Insights · Field note · Security assurance and compliance
Ransomware readiness: the five controls that decide the outcome
Whether a ransomware event is a bad week or the end of the business is decided before it happens, by five controls.
In our readiness reviews (first-hand) the outcome of a ransomware event is decided by five controls: phishing-resistant multi-factor authentication on administrative, remote and email access, which removes the most common entry; endpoint detection and response on every device with someone acting on it, which catches the intrusion before encryption; removal of standing administrative privilege, which stops one machine becoming the whole environment; segmentation of backups and servers from workstations, which limits the blast; and isolated, immutable backups with a tested restore, which make recovery possible without paying. CISA’s StopRansomware guidance covers the same ground in more detail. Organizations with all five recover; organizations missing two or more usually do not.
In detail
What the evidence shows.
Entry: phishing-resistant MFA
Most ransomware begins with a credential. Codes and push notifications are defeated by proxy phishing and fatigue; security keys and passkeys are not. The control applies first to administrators, remote access and email, where entry is most consequential.
Detection and containment: endpoint protection and privilege
Endpoint detection and response sees the intrusion in the hours or days before encryption, if it is deployed everywhere and if someone responds. Standing administrative privilege is what turns a single compromised machine into domain-wide encryption; removing it buys the time detection needs.
Blast radius: segmentation
Workstations that cannot reach servers and backups freely cannot encrypt them. Operational technology and legacy systems that are segmented keep running while the office recovers. Segmentation is the control that converts a catastrophe into an incident.
Recovery: isolated backups, tested
Attackers look for backups first and delete or encrypt what they can reach. Copies that are immutable or offline, held under separate credentials, survive. A restore of a critical service, timed and recorded, is the only proof that recovery is possible. The ransomware readiness checklist covers all five and the response around them; see ransomware readiness review.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days