Ransomware in 2026 is not the ransomware of 2021. The extortion playbook now routinely includes double-extortion data theft, insurance-carrier targeting, and remote-desktop or MFA-fatigue initial access. The defenses that worked five years ago, antivirus, nightly tape, and a firewall, do not stop the current wave. Here is the checklist our engineers use when onboarding a new managed client.
01Start with identity, not endpoints.
The last three ransomware calls we took in SW Florida, a Naples law firm, a Cape Coral contractor, a Fort Myers title company, all started with a credential harvested months earlier and left dormant. Zero-day exploits are extremely rare in small-business incidents. Identity controls stop more attacks than any endpoint product. MFA everywhere it can be required: Microsoft 365, VPN, remote desktop, firewall admin, SaaS logins, every privileged account.
Conditional access policies tighten the story further. Block logins from impossible-travel patterns, require a managed device for sensitive apps, and lock down legacy protocols (IMAP, POP, basic auth) that bypass MFA entirely.
- MFA enforced on M365, VPN, RDP, firewall, SaaS
- Conditional access: managed-device and geo-restriction policies
- Legacy authentication (basic auth) blocked tenant-wide
- Privileged accounts reviewed quarterly
02Treat endpoints like they will be compromised.
Modern ransomware bypasses signature-based antivirus trivially. EDR (endpoint detection and response) watches for behavioral patterns, mass encryption, lateral movement, credential dumping, and kills the process chain before data leaves the device. SentinelOne and CrowdStrike are what we deploy most; Defender for Business is credible for tight budgets.
Human-led response matters more than the vendor logo. A good EDR product with no one watching it is worse than a modest product with a real SOC behind it.
- EDR deployed on every endpoint and server
- 24/7 SOC-monitored alerts with documented response
- Tamper-protection and uninstall-password enabled
- Application allowlisting or blocklisting where feasible
03Backups must be immutable, off-site, and tested.
If your backups can be encrypted by a compromised account, they are not backups. Every modern backup strategy requires at least one immutable, air-gapped, or cloud-object-locked copy that cannot be tampered with even by a domain admin.
And untested backups fail at the worst possible moment. A quarterly restore drill, full VM, random file, and SaaS mailbox, is non-negotiable.
- 3-2-1 rule: 3 copies, 2 media, 1 off-site
- Immutable cloud tier (object lock) on at least one copy
- Quarterly restore testing with documented results
- M365 and Google Workspace backups (native retention is only 30–90 days)
04Train the humans, without humiliating them.
Phishing is still the most common initial-access vector because it still works. Hurricane season is a particularly heavy phishing window in SW Florida, fake power-restoration notices, fake FEMA portals, fake insurance-claim status emails. A quarterly simulated-phishing cadence with short just-in-time training for anyone who clicks shifts behavior more than an annual hour-long video course ever will.
The goal is pattern recognition, not punishment. Report rates matter as much as click rates, a team that reports suspicious email is a team that is paying attention.
05Close with documentation your insurer will accept.
Every modern cyber insurance renewal asks for the same core set of controls: MFA, EDR, backups, patching cadence, security training. Documentation of these controls is what gets your renewal priced. A denied claim for an undocumented control is a bad day nobody needs.
We complete carrier questionnaires, attest controls, and sit on renewal calls for every managed client. Properly-documented programs frequently see premiums stay flat or fall, even in a hardening market.
The last four ransomware calls we took started the same way: a partner clicked something on a Saturday and Monday looked very different. A Ransomware Readiness Review, two weeks, $4,800 fixed, benchmarks your controls against the 26-point checklist we maintain, with a ranked remediation plan your ownership can actually read.