Understanding how ransomware works
Ransomware is malicious software that encrypts an organization's files, or blocks access to them, then demands payment of a ransom in exchange for a decryption key. Initial access most often happens through a phishing email, an unpatched vulnerability on an exposed system, or poorly secured remote access (RDP exposed to the internet, weak or reused passwords). Once inside, the attacker generally seeks to move laterally through the network, identify the most critical systems, and disable or delete accessible backups, before triggering large-scale encryption. This lateral movement phase, which can last from a few hours to several days, sometimes leaves a detection window if monitoring is in place — it is precisely during this window that a fast response can prevent the worst outcome. The final encryption step is often triggered outside business hours (at night, on weekends) to delay discovery of the attack and maximize the time available to the attacker before a team can respond.
Backups: the single most decisive protection
The most effective measure against the impact of ransomware remains a robust backup policy: regular, tested backups, and above all backups isolated from the main network (offline or immutable), so they cannot be encrypted along with production systems. A widely recognized industry rule is the "3-2-1" rule: three copies of the data, on two different media, with one copy off-site. Actually testing the restoration of these backups matters just as much as creating them: a backup that has never been restored as a test can turn out to be corrupted or incomplete on the day it is actually needed. Without reliable, tested and isolated backups, an affected business often has no choice but to negotiate with the attacker or rebuild its systems from scratch, with all the data and time losses that implies. The choice of backup frequency should also reflect the business's real tolerance for data loss: a daily backup means accepting, in the worst case, the loss of up to a full day of activity, which is not acceptable for every type of business.
Patch management and basic IT hygiene
A large share of ransomware compromises exploit known vulnerabilities that were already fixed by a patch available for months, on systems that simply were not updated in time. Maintaining a regular process for updating operating systems, applications and network equipment considerably reduces the attack surface available to an opportunistic attacker. This also includes basic hygiene, often neglected due to lack of time rather than lack of awareness: disabling unnecessary access left over from old projects, strong passwords and multi-factor authentication on sensitive access and remote access in particular, and removing accounts and services that are no longer used but remain active by oversight.
Staff awareness: the human factor
Phishing remains one of the most common entry vectors for ransomware, precisely because it targets people rather than a technical flaw. Regularly training staff to recognize suspicious emails, unusual attachments, links redirecting to fake login pages, and unverified urgent requests (such as an urgent wire transfer requested by a "executive") reduces the risk that a single click compromises the entire organization. Phishing simulations, conducted regularly rather than once, allow concrete measurement of how this vigilance improves over time and help identify teams or profiles that need extra support, rather than relying on a one-off training session with no follow-up or measurement of results.
Having an incident response plan before you need it
Many companies discover their incident response plan at the moment of the incident itself, which costs precious time — precisely the time that is unavailable when facing an actively spreading ransomware. A structured plan defines in advance who does what (IT, leadership, communications, legal), in what order, how to quickly isolate affected systems to limit propagation, who to contact externally (security provider, insurer where applicable, relevant authorities), and how to communicate internally and externally during crisis management. This plan must be tested through simulation exercises, not just written and filed away, to verify it actually works under stress and that everyone knows their role without needing to re-read the document in the middle of a crisis.
Network segmentation, to limit propagation
A flat network, where all systems can communicate freely with each other with no restriction, allows ransomware to spread very quickly once a first machine is compromised, sometimes reaching an entire IT fleet within hours. Segmenting the network — separating critical environments from regular user workstations, limiting access rights between systems based on the principle of least privilege — does not prevent an initial intrusion, but strongly reduces the scale of propagation and gives more time to detect and react before the entire information system is affected. This measure, often perceived as complex to implement, can be introduced progressively by starting with isolating the most sensitive systems rather than trying to segment the entire network at once.