How to Protect Against Ransomware: 13 Steps [2026] | #ransomware | #cybercrime

Global ransomware attacks rose 0.8% quarter-over-quarter in Q2 2026, according to Checkpoint Research’s threat intelligence report, and the group behind the current wave of attacks, Qilin, has now held the top spot for four consecutive quarters with 279 confirmed victims. A rival crew called The Gentlemen actually outpaced Qilin in June 2026, surging 62% to 269 victims. The narrative that ransomware “declined” this year doesn’t hold up once you look at the raw numbers. It just moved, and it moved fast.

This tutorial walks through the exact controls security teams are deploying right now, in August 2026, to stop ransomware before it reaches the encryption stage. You’ll configure identity hardening, patch prioritization tied to CISA’s Known Exploited Vulnerabilities catalog, immutable backups, network segmentation, canary-file detection, and an incident response runbook you can actually test. Every step includes the commands and config you need, not just the theory.

Why Ransomware Protection Can’t Wait Until Next Quarter

Ransomware protection used to mean “install antivirus and hope.” That approach stopped working years ago, and 2026’s threat data makes the gap obvious. Checkpoint Research’s State of Ransomware Q2 2026 report shows attackers are no longer relying on a single dominant strain. Multiple groups are competing for the same targets, which means the tooling, entry points, and extortion tactics are diversifying faster than most defense playbooks can keep up.

The World Economic Forum’s Global Cybersecurity Outlook 2026 names accelerating AI adoption and geopolitical fragmentation as the two forces reshaping the risk landscape this year, and ransomware extortion sits at the center of both. Attackers are using AI to write more convincing phishing lures and to automate reconnaissance against exposed infrastructure, while defenders are still catching up on basic hygiene like MFA coverage and backup testing.

IBM’s 2026 cyberthreat trends analysis found that supply chain and third-party breaches have quadrupled over the past five years, which matters here because a growing share of 2026 ransomware incidents start with a compromised vendor, not a direct hit on the target. If you’re only hardening your own perimeter and ignoring what your suppliers can touch, you’re defending half the attack surface. This guide covers both halves.

Prerequisites and Tools for This Ransomware Protection Tutorial

You don’t need an enterprise security budget to follow this tutorial, but you do need admin access to your endpoints, firewall, and backup system. Here’s what to have ready before you start:

Budget roughly 100 minutes to work through every step at a basic level for a small environment (under 50 endpoints). Larger environments will need to repeat the network and identity steps per segment, which extends the timeline but doesn’t change the process.

Step 1: Map Your Crown Jewels and Identities

Every effective ransomware protection plan starts with an inventory, not a tool purchase. You can’t protect what you haven’t mapped. List the systems that would hurt most if encrypted or leaked: customer databases, financial records, source code repositories, and any system that would stop revenue if it went down for 48 hours.

Pair that with an identity map. Write down every human account, service account, contractor login, and API key that has write access to those crown-jewel systems. This is tedious, but it’s also where most ransomware incident response plans fall apart in year one — teams discover mid-incident that a forgotten service account had domain admin rights nobody remembered granting.

• Spreadsheet or CMDB entry for every system with a business-impact rating (critical, high, medium, low)
• Owner name and backup owner for each system
• List of accounts (human and service) with write or admin access
• Last-tested-backup date for each critical system

Step 2: Lock Down Remote Access With Zero Trust

Kaspersky’s Securelist ransomware trends report for 2026 is blunt about this: RDP and RDWeb connections should never be directly exposed to the internet. They should only be reachable through a VPN or Zero Trust Network Access (ZTNA) gateway. Exposed RDP remains one of the most common initial access points ransomware operators use, because it’s easy to brute-force or buy credentials for on criminal marketplaces.

Start by scanning your own external IP ranges for exposed remote-access ports. This is the same reconnaissance attackers run against you, so run it first.

# Scan your public IP range for exposed RDP, SMB, and VNC ports
nmap -Pn -p 3389,445,5900,22,23 --open -oG - 203.0.113.0/24

# Example output flagging a problem:
# Host: 203.0.113.44 ()  Status: Up
# Host: 203.0.113.44 ()  Ports: 3389/open/tcp//ms-wbt-server///
#
# Any 3389/open result on a public IP is an immediate finding.
# Route it behind your VPN or ZTNA gateway before doing anything else.

