Ransomware defense strategy: Best practices for prevention and recovery

In 2025, only 53% of organizations that had data encrypted in a ransomware attack successfully recovered their data from backups. [1] Even though most of those organizations had backups, they failed them anyway. 

One key reason for this is that ransomware attackers now routinely go after backups as part of an attack, with the specific objective of making it impossible for you to restore the backup data. This is because they know that your backups are your last line defense in an attack, so deleting or corrupting them increases the chances you will pay their ransom.    

What enables attackers to do this successfully is rarely a technical failure in the backup software, but rather a failure in the backup storage strategy. Common mistakes include policy-based immutability that holds only until an attacker with administrator credentials modifies the policy, backup systems on shared networks that get encrypted alongside production, and recovery procedures that have never been tested and fail at exactly the moment they are most needed. 

This guide covers the defense layers that actually reduce ransomware risk, explains the difference between ransomware protection that holds under attack and protection that does not, and applies that framework to the decisions that determine whether an organization recovers without paying a ransom. 

Key takeaways 

• Prevention controls reduce the probability of a successful attack. Recovery readiness determines whether an organization pays the ransom when prevention fails. Many organizations invest heavily in the first but only discover gaps in the second after a successful attack, when it is too late 

• The most dangerous vulnerability in most ransomware defense strategies is when backup storage claims to be immutable, but that immutability can be overridden by anyone with administrator credentials. Hardware-enforced Absolute Immutability is the only form of backup protection that holds when attackers have those credentials. 

• Ransomware defense is now a legal requirement across the EU and UK, not just a security best practice. NIS2, DORA, and the UK Cyber Security and Resilience Bill all mandate specific security controls, tested recovery capabilities, and incident reporting, with significant penalties for non-compliance. 

What is ransomware defense? 

Ransomware defense is the combination of technical controls, policies, and recovery capabilities that protect an organization from ransomware attacks and limit the damage when they succeed. 

It rests on two pillars: 

• Prevention controls reduce the probability that ransomware enters a network and spreads. 

• Recovery readiness determines how quickly you can restore normal operations after an attack breaches your defenses. 

Neither works without the other. Strong prevention without a tested ransomware recovery plan means that one successful phishing email can be all that separates your organization from a ransom demand. 

Reliable backups without prevention give attackers a clear path to production systems and, in most cases, to the backup infrastructure itself. That's why true ransomware resilience requires both. 

The key threats every ransomware defense strategy must address 

Understanding what ransomware actually costs, operationally, financially, and legally, is the first step to allocating defense resources correctly. 

These are the four threat categories that make ransomware one of the most consequential risks in enterprise IT, followed by the one that is changing how all four materialize. 

Financial impact 

Ransomware's financial cost extends well beyond the ransom demand. In 2025, the median ransom payment reached $1.0 million, with recovery expenses averaging an additional $1.5 million per incident regardless of whether any ransom was paid. [1] Together, a single event routinely costs more than $2.5 million before accounting for lost revenue. 

Ransomware now appears in 48% of all data breaches, up from 44% the year before, and 96% of its victims are small and medium-sized businesses. [2] At nearly half of all breaches, it is not a remote risk but a baseline planning assumption for any organization that holds data, runs operations, or serves customers. 

Operational disruption 

Restoring operations after a ransomware attack is not a matter of reverting to a data backup and restarting services. The sequence is more demanding and includes identifying the scope of the encryption, isolating affected systems, confirming backup integrity, locating a clean restore point, reimaging compromised endpoints, restoring data, validating that malware has been fully eradicated, and cautiously reintroducing systems to the network while monitoring for reinfection. 

That process takes days to weeks. The organizations that recover fastest share one characteristic: before the attack, they had tested backups and a recovery procedure that key personnel had actually run. Recovery speed is determined by preparation, not by what an organization does after the attack begins. 

Legal repercussions 

Ransomware incidents now carry mandatory legal consequences in multiple jurisdictions. The obligations extend beyond post-incident notification and require organizations to demonstrate, before an incident occurs, that data security controls meet applicable requirements. 

Four frameworks are currently in force across the EU and UK: 

• NIS2 (EU Directive 2022/2555): Essential and important entities must issue an early warning within 24 hours of a significant incident, a full notification within 72 hours, and a final report within one month. Article 21 requires backup management, business continuity, and incident handling procedures. Penalties reach €10 million or 2% of global annual turnover. 

