A plain framework for ransomware resilience in a mid-market company

the reframe: ransomware is a business model

A ransomware operation has a cost structure. Initial access is bought from brokers or earned through automated scanning and credential stuffing. Tooling is rented from ransomware-as-a-service operators for a revenue share. The payout depends on how much leverage the attacker builds before being noticed, and on whether the victim has any option other than paying.

That structure is good news, because businesses respond to economics. You do not need to be impossible to breach. You need the expected payout from attacking you to fall below the expected cost. The conversion data shows defenders winning this argument more often: 69% of ransomware victims in the 2026 DBIR refused to pay, and Coveware's Q1 2026 payment rate was 23%, near an all-time low. So drop the question "how do we stop ransomware" and ask the attacker's questions instead. How would they get in? What could they reach once in? And what would force you to pay? Each question maps to one job.

the two kinds of leverage, and why backups answer only one

Extortion runs on leverage, and modern attackers build two kinds. Encryption leverage takes your systems away; its antidote is recovery, backups that survive the attack and restores that work. This is the leverage everyone plans for. Exfiltration leverage takes your data away: before encrypting anything, the attacker copies what they found, customer records, contracts, payroll, source code. Data theft was confirmed in 94% of extortion cases in Coveware's Q4 2025 data, and dual extortion accounted for 70% of ransomware claims in Coalition's 2026 Cyber Claims Report. No backup helps here. The only antidote is upstream: the attacker who never reaches the data, or reaches only a small slice of it, has nothing to leverage.

Two details from the recent data are worth absorbing. Extortion built on theft alone converts badly, around one in five exfiltration-only victims pay, and Coveware expects attackers to swing back toward encryption because of it. And this is precisely why the second job, blast radius, is the most neglected and most valuable layer: it is the only one that weakens both kinds of leverage at once. A company that plans only for encryption has solved half the problem, and the half that is shrinking.

why the mid-market is the actual target

The mental model of ransomware as a thing that happens to hospitals and pipelines is a decade out of date. Access brokers and affiliates work lists, not trophies. Scanning is automated, credential dumps are bought in bulk, and a 150-person company with a flat network, no MFA on two admin accounts, and an unmonitored VPN is a faster payday than an enterprise with a security team. The numbers are unambiguous: 96% of ransomware victims of known size in the 2026 DBIR were SMBs, Coveware's Q4 2025 median victim had around 200 employees, and ENISA's Threat Landscape 2025 names ransomware the most impactful threat to EU organizations, at 81% of the cybercrime incidents it analyzed. Size is not protection, and it is also not doom: a 200-person company has a small enough environment that the three jobs below are genuinely finishable.

job one: make entry hard

Entry is where the identity layer earns its keep. In Sophos's 2025 ransomware survey, the root causes split into exploited vulnerabilities (32%), compromised credentials (23%), and email-based attacks (37% combined). Layer on the identity lens and the picture sharpens: 67% of victims tie the incident to an identity attack (Sophos, 2026), and the 2026 DBIR found half of ransomware victims had credentials leak through infostealers or dumps in the roughly 95 days before the attack. The attacker usually logs in before they break in.

MFA where it matters most, then everywhere: admin accounts first, remote access second, everyone third. MFA blocks more than 99.2% of account-compromise attacks (Microsoft). For admin and remote access, phishing-resistant factors (FIDO2 keys or passkeys) are preferable, because the attacker who cannot relay a push prompt moves on; then the bypasses get hunted, app passwords, legacy protocols, accounts excluded temporarily. Closing the doors that belong to nobody matters next: every leaver with live access, every ownerless service account, every contractor login from a finished project is a pre-paid entry ticket. 83% of employees admit they still have access to at least one account from a previous employer (Beyond Identity, 2022, self-reported). Patching what faces the internet is the third move: a list of what is reachable (VPN appliances, firewalls, file-transfer tools, anything with a login page) and a habit of patching that short list fast. Phishing training reduces clicks but never zeroes them; the design goal is an environment where one click does not hand over the kingdom, which is job two.

job two: make the blast radius small

Assume entry happens. The difference between an incident and a catastrophe is what the attacker's first compromised account can reach, and this is the layer most mid-market companies have never deliberately designed.

Least privilege, starting at the top: count who holds the highest admin role and halve the list, and separate admin accounts from daily-driver accounts so the account that reads email cannot also delete backups. Killing the standing paths between things comes next, shared accounts with admin rights, service accounts with broad scopes, OAuth grants that can read the whole drive, the same credential reused across systems. In a modern, SaaS-heavy company the blast radius lives less in network segments and more in the access graph: which identities and grants connect which data. Putting data on a gradient helps focus the effort: the customer database, payroll, and contracts deserve restricted access and short lists of identities that can touch them; the lunch-rota folder does not. And the backups get protected like the crown jewels they are: attackers attempted to compromise backups in 94% of attacks in Sophos's research (2024), so backup credentials must not be reachable with the same accounts that run daily IT, and at least one copy must be immutable or offline.

job three: make recovery certain

Recovery is a capability you either built in advance or do not have. The 2025 numbers are sobering: only 54% of victims with encrypted data restored it from backups, the lowest rate in six years (Sophos, State of Ransomware 2025), and 49% paid. The gap between owning backups and recovering from backups is where most of those payments came from.