If you find open RDP, don’t just close the port and move on. Rotate every credential that could have touched that host, and check your logs for brute-force patterns going back at least 90 days. If you’re running a dedicated firewall for this, our pfSense firewall setup guide covers building the VPN-only access rule from scratch.

Step 3: Enforce MFA Everywhere in Under an Hour

NIST’s ransomware preparation guidance is direct on this point.

“Use antivirus software at all times—and make sure it’s set up to automatically scan your emails and removable media for ransomware and other malware.”

NIST, National Institute of Standards and Technology — Tips for Preparing for Ransomware Attacks

Antivirus is table stakes, but the May 2026 ransomware protection guidelines circulating among incident responders put MFA at the top of the priority list: enable multi-factor authentication on every remote access point, not just email. That includes VPN concentrators, admin portals for your firewall and backup software, and any SaaS tool with financial or HR data. A federal guidance document compiled by the U.S. Department of Justice reinforces the identity side of this with a specific recommendation: implement access controls, including file, directory, and network share permissions, with least privilege in mind.

If you haven’t rolled out phishing-resistant MFA yet, FIDO2 passkeys are the strongest option available in 2026 because they can’t be phished the way a one-time code can. Our passkey (FIDO2) setup guide walks through the enrollment process for a mixed Windows and cloud identity environment.

Step 4: Patch Actively Exploited Vulnerabilities First

You will never patch everything, and trying to is how patch programs collapse under their own backlog. The August 2026 cyber threat update from Micro Advantage is specific about the fix: prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog first, especially on internet-facing systems and anything with admin-level exposure. Those are the CVEs attackers are using right now, not theoretical risks.

# Pull the current CISA KEV catalog and cross-reference against your asset list
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" \
  -o kev_catalog.json

python3 - <<'EOF'
import json

with open("kev_catalog.json") as f:
    kev = json.load(f)["vulnerabilities"]

with open("my_installed_cves.txt") as f:
    my_cves = {line.strip() for line in f if line.strip()}

matches = [v for v in kev if v["cveID"] in my_cves]

for v in sorted(matches, key=lambda x: x["dateAdded"], reverse=True):
    print(f"{v['cveID']} | added {v['dateAdded']} | due {v['dueDate']} | {v['vulnerabilityName']}")
EOF

# Example output:
# CVE-2026-20349 | added 2026-06-02 | due 2026-06-23 | Cisco ASA/FTD Remote Code Execution
# CVE-2026-59310 | added 2026-05-14 | due 2026-06-04 | VMware vCenter Deserialization Flaw

NIST’s guidance keeps this simple: “Keep all computers fully patched.” The federal guidance from the DOJ echoes the same point almost word for word — patch operating systems, software, and firmware on devices. Recent guidance circulating in May 2026 pushes this further, recommending patches go out within 48 hours of disclosure for anything on the KEV list. That’s an aggressive window, but it matches how fast ransomware crews weaponize new CVEs once they’re public. If you haven’t formalized a patch cadence yet, our vulnerability management program guide covers building the full triage workflow.

Step 5: Deploy EDR/XDR and Eliminate Coverage Gaps

The SANS Institute’s mid-2026 ransomware analysis is one of the more actionable pieces of guidance published this year, and its top recommendation is coverage, not capability: close your EDR/XDR coverage gaps, know your full asset inventory, and actively hunt for unmanaged hosts. A next-generation EDR agent does nothing for a laptop it was never installed on, and ransomware operators specifically probe for those blind spots during reconnaissance.

Run this comparison monthly: your asset inventory against your EDR console’s list of reporting agents. Anything in the first list but not the second is a gap.