• DORA (EU Regulation 2022/2554): Financial entities in the EU face additional obligations under Article 12, including documented ICT continuity policies, defined recovery time objectives, and regular testing of recovery capabilities. Binding since January 2025, it applies regardless of where an organization is headquartered. 

• GDPR (EU Regulation 2016/679): Article 33 requires supervisory authority notification within 72 hours when a breach involves personal data. Article 34 requires direct notification to affected individuals when the breach creates a high risk to their rights and freedoms. 

• UK Cyber Security and Resilience Bill: Expanding the UK's NIS regulations with stronger incident-reporting requirements broadly consistent with the NIS2 checklist. 

Reputational damage 

Mandatory notification requirements mean most ransomware incidents become public. Customers, partners, and the press learn about events that organizations would have preferred to contain internally. 

The reputational damage typically outlasts the technical recovery. Organizations that demonstrate rapid recovery built on tested, resilient infrastructure tell a story of preparedness. Those who paid a ransom, experienced extended downtime, or cannot confirm whether customer data was exfiltrated face a significantly longer trust-rebuilding period. 

The evolving threat: AI-powered ransomware 

Most ransomware now incorporates some form of AI, whether for reconnaissance, intrusion, or negotiation. [5] Attacks by AI-enabled adversaries increased 89% in 2025, with the average breakout time from initial access to lateral movement now standing at 29 minutes. [3] 

Voice phishing (vishing) grew 442% between the first and second halves of 2024, driven by AI voice synthesis that enables convincing impersonation of executives and IT staff with a realism that standard training does not address. [5] 

Evasion is advancing at the same pace. In 2025, 82% of detections involved malware-free techniques, and AI-powered polymorphic malware continuously rewrites its own code to generate variants that no signature database contains. [5] 

Behavioral monitoring, not signature detection, is what catches this pattern. Global ransomware costs are projected to reach $265 billion annually by 2031. [5] For a deeper look, see Object First's AI data protection white paper. 

Ransomware defense strategy: best practices 

No single control stops ransomware. The best defense against ransomware is a layered posture in which each control is designed to block an attack, limit its spread, detect it early, or ensure recovery if it succeeds. 

The practices below are organized by the stage of an attack where they have the greatest effect. 

Prevention 

Prevention controls reduce the probability that ransomware reaches production systems. None is sufficient on its own; the value is in the combination. 

• Patch management. Unpatched vulnerabilities are among the most common entry points for ransomware. Prioritize high-severity CVEs and maintain emergency patching procedures for actively exploited vulnerabilities in the wild. 

• Firewalls and antivirus. Network firewalls restrict unauthorized connections; endpoint antivirus detects known malware signatures. Both are baseline controls that every other layer depends on. 

• Email security. Phishing is one of the most common ransomware delivery mechanisms. SPF, DKIM, DMARC, sandboxing, and blocking macro execution in untrusted documents all reduce exposure. 

• Port management. Exposed RDP (port 3389) and SMB (port 445) are among the most frequently exploited entry points. Disable RDP where not required, place it behind a VPN where it is, and block SMB at the perimeter. 

• Employee security awareness training. Most ransomware campaigns begin with a user action. Training must now account for AI-generated phishing that no longer carries the obvious signals employees have been trained to recognize. 

• Ad-blocking. Malvertising delivers payloads via compromised ad networks, often without user interaction. Deploying ad-blocking on managed endpoints closes this vector with minimal operational overhead. 

Access control 

Prevention controls keep threats out. Access control limits the damage when one gets through. 

• Network segmentation. Dividing the network into isolated zones prevents ransomware from moving freely after initial compromise. Critical assets should reside on segments that standard user workstations cannot access directly. 

• Least privilege access. Every account and service should hold only the permissions required for its specific function. Overprivileged accounts are among the most valuable assets an attacker can gain from a compromised environment. 

• Multi-factor authentication. A compromised password is significantly less useful when MFA is required. Enforce it on all remote access, administrative accounts, email, cloud services, and backup management interfaces. 

Detection and early warning 

Detection converts residual risk into a manageable incident by identifying active threats before they complete. Speed is the key variable. 

• Network traffic monitoring and intrusion detection. Ransomware generates recognizable patterns: lateral movement, command-and-control beaconing, and unusual file modification volumes. IDS and SIEM integration surfaces these before encryption reaches critical systems. 

• Endpoint Detection and Response (EDR). EDR identifies suspicious behaviors regardless of whether the tool involved is a recognized threat. In 2025, 82% of detections involved malware-free techniques; [3] EDR is specifically designed for the adversary behavior that signature-based antivirus cannot see. 

