In short
- The intrusion finishes days before anything encrypts
- Living-off-the-land technique defeats detection tuned for malware
- MFA, least privilege, segmentation and immutable backups do the real work
- Measure readiness by how long a real restore took, not by whether a plan exists
Modern ransomware rarely triggers signature detection, because it is rarely a signature. The encryption stage increasingly uses tooling already present on the host, and the operator has usually been inside for days before anything is encrypted.
Why endpoint detection alone under-performs
- Living-off-the-land technique uses signed, legitimate system binaries
- Credential theft and lateral movement look like ordinary administration
- Backups and shadow copies are removed before encryption begins
- Detection tuned for malware misses an operator behaving like an admin
By the time files start encrypting, the interesting part of the intrusion finished several days ago.
What actually stops it
The effective controls are unglamorous and mostly already inside your existing licences: multi-factor on every remote access path, restricted local administrator rights, segmentation that limits how far one compromised host can reach, and backups an operator with domain rights cannot delete.
Then monitor for the precursor behaviour — credential dumping, unusual service creation, backup deletion — rather than only for the payload. Those events give you days of warning instead of minutes.
Test the recovery, not the plan
An untested backup is a hypothesis. The only meaningful measure of ransomware readiness is how long a full restore actually took the last time you performed one, and most organisations have never measured it.