# Compare full asset inventory against active EDR agents (example using CSV exports)
python3 - <<'EOF'
import csv

with open("asset_inventory.csv") as f:
    assets = {row["hostname"] for row in csv.DictReader(f)}

with open("edr_active_agents.csv") as f:
    covered = {row["hostname"] for row in csv.DictReader(f)}

gaps = assets - covered
print(f"Total assets: {len(assets)}")
print(f"EDR coverage: {len(covered)}")
print(f"Uncovered hosts ({len(gaps)}):")
for host in sorted(gaps):
    print(f"  - {host}")
EOF

# Example output:
# Total assets: 214
# EDR coverage: 198
# Uncovered hosts (16):
#   - print-server-03
#   - legacy-erp-vm
#   - contractor-laptop-07

SANS also flags something worth building into your alerting: treat infostealer detections seriously, both on corporate devices and on personal devices that touch company credentials, because credential theft from a personal machine is a common ransomware precursor. Block and alert on dual-use tools too — remote management utilities and penetration-testing frameworks that are legitimate in the hands of your IT team and dangerous in the hands of an attacker who just gained a foothold. If you want a SIEM layer to catch this kind of behavior, our Security Onion 3 setup guide is a solid free starting point, and our CrowdStrike Falcon vs. Microsoft Defender XDR comparison breaks down the paid EDR/XDR options by cost and detection coverage.

Step 6: Turn On OS-Native Ransomware Protection

Before you spend money on a third-party anti-ransomware product, turn on the free controls already built into Windows. Controlled Folder Access blocks unauthorized applications from modifying files in protected directories, which stops most commodity ransomware encryptors cold because they aren’t on the allow-list.

1. Open Settings, then go to Privacy & Security
2. Choose Windows Security, then Virus & Threat Protection
3. Under Ransomware Protection, select Manage Ransomware Protection
4. Toggle Controlled Folder Access on
5. Select Protected Folders to review the default list and add any project or data folders that need coverage
6. Add trusted line-of-business applications to the allowed-apps list so they aren’t blocked from writing to protected folders

For fleet-wide deployment instead of clicking through each machine, push the setting via PowerShell and Group Policy or Intune:

# Enable Controlled Folder Access via PowerShell (run as Administrator)
Set-MpPreference -EnableControlledFolderAccess Enabled

# Add a custom protected folder
Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\ProjectData"

# Allow a trusted line-of-business app to write to protected folders
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\ERP\erp-sync.exe"

# Verify current status
Get-MpPreference | Select-Object EnableControlledFolderAccess, ControlledFolderAccessProtectedFolders

Gizmodo’s 2026 ransomware protection testing confirmed this control still catches a meaningful share of commodity ransomware samples in isolation, though it’s not a substitute for EDR on business networks — treat it as one layer, not the whole strategy.

Step 7: Build a 3-2-1-1-0 Immutable Backup Strategy

CISA’s ransomware guidance is unambiguous on backups.

“Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.”

CISA, U.S. Cybersecurity and Infrastructure Security Agency

The classic 3-2-1 rule (three copies, two media types, one offsite) has evolved into 3-2-1-1-0 for 2026: three copies, two media types, one offsite, one immutable or offline, and zero errors after a test restore. That last number is the one most teams skip, and it’s exactly the gap ransomware operators exploit — they know most “backups” have never actually been restored under pressure.

# Initialize an immutable, encrypted backup repository with restic
export RESTIC_REPOSITORY="s3:https://s3.example-region.amazonaws.com/company-backups"
export RESTIC_PASSWORD_FILE="/etc/restic/password"

restic init

# Run a backup with object-lock immutability enforced at the bucket level
restic backup /data/critical --tag "critical-nightly"

# Automate a monthly integrity check — this is the "0 errors" step teams skip
restic check --read-data-subset=10%

# Test a full restore into an isolated sandbox, not production
restic restore latest --target /restore-test --tag "critical-nightly"

# Example output on a healthy backup:
# repository abc123de opened successfully, password is correct
# no errors were found for repository: abc123de
# restoring  to /restore-test

The object-lock configuration on your cloud storage bucket (S3 Object Lock, Azure immutable blob storage, or equivalent) is what actually stops ransomware from encrypting or deleting your backups even with stolen admin credentials — set the retention mode to compliance, not governance, so it can’t be overridden by anyone, including an attacker with domain admin.

Step 8: Segment Your Network to Contain the Blast Radius

Network segmentation doesn’t stop the initial compromise, but it stops one infected laptop from becoming a company-wide encryption event. If your file servers, backup infrastructure, and workstation network all sit on the same flat VLAN, ransomware that lands anywhere can reach everywhere.

