Editorial illustration.
Originally published 16 June 2023; rewritten and reviewed on 15 October 2026.
The first visible sign of ransomware may be an unreadable file or an unavailable system. By then, the organisation needs more than an explanation of encryption. It needs to know what was affected, whether information was taken and how a trustworthy service can be restored.
Look beyond the final encrypted file
An incident may involve compromised credentials, a vulnerable exposed service or a malicious attachment. The path varies. Once an attacker has access, additional permissions and reachable backups can determine how far the disruption spreads.
That is why prevention includes maintained software, protected identities and restricted access between systems. No single control establishes that the organisation cannot be affected.
Make detection actionable
Monitor the events that matter for the environment: unusual access, unexpected administrative changes and signs of tampering with recovery resources. Assign an owner who can investigate and escalate. Collect logs somewhere appropriate so evidence does not disappear with the affected host.
Users also need a clear way to report suspicious activity quickly. A reporting process works better when people can use it without first proving that they have found an attack.
Practise restoration before an incident
Keep protected backups and verify that a representative service can be restored with its configuration, keys and dependencies. A backup job’s success message does not demonstrate recovery. Consider what happens if the ordinary administrator account or backup console is unavailable.
During a suspected incident, follow the response plan, preserve evidence and involve the appropriate technical and organisational owners. Do not treat paying an extortion demand as a guaranteed recovery method.
The practical lesson is about preparedness. Reducing access and practising restoration can limit the organisation’s dependence on improvisation when its normal tools are no longer trustworthy.