk-based security program fills this compliance-only security gap.

Instead of asking, “Do we have the control in place?” it suggests we ask:

• How would an attacker actually get in?
• What would they target first?
• How quickly would we detect it?
• How bad would the business impact be?

Organizations that take this approach are far better positioned to withstand ransomware events.

Practical Steps to Take This Quarter

If ransomware feels like a growing concern, focus on actions that produce clarity quickly and reduce uncertainty:

1. Test backup restoration procedures, not just if the backup itself was a success.
2. Review privileged accounts and service access.
3. Validate detection and response with a penetration test or tabletop exercise.
4. Map ransomware scenarios to business impact, not just systems.
5. Ensure executives and technical teams understand their roles during an incident.

Turning Fear Into Control

Just because we continue to see ransomware grow, it doesn’t mean businesses should be helpless.

Organizations that focus on risk visibility, validation, and response readiness recover faster, lose less data, and experience far less disruption when incidents occur.

Cybersecurity isn’t just about limiting threats.  It’s also about staying in control when those threats turn into incidents.

If you’re not sure how ransomware would impact your organization or whether your current controls would hold up in a real attack, let’s have a conversation to help provide clarity.

We are always happy to discuss what ransomware resilience looks like in your environment and help identify practical next steps.