# pfSense-style firewall rule blocking workstation VLAN from reaching backup VLAN
# except through the designated backup server on its required port

# VLAN 10 = Workstations (192.168.10.0/24)
# VLAN 40 = Backup Infrastructure (192.168.40.0/24)

Rule: Block
  Interface: VLAN10
  Source: 192.168.10.0/24
  Destination: 192.168.40.0/24
  Protocol: any
  Description: Deny workstation VLAN direct access to backup VLAN

Rule: Allow
  Interface: VLAN10
  Source: 192.168.10.0/24
  Destination: 192.168.40.5 (backup-server)
  Protocol: TCP
  Port: 9419 (restic REST server)
  Description: Allow backup client traffic to backup server only

At minimum, put backup infrastructure, domain controllers, and any OT/industrial systems on isolated VLANs with explicit allow-list rules rather than broad permits. This single change is consistently one of the highest-impact, lowest-cost items on any ransomware protection checklist, and it’s the difference between “one department lost a week of files” and “the whole company is down.”

Step 9: Deploy Canary Files for Early Warning Detection

Canary files (sometimes called honeytokens) are decoy documents planted in file shares that no legitimate process ever touches. The moment something modifies or encrypts them, you have a near-real-time trigger, often minutes before the bulk of an encryption run finishes.

#!/usr/bin/env python3
# canary_watch.py — alerts immediately if a canary file changes
import hashlib
import time
import smtplib
from email.message import EmailMessage

CANARY_FILES = [
    "/mnt/shares/finance/AAA_DO_NOT_OPEN_Q3_Payroll.xlsx",
    "/mnt/shares/hr/AAA_DO_NOT_OPEN_Employee_Records.docx",
]

def file_hash(path):
    with open(path, "rb") as f:
        return hashlib.sha256(f.read()).hexdigest()

def alert(path):
    msg = EmailMessage()
    msg["Subject"] = f"CANARY TRIGGERED: {path}"
    msg["From"] = "[email protected]"
    msg["To"] = "[email protected]"
    msg.set_content(f"Canary file modified: {path}. Possible ransomware activity — isolate host immediately.")
    with smtplib.SMTP("localhost") as s:
        s.send_message(msg)

baseline = {f: file_hash(f) for f in CANARY_FILES}

while True:
    for f in CANARY_FILES:
        current = file_hash(f)
        if current != baseline[f]:
            alert(f)
            baseline[f] = current
    time.sleep(15)

# Example log output when triggered:
# [2026-08-24 03:12:07] CANARY TRIGGERED: /mnt/shares/finance/AAA_DO_NOT_OPEN_Q3_Payroll.xlsx
# [2026-08-24 03:12:07] Alert email sent to [email protected]

Wazuh and most commercial EDR platforms have this pattern built in as a file-integrity-monitoring rule, so treat the script above as a reference implementation for environments without a SIEM yet.

Step 10: Automate Ransomware Detection With SIEM Rules

Canary files catch the “someone touched a decoy” case. A behavioral SIEM rule catches the broader pattern: mass file renames, sudden spikes in file-write operations, or a single process touching thousands of files within seconds. A Sigma rule (the open standard most SIEMs including Wazuh, Splunk, and Sentinel can ingest) is a portable way to define that logic once.

title: Mass File Rename Consistent With Ransomware Encryption
id: 7f3d9c21-8ab4-4e1a-9c7f-ransomware-mfa
status: stable
description: Detects a single process renaming an abnormally high number of files in a short window, a common ransomware encryption signature
logsource:
  product: windows
  category: file_rename
detection:
  selection:
    EventID: 4663
    ObjectType: File
  timeframe: 60s
  condition: selection | count(TargetFilename) by Image > 100
falsepositives:
  - Bulk file migration tools
  - Backup software during scheduled full backups
level: high

Tune the count threshold and timeframe against your own baseline before going live — a legitimate backup job or a bulk file migration can trip this if you set the threshold too aggressively. Run it in alert-only mode for a week, review the false positives, then move to active blocking through your EDR’s response action if your platform supports it.

Step 11: Train Employees and Run Phishing Simulations

Phishing remains the number-one entry point for ransomware in 2026, and Keepnetlabs’ security awareness training trend analysis for the year flags two shifts worth building into your program: deepfake scenarios are now showing up in curriculum content, and “GenAI shadow use” — employees pasting sensitive data into unauthorized AI tools — has become a training topic in its own right, not a side note.

