Ransomware Protection: What Actually Works

Last updated: October 29, 2026 · Based on published incident guidance and vendor documentation

Ransomware advice has a bad habit of treating every layer as equally important, which produces checklists that are long, expensive, and mostly irrelevant to how the incidents actually happen. The truth is narrower: the overwhelming majority of ransomware arrives through a person, and the defences that stop most of it are behavioural rather than technical. What the technical layers contribute is narrower and worth stating precisely. This guide ranks the controls by how much they actually prevent, and separates prevention from recovery.

Table of contents

• How ransomware actually arrives
• The tier that does most of the work
• Controls that reduce the blast radius
• What security products contribute
• Recovery, which is a different problem
• The checklist, in order of value
• FAQ
• Bottom line

How ransomware actually arrives

Almost every incident worth reading about starts with an ordinary moment: an email that looked like an invoice, a document that looked like a delivery notification, a shared drive that looked like a shortcut, a login page that looked like the real one. The payload arrives, it executes, and the encryption begins. The gap between that moment and the encryption is where defence is possible, and it is much shorter than most product pages imply.

Two features of the arrival stage shape everything that follows. It is human-initiated, which means a technical control that requires a person to do something unusual — type a command, run a script, disable a protection, approve a prompt — can stop it. And it is delivered over an ordinary channel, which means the delivery mechanisms are the ones you already use for legitimate work, and the defences that matter are the ones you already have.

This is why the most effective controls in this category are unglamorous. A rule that blocks executables arriving by message, a password manager that does not autofill on a lookalike domain, a habit of checking the sender on anything with an attachment: these stop more ransomware than a feature list of scanning engines does.

The tier that does most of the work

These are the controls worth getting right first, and they are nearly free.

• Multi-factor authentication on email, and on anything that can reset your email. This is the control that breaks the chain most often. A great many intrusions begin with a mailbox compromise, because the mailbox is where password resets live. An authenticator app or a hardware key is materially stronger than a code sent to the same device. [VERIFY the factor types any service you use supports before choosing.]
• A password manager with lookalike-domain detection. It stops a large share of credential phishing, because the autofill does not happen on a domain that is not the one saved. Crucially, this requires that you use the manager rather than copying and pasting.
• Multifactor on banking and payment services too. Not only email. Financial access is the objective of the operation, and it is often protected separately.
• Do not run as administrator, for daily work. A large share of ransomware cannot install, cannot read protected files, or cannot reach system directories without elevation. This is a setting, not a purchase.
• Update promptly, including the operating system. Ransomware campaigns chain known vulnerabilities, and the gap between disclosure and widespread exploitation is often short. Many organisations still run on operating systems they consider current.
• A rule that blocks script execution from messages and downloads. Your mail client and browser can do this. It breaks some legitimate attachments, which is a reasonable trade, and it is a meaningful obstacle to the delivery stage.
• Attachment and macro defaults. Disable macro execution by default in documents and spreadsheets. Where you need them, ask for them deliberately rather than having them on.

Controls that reduce the blast radius

These do not prevent the arrival. They limit what happens after it, which is often the difference between an incident and a catastrophe.

• Restrict administrative shares and remote administration. Ransomware spreads laterally. The single most effective containment step is preventing one compromised machine from reaching others, and the most common routes are remote desktop and file sharing.
• Network segmentation. Separate the machines that can talk to each other from those that cannot. A user workstation should not be able to reach a file server or a backup share directly.
• Least privilege on file access. The reason ransomware can encrypt a whole share is that a single account can write to all of it. Read-only access to the directories that do not need editing removes the encryption from the equation.
• Disable macros and scripts from mapped and shared locations. A shared drive is a delivery vector as well as a target.
• Turn off automatic running of executables from network locations. This is a long-standing Windows behaviour that many organisations leave enabled for compatibility, and it is worth checking.
• Rate-limit and alert on mass file modifications. Encryption is visible in the filesystem as a mass rename-and-rewrite. Most environments can log it, and most do not.

What security products contribute

Here is where the honest answer is narrower than the marketing, and it is still worth having.

• Behavioural detection that sees encryption in progress. Modern engines do detect ransomware-like file activity, and this is a genuine contribution — but it is a contribution at the execution stage, after delivery, not a replacement for the tier-one controls that stop delivery.
• Exploit and vulnerability protection. Useful, and it addresses a real path. It does not address the human-initiated path, which is the more common one.
• Controlled folder access. A feature on current operating systems, and one of the more valuable. It allows only specified applications to write to specified folders, so a payload that has executed cannot encrypt your documents even if it is running.
• Backup and rollback. Genuinely valuable, and it is recovery rather than prevention. Covered separately below.
• Managed detection with a human in the loop. For an organisation, a monitoring service that notices the mass file modification and tells somebody is worth more than another signature in an engine. Detection that nobody acts on is not detection.

