Ransomware in 2026: Stopping the Attack Before It Starts

Modern ransomware doesn't kick the door in — it walks through your inbox. Here's how to defend properly.

The threat has changed. Has your defence?

Ransomware in 2026 looks nothing like 2018. Attackers don't deploy noisy crypto-locker payloads on day one. They infiltrate, escalate privileges, exfiltrate data, disable backups, and *then* trigger encryption — often weeks after the initial compromise.

That changes everything about how you defend.

How attacks actually start

  • Phishing with AI-written lures that pass the smell test
  • Credential stuffing against accounts without MFA
  • Compromised third-party SaaS with over-permissioned OAuth tokens
  • Unpatched edge devices — VPN appliances, firewalls, network printers

The "kick the door in" days are largely over. Modern attackers walk in with valid credentials.

The five controls that stop most ransomware

  • Phishing-resistant MFA on every account. Including service accounts. Including the admin who hates it.
  • Modern EDR with 24/7 monitoring. Not legacy AV. Not "we get an email if something happens".
  • Immutable, off-site backups with documented restore tests. If you can't restore in an exercise, you can't restore in a crisis.
  • Privileged access management. Local admin should be temporary, logged, and rare.
  • Email filtering with attachment sandboxing and link rewriting.

The bit nobody likes talking about

Ransomware events are not just IT events. They're legal, PR, HR, and insurance events. Your incident response plan needs:

  • Pre-agreed forensic and legal contacts
  • Comms templates for staff, clients, and the ICO
  • Cyber insurance details and notification thresholds
  • Decision authority for ransom discussions (don't pay — but know who decides)

What to do this week

  • Confirm MFA coverage across every account, including admin
  • Check the date of your last successful restore test
  • Patch every internet-facing device this week
  • Review OAuth-connected apps in your M365 or Google tenant

Need a second opinion?

We run free 30-minute cyber posture reviews for London SMEs — no scare tactics, just a clear-eyed view of where you stand. Book on Calendly or message us on WhatsApp.