Run monthly phishing simulations, not quarterly ones. Attackers iterate faster than a once-a-quarter cadence can track, and monthly testing gives you a much tighter feedback loop on which departments need targeted follow-up training. Pair this with hands-on guidance for your team on spotting the specific red flags — our phishing email detection guide covers the header analysis and sender-verification techniques worth including in your training materials, and our SPF, DKIM, and DMARC setup guide covers the email authentication side that blocks a lot of spoofed sender attacks before they reach an inbox at all.

Step 12: Write, Test, and Rehearse Your Incident Response Plan

Every control above is prevention. This step is what happens when prevention fails, because it eventually will for someone. A written incident response plan that’s never been rehearsed is a document, not a plan. Tabletop exercises expose the gaps: nobody knows who has authority to shut down a business system, the “backup” contact for your legal counsel is three roles out of date, or your cyber insurance policy has a notification window nobody remembers.

• Define your incident severity tiers and who can declare each one
• Pre-approve the decision to isolate a host or segment from the network without waiting for a meeting
• List your incident response retainer contact, cyber insurance claims line, and outside counsel — with current phone numbers
• Schedule a tabletop exercise at least twice a year, and run one immediately after any major infrastructure change
• Store a printed or offline copy of the plan — if your network is encrypted, your only copy of the response plan shouldn’t be on the encrypted network

Step 13: Protect Cloud Workloads and SaaS Data

Everything above assumes an on-premises or hybrid network, but a growing share of 2026 ransomware incidents never touch a traditional endpoint at all. Attackers who compromise a single SaaS admin account can mass-delete or encrypt files stored in Microsoft 365, Google Workspace, or a SaaS CRM, and most organizations discover too late that their SaaS provider’s built-in retention window doesn’t count as a real backup. A 30-day recycle bin isn’t a disaster recovery plan if the account credential that emptied it is the same one that got phished.

Three changes close most of this gap. First, run a dedicated SaaS backup tool that takes independent, immutable snapshots of Microsoft 365 and Google Workspace data outside the vendor’s own retention system — the point is redundancy against a compromised admin account, not just accidental deletion. Second, apply the same least-privilege principle from Step 3 to your cloud IAM roles: audit who holds Global Admin or equivalent in your identity provider, and cut that list down to the smallest number of people who genuinely need standing access. Most organizations find accounts with admin rights nobody remembers granting, the same pattern that shows up in on-premises identity sprawl.

Third, extend your Step 4 patch-prioritization habit to your SaaS vendor’s own security bulletins, not just your own infrastructure. IBM’s 2026 cyberthreat analysis ties the sharp rise in supply chain and third-party breaches directly to this blind spot: organizations that carefully patch their own stack often have no process at all for tracking a critical vulnerability disclosed by a vendor they depend on. Subscribe to your top five SaaS vendors’ security advisory feeds and route them into the same triage workflow you use for CISA KEV entries.

Common Ransomware Protection Pitfalls to Avoid

These mistakes show up repeatedly in post-incident reviews, and every one of them is avoidable with the steps above.

• Backups that were never restore-tested. A backup job completing successfully tells you nothing about whether the data is recoverable. Schedule quarterly restore drills into an isolated environment, not production.
• MFA gaps on “less important” accounts. Service accounts and legacy admin logins are frequently exempted from MFA rollouts because they’re inconvenient to update. Attackers specifically target those exemptions.
• Treating EDR deployment as complete at 90% coverage. The uncovered 10% is exactly where ransomware operators land, because it’s the path of least resistance.
• Flat network architecture with no segmentation. One compromised workstation shouldn’t have a network path to your backup infrastructure or domain controllers.
• Patch backlogs prioritized by CVSS score alone instead of exploitation status. A CVSS 9.8 that isn’t being exploited in the wild is a lower priority than a CVSS 7.5 sitting on the CISA KEV list.
• No offline copy of the incident response plan. If ransomware encrypts your file server, and that’s where your response plan lives, you’ve lost your playbook exactly when you need it most.
• Assuming cyber insurance covers everything. Many 2026 policies have specific requirements (MFA, EDR, tested backups) that must be in place before an incident, or the claim gets denied. Read your policy’s technical requirements section now, not after an attack.

