How does a ransomware attack work?
Encryption is the end, not the beginning. Before it come initial access — phishing, a purchased credential, an unpatched exposed service — internal reconnaissance, privilege escalation and lateral movement that can last weeks, and identification of what is most valuable. Only when the attacker controls enough, and has neutralized the backups, does encryption launch. That earlier window is where it can be stopped.
Double extortion changed the rules
Today the norm is stealing the data before encrypting it. So even if the victim restores from backup and recovers operations, pressure continues: publishing the stolen information is the second lever, and it affects customers, contracts and legal notification duties. That is why 'we have backups' no longer equals 'they cannot hurt us', and response must address the data breach, not just recovery.
What genuinely reduces the risk
Tested backups, with at least one offline or immutable — attackers hunt and delete backups reachable from the network, and a restore never rehearsed fails when needed. Add phishing-resistant MFA on every remote access, patching of internet-exposed systems, segmentation that blocks lateral movement, least privilege, and detection able to see the earlier phase rather than the encryption.