Where a product purchase makes sense, it is usually for one of these specific capabilities — controlled folder access, rollback, or monitored response — rather than for a marginally better detection rate.

Recovery, which is a different problem

Prevention and recovery should be budgeted separately, because they are different problems and confusing them is how organisations end up with a very good prevention story and no way back.

• Backups that are actually restorable. The important property is not that backups exist but that a restore has been tested. An untested backup is a hypothesis.
• Backups that cannot be reached by the thing that is encrypting. If the backup is on a mapped drive or a network share, and the malware has administrative rights, it is in scope. Offline or immutable storage exists for exactly this reason.
• Versioned or immutable retention. Ransomware that encrypts files also tries to delete the originals. Retention that keeps previous versions, and storage that resists deletion, is what makes recovery a matter of restoring rather than of paying.
• A rehearsed recovery sequence. Who decides, who isolates, who restores, in what order, and who is authorised to pay. The decision about whether to pay is the one most worth making in advance, because it is the one nobody wants to make under pressure.
• Knowing your recovery point objective. How much data can you afford to lose? The answer determines the backup frequency, and it is a business decision rather than a technical one.
• Restoration testing on a schedule. Restore a file, then a folder, then a machine. Doing this quarterly costs little and is the difference between a plan and a hope.

The checklist, in order of value

1. Turn on multifactor authentication for email. Then for banking, then for anything with password-reset access to the rest. Use an authenticator app or a hardware key rather than SMS where the service allows it.
2. Use a password manager every day, and stop copying passwords. Lookalike-domain detection is the part that matters for this threat.
3. Stop running as administrator.
4. Block script execution from messages and downloads; disable macros by default.
5. Update the operating system and the browser promptly.
6. Turn on controlled folder access for your documents folder, if your operating system offers it.
7. Restrict remote administration and split the network into segments.
8. Check the backup is unreachable from the network and is versioned.
9. Restore something, today. One file, to confirm it works.
10. Decide and document the recovery sequence and who can authorise a payment.
11. Only then consider an additional security product, and buy it for a specific capability rather than for a detection rate.

FAQ

Does antivirus stop ransomware?

Partially, and less often than the category's marketing implies. Behavioural detection catches a meaningful share of active encryption, and it is worth having. But it operates after the payload is running, while the controls that prevent most incidents — multifactor authentication, a password manager, blocked script execution, not running as administrator — operate before, and they are cheaper. The decision framework in do you need antivirus covers when the product tier is worth adding.

Do I need to pay for a ransomware-specific product?

Usually not, if your operating system is current and you have turned on the features it already includes. Controlled folder access and system restore points are free, and they cover a meaningful part of the ground. The exception is a business with a managed detection requirement, where somebody is paid to watch and act — that is a service rather than a product.

Is a home NAS enough as a backup?

A NAS on the same network is better than nothing and worse than you might think, because it is reachable from the compromised machine and a ransomware payload will try to encrypt what it can reach. Some NAS devices support snapshots or immutable volumes, which addresses that; check whether yours does, and if not, whether you can move the backup to a device that is not mounted during normal use.

What about cloud sync?

It is better than nothing and it has a specific weakness: synchronised folders propagate deletions and changes, so an encrypted file can be encrypted everywhere and the previous version may or may not survive depending on the retention policy. Versioned retention is the property to check. A tool that keeps prior versions for a set period, with the deletion of old versions itself delayed, turns ransomware into a recoverable inconvenience.

Do I need to worry if I am on a Mac?

Much less, and the difference is structural. macOS has historically made it substantially harder for malware to run with the privileges ransomware needs, and the platform's permission model and Gatekeeper prompt before running unrecognised software. The human-initiated arrival paths still exist — a convincing fake installer, a fake update prompt — so the tier-one controls still apply.

Should I pay the ransom if I am caught?

This is a decision with legal, financial and ethical dimensions and it depends on your circumstances, your jurisdiction and your insurer, so it is not one to answer generically. What is generally worth doing in advance is deciding the rule before you are in it: who is authorised, what the criteria are, and what the fallback plan is if payment is not an option. That decision is much harder to make under pressure, which is why it should be made now.

Bottom line

Most ransomware arrives through a person, and most of it can be stopped by things that cost nothing: multifactor authentication on your email, a password manager you actually use, not running as administrator, blocked script execution from messages, and current software. Add containment — restricted remote administration, segmented networking, controlled folder access — and you have addressed the majority of realistic scenarios. Security products contribute behaviour detection, exploit protection and rollback, which are worth having at the margin, and matter more for an organisation with a monitored-response requirement than for an individual. Then treat recovery as a separate budget: backups that cannot be reached from the network, versioned retention, a rehearsed restore, and a documented decision sequence. That combination — cheap prevention, containment, and real recovery — addresses far more than any product purchase on its own.

If you want to see what current security tooling costs, the link below goes to our own page for the category.

See current security tool plans →