Troubleshooting Ransomware Protection Issues

Here are the problems teams run into most often while implementing these controls, and how to work through them.

• Controlled Folder Access is blocking a legitimate business app. Add the app’s executable path to the allowed-apps list via Add-MpPreference -ControlledFolderAccessAllowedApplications rather than disabling the feature entirely.
• restic backup jobs are timing out on large datasets. Break the backup into smaller tagged jobs by directory instead of one monolithic run, and confirm your network path to the S3 endpoint isn’t being throttled by an intermediate firewall rule.
• Sigma rule is generating too many false positives from legitimate backup software. Add an exclusion for your known backup process image path in the falsepositives handling, or raise the file-count threshold and re-baseline.
• Canary file script isn’t detecting changes. Confirm the monitoring process has read access to the file share and that the share isn’t excluded from the antivirus real-time scan path, which can sometimes intercept file handles first.
• nmap scan shows a port as filtered instead of open or closed. That usually means a firewall is dropping packets rather than rejecting them — confirm with a targeted nmap -sS -p3389 --reason scan and check firewall logs directly.
• MFA rollout is being bypassed via legacy authentication protocols. Disable legacy auth (POP, IMAP, older SMTP auth) at the identity provider level; these protocols don’t support MFA and are a common workaround attackers exploit.
• Object Lock on your backup bucket isn’t preventing deletion. Confirm the retention mode is set to Compliance, not Governance — Governance mode can be overridden by an account with the right IAM permission, which defeats the purpose against an attacker with stolen admin credentials.
• EDR agent shows as installed but not reporting. Check for a broken outbound connection to the management console (proxy or firewall rule blocking the agent’s callback), which is a common cause of “phantom coverage” in the gap-analysis script from Step 5.

Advanced Tips for Enterprise-Grade Ransomware Resilience

Once the core controls above are in place, a few additional practices separate a good ransomware program from one that actually holds up under a real attack.

Move to Zero Trust identity, not just MFA. MFA proves who someone is at login. Zero Trust continuously evaluates whether that session should still be trusted, factoring in device posture, location, and behavior. Conditional access policies that require a compliant, managed device for access to crown-jewel systems close a gap MFA alone leaves open.

Extend your vendor risk questions past “do you have a SOC 2.” Given that supply chain breaches have quadrupled over five years according to IBM’s 2026 analysis, ask vendors directly about their own backup immutability, MFA coverage, and whether they’ve had a tested (not theoretical) incident response exercise in the past 12 months.

Treat dual-use tooling as a detection priority, not an afterthought. Remote monitoring and management (RMM) tools and penetration-testing frameworks are dual-use by nature. SANS’s 2026 guidance specifically calls out blocking and alerting on these tools when they appear outside your approved IT toolset, since attackers frequently repurpose the exact same software your own team uses legitimately.

Build a decoy environment for high-value targets. A honeypot domain controller or fake file share with realistic-looking (but fake) data adds detection depth beyond canary files, and it buys your SOC extra time by sending attackers down a dead end during reconnaissance.

Track group-specific tactics, not just generic ransomware indicators. Checkpoint’s Q2 2026 data shows Qilin and The Gentlemen currently account for a large share of active campaigns, and both groups have documented, distinct affiliate tooling and negotiation patterns. Feeding your SOC current threat-intel reporting on whichever groups are most active against your industry sharpens detection rules well beyond what generic ransomware signatures catch, and it shortens the time between initial access and containment when minutes matter most.