• Early detection tools. A network decoy mimics a legitimate backup target to lure attackers into revealing themselves before any real data is at risk. Object First Honeypot deploys a decoy Veeam server built into the backup appliance, with 5-click activation and email or SIEM alerts. 

Backup and recovery readiness 

When prevention, access control, and ransomware detection all fall short, recovery capability determines the outcome. That capability is built before the attack, not during it. 

• Employ backups with Absolute Immutability. When, not if, a breach occurs and your business, reputation, and career are on the line, backup storage with Absolute Immutability is your ultimate ransomware defense. This means nobody, not even the most privileged administrator, can alter or delete backup data, regardless of credentials, software policies, or remote commands. 

• Test backup restores regularly. An untested backup is an assumption, not a recovery capability. Regular testing confirms whether critical systems can be restored within the defined RTO and satisfies DORA Article 12 and NIS2 Article 21 regulatory requirements. 

• Avoid paying ransom. Paying does not guarantee working decryption keys, and the funds pay for an ecosystem that will attack again. Organizations with tested, hardware-protected backups can recover without negotiating. 

How to build a ransomware defense strategy 

The controls above tell you what matters. The blueprint below tells you what to build first. Most organizations fund recovery last. That 53% recovery rate is what it costs them. [1] 

So this sequence flips the order, starting with the one capability that still works after every other control has failed. Run the phases in parallel if you can; when time or budget is tight, this is the order that keeps you standing. 

Phase 1: Ensure you can recover 

Recovery is the only control that works after prevention, access control, and detection have all been defeated. Build it first, and every later decision is made from a position of safety rather than exposure. 

• Deploy backup storage with hardware-enforced Absolute Immutability, architected to the 3-2-1-1-0 backup rule: three copies of data, two media types, one offsite, one immutable, and zero unverified backups. At least one copy must be absolutely immutable so that no credential can alter or delete it. 

• Run a restore test immediately. An untested backup is an assumption. Restoring it once converts it into a confirmed capability and surfaces problems while they are still cheap to fix. 

Before trusting any backup product, run three questions against it. They separate Absolute Immutability from data immutability; you're only assuming: 

1. Is S3 Object Lock set to compliance mode, not governance mode? Governance mode allows administrative override. 
2. Can a domain or backup administrator delete a backup before its retention expires? If yes, an attacker holding those credentials can too. 
3. Has the backup been restored end-to-end, under load, within the defined RTO? 

A platform that answers “compliance mode”, “no”, and “yes” to these 3 key questions is one you can build the rest of your strategy on. 

Phase 2: Close the entry points that attackers use most 

With a recoverable baseline in place, reduce the probability that an attack ever reaches production. These controls address the vectors behind the majority of incidents. 

• Enforce multi-factor authentication everywhere, starting with backup management consoles, remote access, and administrative accounts. 

• Patch actively exploited vulnerabilities on a defined schedule, prioritizing high-severity CVEs under exploitation in the wild. 

• Restrict high-risk ports: disable RDP (3389) where it is not required, place it behind a VPN where it is, and block SMB (445) at the perimeter. 

• Filter email at the gateway with SPF, DKIM, and DMARC, add sandboxing, and block macro execution in untrusted documents. 

Phase 3: Contain the blast radius and detect early 

Assume a control will eventually fail. These measures limit how far an intrusion spreads and shorten the time between compromise and discovery. 

• Segment the network so that backup infrastructure is isolated from production networks and credentials, and so standard workstations cannot contact critical assets directly. 

• Apply least privilege to every account and service. 

• Deploy EDR for behavioral detection and route IDS and SIEM alerts into defined escalation paths. 

• Add an early-warning decoy. A honeypot deploys a fake backup target that triggers an alert the moment an attacker probes it, often before any real data is accessed. 

Phase 4: Build and rehearse your ransomware response plan 

Backup data is the starting point for recovery. A documented ransomware response plan is what turns that data into a practiced capability under pressure. 

• Assign roles before an incident: who isolates systems, who notifies legal and executive leadership, and who contacts the cyber insurer, since many policies require prompt notification to activate coverage. 

• Define the first-hour runbook: isolate affected systems, disable switch ports to stop lateral movement, and preserve forensic evidence by not powering systems off without incident-response guidance. 

• Identify a clean restore point that predates the initial compromise, not just the visible attack. Operators often maintain persistence for days or weeks before triggering encryption, and restoring a point that already contains their foothold reintroduces the threat. 

