Ransomware Defense in 2026
Ransomware stopped being a malware problem and became a business model years ago. Today's operators run affiliate programs, help desks, and leak sites; they buy access from initial-access brokers rather than writing droppers; and they steal your data before they encrypt it, so that clean backups — still essential — no longer end the negotiation. Defending against it means thinking about the whole intrusion lifecycle, not just the moment files start turning into gibberish.
How organizations actually get hit
The forensic reports are monotonous, which is good news — monotony is defensible:
- Valid credentials. Phished, purchased, or sprayed against an exposed VPN or RDP portal without MFA. This is the leading initial vector, and it's a login, not an exploit.
- Unpatched external services. Edge devices — VPN concentrators, firewalls, file-transfer appliances — with an n-day vulnerability, exploited within hours of disclosure.
- Phishing to execution. A user runs an attachment or a malicious installer delivered by search-ad malvertising.
After entry, the pattern is consistent: establish persistence, dump credentials, move laterally, find and exfiltrate the crown-jewel data, delete backups, then detonate encryption — often on a weekend. The dwell time between entry and encryption is where defense lives.
The controls that break the chain
Identity first
Phishing-resistant MFA (passkeys or FIDO2 hardware keys) on every external entry point and every privileged account is the single highest-value control, because it defeats the leading initial vector outright. Pair it with least privilege — no daily-driver domain admins — so one stolen credential doesn't unlock the estate.
Backups that survive the attacker
The 3-2-1-1-0 rule is the modern standard: three copies, two media, one offsite, one immutable or offline, and zero errors on a tested restore. Immutability is the point — object-lock or air-gapped backups that the ransomware operator cannot delete even with domain admin. A backup you have never restored is a hypothesis, not a plan.
Detection at the endpoint and in identity
EDR/XDR watches for the behavior of an intrusion — credential dumping, suspicious lateral movement, shadow-copy deletion — rather than known file signatures. Just as important in 2026: identity-threat detection, because the attacker who logged in with valid credentials leaves no malware to find, only anomalous authentication.
Catch the tell: shadow-copy deletion
A near-universal precursor to encryption on Windows is the destruction of volume shadow copies and backup catalogs. Alerting on it buys precious minutes. A minimal Sysmon-plus-PowerShell watch:
# Alert on the classic "destroy the safety net" commands.
# Wire this to your SIEM via Sysmon Event ID 1 (process creation).
$suspicious = @(
'vssadmin(\.exe)?\s+delete\s+shadows',
'wmic\s+shadowcopy\s+delete',
'wbadmin\s+delete\s+catalog',
'bcdedit.*recoveryenabled\s+no',
'Set-MpPreference\s+-Disable' # tampering with Defender
) -join '|'
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Sysmon/Operational'; Id=1 } |
Where-Object { $_.Message -match $suspicious } |
ForEach-Object {
# Ship a high-severity alert; every second counts here.
Send-SecurityAlert -Severity Critical -Source $env:COMPUTERNAME -Detail $_.Message
}Better still, block it: modern EDR and Windows' own controlled-folder-access and tamper-protection features can deny these operations rather than merely log them.
Assume-breach detection with canaries
Encryption is loud once it starts. Canary files — decoy documents seeded across shares — turn "loud" into "instant": a process touching them is almost certainly ransomware sweeping the filesystem. A lightweight watcher:
import time
from pathlib import Path
from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler
CANARIES = {p.resolve() for p in Path("/srv/share").rglob(".~canary_*.docx")}
class Tripwire(FileSystemEventHandler):
def on_any_event(self, event):
if Path(event.src_path).resolve() in CANARIES:
# A legitimate user never opens these. Isolate the host now.
isolate_host(reason=f"canary tripped: {event.src_path}")
obs = Observer()
obs.schedule(Tripwire(), "/srv/share", recursive=True)
obs.start()
while True:
time.sleep(1)Hook isolate_host() into your EDR's network-quarantine API so a trip pulls the machine off the network in seconds — faster than a human can read the alert.
The response plan you write before you need it
- Isolate, don't power off — pulling the network stops spread and exfiltration while preserving memory forensics.
- Know who decides. Paying is a business, legal, and possibly sanctions decision (paying certain sanctioned groups is itself unlawful). That conversation cannot start at 3 a.m.
- Assume data was stolen. Plan breach notification in parallel with recovery; disclosure clocks start regardless of your readiness.
- Restore from immutable backups to clean, rebuilt hosts — never onto the compromised estate.
- Run a tabletop twice a year. The cheapest control in this article.
Ransomware is extortion with good UX. Beat it with identity you can't phish, backups it can't reach, and detection that fires on behavior — then rehearse the bad day before it arrives.