Complete Working Project: A Ransomware Resilience Starter Kit

Putting every step together, here’s a minimal but complete project structure you can adapt for a small-to-midsize environment. Each script referenced above slots into this layout:

ransomware-resilience-kit/
├── scan/
│   └── external_port_scan.sh        # Step 2: nmap sweep of public IP ranges
├── patch/
│   ├── kev_catalog.json             # Step 4: cached CISA KEV data
│   └── kev_crossref.py              # Step 4: match KEV entries to installed CVEs
├── edr/
│   └── coverage_gap_check.py        # Step 5: asset inventory vs. EDR agent list
├── backup/
│   ├── restic_backup.sh             # Step 7: nightly immutable backup job
│   └── restic_restore_test.sh       # Step 7: monthly restore drill
├── network/
│   └── pfsense_segmentation.txt     # Step 8: VLAN isolation rules
├── detection/
│   ├── canary_watch.py              # Step 9: canary file monitor
│   └── mass_rename_sigma.yml        # Step 10: Sigma detection rule
├── ir/
│   └── incident_response_plan.md    # Step 12: tested IR runbook
└── cron/
    └── crontab.txt                  # Scheduling for all recurring jobs

# Example crontab.txt entries:
# 0 2 * * * /ransomware-resilience-kit/backup/restic_backup.sh
# 0 3 1 * * /ransomware-resilience-kit/backup/restic_restore_test.sh
# 0 6 * * 1 /ransomware-resilience-kit/patch/kev_crossref.py
# */15 * * * * /ransomware-resilience-kit/detection/canary_watch.py --once

Clone this structure, drop your own asset inventory and backup targets into the config files, and you have a working, auditable ransomware resilience baseline that maps directly back to the twelve steps above — useful both for day-to-day operations and for demonstrating due diligence to auditors or cyber insurance underwriters.

Ransomware Protection Tools Compared for 2026

You don’t need every tool in this table, but each row maps to a specific step above. Pick based on your budget and existing stack.

Security.org’s 2026 testing of consumer-facing options singled out Norton 360 as a strong pick specifically because of its cloud backup feature, which gives users a clean recovery path even if an attack succeeds — the same principle as the enterprise 3-2-1-1-0 strategy in Step 7, just packaged for individual users.

Frequently Asked Questions

How long does it take to fully implement ransomware protection?

Budget around 100 minutes to complete the core technical steps (MFA, patching triage, backup setup, Controlled Folder Access, and basic segmentation) for a small environment. Full enterprise rollout, including EDR coverage validation and a rehearsed incident response plan, typically spans several weeks because it depends on tabletop scheduling and vendor procurement.

Is antivirus software enough to stop ransomware in 2026?

No. NIST’s guidance still recommends antivirus as a baseline control, but modern ransomware operators route around signature-based detection using living-off-the-land techniques and legitimate dual-use tools. Antivirus needs to be paired with EDR/XDR behavioral detection, MFA, and immutable backups to be effective against 2026-era attacks.

Should I pay the ransom if my organization is already encrypted?

Most incident response guidance discourages paying, since payment doesn’t guarantee a working decryption key and directly funds further attacks. This is a decision for your legal counsel and incident response retainer, factoring in regulatory requirements in your jurisdiction — it’s not a call to make without that guidance already lined up before an incident happens.

What’s the single highest-impact control if I can only do one thing?

Tested, immutable, offline backups. Every other control reduces the odds of a successful attack; backups determine whether a successful attack is a bad week or a company-ending event. If you do nothing else from this guide, implement Step 7.

How often should phishing simulations run?

Monthly is the current recommendation for 2026, up from the quarterly cadence common a few years ago. Attackers iterate on lures faster than a quarterly schedule can track, and monthly testing surfaces which teams need targeted follow-up training sooner.

Does network segmentation slow down normal business operations?

Done correctly, no. Segmentation should be invisible to legitimate traffic patterns, since the allow-list rules match how your systems already communicate. The friction shows up only when segmentation is implemented reactively after an incident, without first mapping normal traffic flows — plan the VLAN structure around your actual usage patterns first.

Are small businesses actually targeted by ransomware, or just large enterprises?

Small businesses are targeted heavily, often specifically because they’re less likely to have EDR, tested backups, or MFA in place. Checkpoint’s Q2 2026 data shows ransomware groups running high-volume campaigns across many victims rather than only pursuing a handful of large targets, which means smaller organizations without these controls are frequently the easier win.

How do I know if my current backups would actually survive a ransomware attack?

Run a restore test into an isolated sandbox environment, not production, and confirm the data is intact and the process completes within your recovery time objective. If you’ve never done this, assume your backups are unverified until proven otherwise — a backup job reporting “success” only confirms the copy operation completed, not that the data is recoverable under attack conditions.

Related Coverage