• Rehearse the plan in a tabletop exercise so key personnel have run a full ransomware data recovery cycle before they need it, not for the first time during an attack. 

Phase 5: Operationalize and prove it 

A mature ransomware backup protection strategy is not a one-time deployment. Threats evolve, infrastructure changes, and regulators now require evidence that recovery works, not just claims that it does. 

• Restore-test on a fixed cadence: critical systems quarterly, the full production environment at least annually, documented each time. 

• Map your controls to the frameworks that apply to you: NIS2 Article 21, DORA Article 12 for EU financial entities, and the UK Cyber Security and Resilience Bill all require tested recovery capabilities and timely incident reporting. 

• Reassess annually against both the current threat landscape and your own infrastructure changes. 

Become ransomware-proof with Object First

When—not if—ransomware strikes, the future of your business hangs in the balance. In that moment, recovery matters most—getting back up and running as fast as possible, without unwanted complexity. 

We make cyber resilience simple with backup storage that's absolutely immutable and purpose-built for Veeam. It's your ultimate defense against ransomware. 

Object First is built on Zero Trust best practices and is third-party tested and verified to be secure. It's simple to deploy and manage with no security expertise required, and is powerful enough for lightning fast backups and supercharged Instant Recovery to scale with your business. 

Book a live Object First demo and learn how to make your backups ransomware-proof. 

FAQ 

What is the most effective defense against ransomware? 

No single control is sufficient; the most effective defense is layered. Among those layers, backup storage with Absolute Immutability is the one that still works after prevention and detection have failed. Prevention reduces how often you are attacked. A tested, immutable backup storage solution determines whether an attack ends in recovery or a ransom payment. 

What is the 1-10-60 rule? 

The 1-10-60 rule is a response-speed benchmark: detect an intrusion within 1 minute, investigate it within 10 minutes, and contain it within 60. [3] It reflects how quickly modern attackers move once inside a network, where breakout time from initial access to lateral movement now averages 29 minutes. Meeting it requires behavioral detection through EDR, integrated alerting, and a rehearsed response plan, not signature-based tools alone. 

How do immutable backups protect from ransomware? 

Immutable backups ensure backup data cannot be altered or deleted, even when attackers hold administrator credentials, giving you a clean restore point that the attack cannot touch. What matters is how that immutability is enforced: policy-based rules can be changed by anyone with admin access, while hardware-enforced Absolute Immutability, using S3 Object Lock in compliance mode, holds at the storage layer regardless of credentials. That distinction is the difference between a backup that survives an attack and one that does not. 

How does a data recovery plan help? 

A data recovery plan turns backup data into a practiced capability. Backups alone are not enough; you also need documented restore procedures, defined recovery time objectives, and tested restore paths that confirm critical systems actually come back. The organizations that recover fastest are the ones that rehearsed the plan before the attack, not during it. 

What is the 3-2-1-1-0 backup rule, and why does it matter for ransomware defense? 

The 3-2-1-1-0 rule specifies three copies of data, on two media types, with one offsite or offline, one immutable, and zero unverified backups. It updates the older 3-2-1 model with the two requirements ransomware makes essential: one copy that an attacker cannot alter or delete, even with admin credentials, and zero backups that have not been tested and confirmed recoverable. Those two additions are what make backups ransomware-proof rather than just redundant. 

Can ransomware attacks be detected before encryption begins? 

Yes. Attackers rarely encrypt immediately; they spend time moving laterally, escalating privileges, and disabling recovery tools first, and that dwell time is a detection window. Behavioral monitoring through EDR, network anomaly detection, and ransomware honeypots all close it. Object First Honeypot, built into the Ootbi appliance, deploys a decoy Veeam server that alerts via email or SIEM the moment an attacker probes it, with five-click activation and no additional tooling. 

Resources

[1] Sophos. "The State of Ransomware 2025." 2025. https://www.sophos.com/en-us/content/state-of-ransomware 

[2] Verizon. "2026 Data Breach Investigations Report." 2026. https://www.verizon.com/business/resources/reports/dbir/ 

[3] CrowdStrike. "2026 Global Threat Report." 2026. https://www.crowdstrike.com/en-us/global-threat-report/ 

[4] Object First. "Ransomware Survival Guide." 2025. https://objectfirst.com/ransomware-survival-guide/ 

[5] Object First. "Invisible Threats: How AI Is Rewriting the Rules of Data Protection." 2026. https://objectfirst.com/ai-data-protection/