Free white paper · Secure
The Ransomware Vaccine
A plan your IT team or MSP can run to make ransomware much harder to pull off, and recoverable if it lands.
- Format
- Length
- 10 pages
- Size
- 160 KB
- Version
- Version 2.0
Who it's for
Written for
IT managers and MSPs are the primary audience, but it is written so business leaders can follow it. The idea: hand it to your technical team and say, "Run this playbook, tell me where we stand, and give me a plan to close the gaps."
What's inside
- Two questions for leaders. How likely is a ransomware event, and how ready are we to recover? Plus what changed in version 2.0.
- Start with the Big 3. Why exploited vulnerabilities, stolen credentials and phishing come first, backed by the 2026 Verizon DBIR and Sophos State of Ransomware data.
- Phase 1: the Big 3. External exposure, identity and device trust (phishing-resistant MFA, current NIST password rules, infostealer response), and phishing and social engineering, including help desk checks.
- Phases 2 to 4. Email and endpoint protection, privileged access, and internal vulnerability management with patch deadlines based on CISA's Known Exploited Vulnerabilities catalog.
- Phases 5 and 6. Backups attackers can't delete, tested every quarter, and a one-page "suspected ransomware" playbook with a who-to-call list.
- Phase 7: scorecard and validation. Score each phase from 0 to 10 against written anchors, set targets and report to leadership.
- Checklist, glossary and sources. A one-page checklist (Yes, In progress, No, Not applicable), plain-English definitions, and the sources behind every figure.
Key takeaways
- Start with the Big 3: exploited vulnerabilities, stolen credentials and phishing. The two largest 2026 studies rank them differently, but both put these three on top.
- Put MFA on everything reachable from outside, including VPNs, firewall consoles and backup consoles, and move admins and remote access to phishing-resistant methods such as passkeys or security keys.
- Patch by risk: 3 days for known exploited flaws on internet-facing systems, 14 days for other known exploited flaws, and a monthly cycle for the rest.
- Keep at least one backup copy that is immutable or offline, behind separate credentials, and test restores every quarter, including one full system.
- Score each phase from 0 to 10, set a target, and put the scorecard in front of leadership at least once a year. Quarterly is better.
Summarised from version 2.0 of the document. Use the download button at the top of the page for the full detail and sources.
Related offering
Secure
Cybersecurity Benchmark & 12-Month Roadmap
“How likely is a ransomware event, and how ready are we to recover?”
Talk to a Principal Engineer about this
Worked through the checklist, or want an outside view of where you stand? A Principal Engineer will help you decide what to fix first. Thirty minutes, no slide deck.