Protect and secure your data from cyber attacks
Data Protection
Data Security
Data Insights
The 5 Steps to Cyber Resilience
Cloud & SaaS
Enterprise
Industries
Ransomware can take a business offline in minutes. And even after the dust settles, the damage lingers, because once an attacker has been inside your systems, you can no longer take the integrity of your data for granted. Recovery often means proving what's trustworthy before you can use it again.
Strong protection works on two fronts: prevention keeps attackers out and limits how far they get when they do break in. Recovery readiness makes sure that if ransomware does take hold, you can quickly restore operations from safe data. One without the other leaves a gap, since no defense stops every attack, and backups alone don't spare you the disruption of getting hit.
This guide covers both sides. We'll walk through how to protect against ransomware, how to detect and respond to an attack in progress, and how resilient backups let you recover with confidence when it counts.
Ransomware is malicious software that encrypts your data and holds it hostage, with attackers demanding payment in exchange for the key to unlock it.
What sets it apart from other malware is its goal. Where a data-stealing Trojan or spyware works quietly to stay hidden, ransomware is built to be noticed, locking you out of your own systems and making its presence impossible to ignore.
Most attacks start with one of a few entry points, like a phishing email that tricks an employee into clicking or an unpatched system that an attacker can exploit from the outside. Once inside, attackers move through the network, escalate their access, seek out the most valuable data and systems, and often go after backups along the way. By the time the encryption triggers, they've usually positioned themselves to do the most damage possible.
Paying the ransom is tempting when operations are frozen, but it leaves the real problem untouched. A payment buys a decryption key, not the removal of the attacker from your systems, so the entry point and any foothold they established remain open. Decryption tools supplied by attackers are often slow or incomplete, leaving some data unrecovered. And when an attacker has stolen data as leverage, paying offers no guarantee they'll delete it rather than sell or leak it later.
Protecting against ransomware starts with keeping it from reaching your data in the first place. Attackers get in through a few predictable entry points, and prevention works by shutting them down. The three controls in this section cover the people attackers try to trick, the credentials they try to steal, and the systems they try to exploit.
Your employees are the most frequent target. One click on a convincing phishing email can hand an attacker the access they need, which is why effective training needs to go well past an annual slideshow.
Simulated phishing campaigns put employees in realistic situations and show you who needs more support, while role-specific scenarios prepare people for the lures aimed at them, like finance staff facing fake invoices or executives targeted by impersonation.
Multi-factor authentication is the single highest-impact control you can deploy against credential-based attacks. Even when an attacker steals a password, MFA gives them a second barrier that a stolen credential alone can't clear. From there, least-privilege access limits the damage if an account is compromised, since a user who can only reach what their job requires gives an attacker far less room to move.
Privileged account management applies that same thinking to your highest-risk accounts, putting extra controls around the IT and admin credentials an attacker wants most. These identity controls form a core part of cybersecurity resilience services that contain an attack before it spreads.
Unpatched systems are one of the most common ways attackers get in, so keeping software current closes a door that's otherwise left standing open. Endpoint detection and response (EDR) catches what patching misses, watching for malicious behavior on devices and stopping threats that slip past other defenses.
Network segmentation limits how far an attacker travels after gaining a foothold, walling off parts of your network so a single compromised system doesn't open the path to everything. Layered together, these are foundational data security solutions that shrink both the openings attackers use and the ground they can cover.
Attackers give themselves away before they encrypt anything. They log in at odd hours, dig through files they have no reason to touch, try to switch off security tools, and move large amounts of data out of place. Each is a warning sign, and the sooner you spot one, the more time you have to stop the attack before it lands.
Signature-based tools only recognize ransomware they've seen before, so a new variant slips right past. Watching for what an attacker does, rather than which strain they're running, catches the threat regardless. Anomaly detection works this way: learning your system's normal rhythm and raising a flag when something breaks from it. The same detection feeds ransomware data recovery, since catching an attack early leaves far less to restore once it's contained.
When you confirm an attack, the first hour shapes how the rest of the recovery goes, so speed and order are important.
Start by isolating affected systems, disconnecting them from the network so the ransomware can't spread to healthy machines. Pull the network connection rather than shutting machines down, since powering off can wipe evidence held in memory that helps you understand the attack later. If you can't isolate a single system fast enough, segmenting a larger part of the network buys you time.
Preserve evidence as you work. Capture logs, take system images, and note what you saw and when, since this record guides the investigation and supports any reporting you owe to regulators, insurers, or law enforcement. Working from memory after the fact rarely holds up.
Bring the right people in early. Activate your incident response plan so everyone knows their role, and the response moves as a coordinated effort instead of a scramble. That usually means a lead coordinating decisions, technical staff handling containment and recovery, and someone managing communication with leadership and, where needed, customers or regulators.
Resist the urge to rush a fix. Wiping and rebuilding a system before you understand how the attacker got in often leaves the door open for them to return. Confirm the scope first, then move to recovery. When your team needs deeper expertise, an incident response service brings in specialists to guide containment and recovery alongside your staff.
A backup made after the attacker got in may carry the malware too, so a standard restore can put the threat straight back into production. Clean room data recovery avoids that by rebuilding data in an isolated space first, where you can confirm it's free of threats before it reaches your live systems.
Finding the right recovery point is the first problem to solve. The newest backup is often the wrong one, since it may already hold the attacker's tools or altered files. The copy you want is the last one taken before the intrusion started, and pinpointing it means working backward through your snapshots with threat scans and forensic timelines until a version comes back clean.
Recovery then runs in stages rather than all at once. You restore the systems the business needs most first, then check each one against indicators of compromise before it reconnects to the network, so a single missed backdoor can't reinfect what you've already restored. Endpoints are often reimaged from scratch instead of restored, since a clean rebuild is faster and safer than trusting a machine that was in the blast radius.
For your backups to survive a ransomware attack, three things have to be in place: immutability and air-gapping, the right number of copies in the right locations, and regular testing.
An immutable backup can't be changed or deleted once it's written, so stolen admin credentials are useless against it. Air-gapping works differently, keeping a copy separated from your production network so it sits outside the attacker's path entirely.
Immutability protects the copy from tampering, and air-gapping keeps it out of reach, so you need both to be sure one clean copy survives, no matter how deep an attacker gets. Data backup and recovery services that offer both provide strong protection from ransomware.
The 3-2-1 rule is a long-standing backup standard. You keep three copies of your data, on two types of media, with one copy offsite. It works well for accidental loss, like a failed drive or a fire, but it was never built for an attacker deliberately hunting your backups, and an offsite copy that's still online and reachable can be encrypted along with everything else.
The 3-2-1-1-0 extension closes that gap by adding one copy that's immutable or air-gapped, plus zero recovery errors verified through testing. Those two additions are what carry the rule from protecting against bad luck to protecting against ransomware.
A backup is only useful if you can recover from it, and testing is how you find that out before a real attack. A good test restores your data and checks that it comes back intact and fast enough to meet your recovery targets. Run these tests on a regular schedule, since a backup that recovered cleanly months ago can fail today after changes to your systems.
Most organizations run backup, security, and recovery as separate products, and the gaps between them are where time gets lost during an incident. Cohesity closes those gaps by building all three into one data resilience solution. Anomaly detection flags a threat in the same place your backups live, so you move from spotting an attack to recovering from a verified copy without stitching tools together mid-incident.
You can see how it fits your own systems with a free 30-day trial, a low-commitment way to test the platform against your recovery scenarios before you decide.
