Ransomware readiness for mid-market organizations: what to fix first

Start from the outcome, not the tool list

Ransomware readiness is often sold as a product category. In practice it is a question with a short answer: if every server and laptop in your environment were encrypted tonight, how long until the business is operating again, and what would you have lost? Everything below is ordered by how directly it improves that answer.

Mid-market organizations face the same tactics as large enterprises with a fraction of the staff. That makes sequencing the real skill. Spend the first quarter on the controls that remove the attacker's leverage, and defer the ones that merely add visibility.

Be candid about trade-offs when you brief leadership. Immutable backups and administrative tiering consume engineering time, not just license budget, and they compete with feature work. Frame them as insurance with a measurable payoff: a recovery time you have actually timed, and an attack path you have visibly shortened. Executives fund what they can see being tested, so bring the restore-test result to the meeting rather than the product brochure.

Protect recovery before anything else

Attackers know that backups are your alternative to paying, so they hunt for them early. A backup that is reachable with the same credentials as production is not a safety net. Treat recovery capability as the first control you harden.

• Keep at least one copy that is immutable or offline, and make sure no domain admin account can delete it.
• Separate backup administration from your directory. Use dedicated accounts with multi-factor authentication and no daily-use privileges.
• Back up identity infrastructure (Active Directory, Entra ID configuration, DNS, certificate services), not just file servers and databases.
• Test a full restore of your most critical system and record the elapsed time. That number is your real recovery time, whatever the policy says.

Close the doors attackers actually use

Most intrusions begin with stolen credentials, a phishing message that lands on an unprotected device, or an exposed remote-access service. Address those three paths in that order.

• Enforce phishing-resistant or at minimum app-based multi-factor authentication for all remote access, email, and every administrative role.
• Inventory everything reachable from the internet, including forgotten VPN appliances and remote desktop gateways, and patch or retire it. Prioritize items on CISA's Known Exploited Vulnerabilities catalog.
• Remove local administrator rights from standard users and unique-ify local admin passwords so one compromised laptop cannot unlock the fleet.
• Block macros from the internet and restrict script interpreters where the business does not need them.

Limit how far an intruder can travel

Ransomware operators rarely encrypt on day one. They spend days or weeks moving laterally, escalating privileges and staging data. Your goal is to make that journey slow and noisy.

Tier your administrative accounts so that a workstation compromise never exposes a domain-level credential. Segment the network so that user devices cannot talk directly to servers on management ports, and so that backup systems, hypervisors and identity systems sit in their own protected zones. Segmentation does not need to be perfect to be valuable; separating the three or four crown-jewel zones captures most of the benefit.

Detect behavior, not just malware

Endpoint protection that only matches known malware will miss an attacker using legitimate tools. Map your detection coverage to the MITRE ATT&CK techniques that precede encryption: credential dumping, remote service execution, disabling of security tooling, deletion of shadow copies and unusual mass file access.

Detection only matters if someone responds at 2 a.m. If you do not staff round-the-clock monitoring, decide deliberately how alerts reach a person who can isolate a host within minutes, and write that path down. Our 24/7 monitoring teams treat host isolation authority as a pre-agreed decision rather than something to negotiate during an incident.

Pair monitoring with a short list of pre-approved containment actions: isolating an endpoint, disabling an account, blocking an address range, revoking sessions. Each action should say who may trigger it, what it breaks, and how it is reversed. When those decisions are made in advance, response takes minutes rather than a conference call.

Write the plan and rehearse it

An incident response plan that has never been exercised is a hypothesis. Keep it short enough to use under stress: who declares an incident, who can authorize shutting down systems, who talks to counsel, insurers, regulators and customers, and where the out-of-band contact list lives (not on the file server that may be encrypted).

Run a tabletop exercise twice a year with executives in the room. Use a realistic scenario, such as encrypted hypervisors plus a threat to publish stolen data, and record the decisions that stalled. Each stall becomes a line item on the next quarter's plan.

A ninety-day sequence

If you need a starting point, work in this order: days 1 to 30, immutable backups, restore test and multi-factor authentication on remote access and administrators; days 31 to 60, internet exposure cleanup, admin tiering and local administrator hardening; days 61 to 90, detection coverage review, response authority and a first tabletop. Revisit the sequence against the NIST Cybersecurity Framework functions (Identify, Protect, Detect, Respond, Recover) so you can show a board where each investment lands.