Backups that survive contact follow the standard pattern, more than one copy, more than one medium, one copy off-site, and the modern addition, one copy immutable, but what separates the 54% from the rest is the discipline around it: scope (are the SaaS systems where the business actually lives covered, or only the file server?), isolation (separate credentials, MFA, no domain join), and testing. A restore test is the only proof a backup exists; quarterly, pick a system, restore it somewhere safe, and time it. The first test usually fails or takes far longer than anyone guessed, which is precisely the information you want before it matters. Sophos's 2025 data shows 53% of victims now fully recover within a week, and the ones who do are the ones who had rehearsed. A decision made before the bad day completes the job: whether you would ever pay, who decides, who calls the insurer, who talks to customers, and what the regulatory reporting clocks are (24 hours for the NIS2 early warning if you are in scope). The entire extortion model rests on the victim having no better option, so certain recovery plus limited exfiltration equals a victim with options, which is exactly why payment rates are collapsing.

where to start: the first 30 days

No purchases, roughly in order, each step useful even if you stop after it. Week one is to see your access: who holds admin, MFA coverage and its gaps, leavers still active, service accounts and their owners, what faces the internet. Week two is to close the worst of it: MFA on every admin and remote-access account, disable the leavers, patch the internet-facing short list; this week alone removes the most common entry paths in the incident data. Week three is to find out if the backups are real: inventory what is actually backed up against where the business actually lives, check who can reach the backups and with which credentials, and run one restore test and time it. Week four is to write the two-pager and rehearse once: the decision tree, the contact list, the reporting clocks, and one ninety-minute tabletop with leadership. A month like this does not make you unbreachable. It makes you expensive, contained, and recoverable.

how the program grows with your company

Under roughly 50 people, the jobs compress into hygiene: MFA everywhere via the productivity suite's built-in enforcement, owner-known accounts, one immutable backup of the systems that matter, and a one-page plan. From 50 to 500, the band the median victim sits in, the access graph outgrows anyone's head, and the three jobs become explicit workstreams with owners; detection enters the picture, usually as a managed service rather than your own analysts, because an alert nobody reads at 3am is not a control. From 500 to 2,000, engineering depth gets added: phishing-resistant MFA as default, privileged access management for the admin estate, real data classification, recovery time objectives per system agreed with the business, and resilience testing on a calendar. At 2,000 and above, the jobs do not change; the coordination does, with dedicated teams, recovery objectives in contracts, and exercises that include subsidiaries and key vendors.

different companies, different stakes

B2B SaaS runs two environments and two programs, corporate IT and production; an attacker in production makes customers victims too, so blast-radius work there is also a sales asset that enterprise questionnaires increasingly ask for. E-commerce and DTC face downtime as the leverage, with attackers timing attacks to peak seasons, so recovery time objectives matter most and the agency and integration accounts that run the store are the entry surface nobody watches. Professional services face the exfiltration side dominating, because client files are the crown jewels and the threat to publish them attacks the franchise, so data gradient and access minimization matter more than fast restores. Regulated and critical-sector firms run the same three jobs plus clocks and evidence, NIS2's 24-hour early warning, DORA's incident classification and resilience-testing duties, and supervisors who ask for proof; resilience work done properly produces that evidence as a byproduct.

what you don't need yet

Every vendor will tell you their category is step one. You do not need a 24/7 security operations center at 80 people; you need the basics above, then perhaps a managed detection service. You do not need a deception platform, a threat-intel feed, or an AI-powered anything before MFA coverage is real and a restore has been tested. Endpoint detection is genuinely valuable, and it is a category to enter deliberately, managed if nobody will read its alerts, rather than a reflex purchase after a scary demo. The pattern behind every premature purchase is the same: tooling bought to compensate for visibility nobody has. See first, buy second.

how this maps to nis2, dora, and your insurer

If a framework applies to you, this work is not extra. NIS2's Article 21 measures name access control, MFA, backup management, business continuity, and incident handling directly, and the three jobs produce them in working form. DORA goes further for financial entities, with classified incident reporting, recovery objectives, and resilience testing on a schedule. The insurer is often the nearest deadline: ransomware was the most expensive claim type in Coalition's 2026 Cyber Claims Report, at an average loss of $269,000, and underwriters price accordingly, MFA coverage, backup isolation, tested recovery, and leaver hygiene are now standard questionnaire items.

common mistakes

Planning only for encryption covers half the leverage, and the shrinking half; the data-theft side is answered upstream or not at all. Backups the attacker can reach, domain-joined backup servers, shared admin credentials, no immutable copy, are a single point of failure dressed as redundancy. Confusing owning backups with having recovery catches the 46% who could not restore in 2025 despite owning backup products, undone by untested restores, uncovered SaaS systems, and unknown restore times. Treating it as a tooling project misreads the median victim, a 200-person company that owned security products and lost on operational gaps, the unenforced MFA, the leaver from March, the service account nobody owns. Writing the plan during the incident makes deciding whether to pay a terrible 2am activity. And waiting for budget postpones resilience while attackers do not wait for your procurement cycle; the first 30 days cost attention, not money.