Ransomware Readiness – How can organizations protect themselves?

Ransomware attacks have remained a significant threat for many years now. According to Verizon’s 2025 Data Breach Investigation Report, Ransomware was involved in 88% of data breaches at small and medium firms and 39% at large firms. Such Ransomware incidents can cause operational disruptions and result in substantial recovery and remediation costs.

Unfortunately, no set of security controls can guarantee complete protection against every ransomware attack. This means that an organization has to be ready and plan for such a scenario by not only investing into security defenses, but also implementing and managing incident response and disaster recovery plans.

This is not a pessimistic view, but a realistic approach to todays security landscape. It follows the “assume breach” principle, which is also a fundamental concept of the Zero Trust security model: instead of focusing solely on preventing attacks, organizations should also be prepared to detect, contain and recover from a compromise.

There has also been a shift away from traditional destructive ransomware, which focused on encrypting data and disrupting business operations, toward extortion-based attacks. In these attacks, threat actors exfiltrate (steal) sensitive data and then demand payment in exchange for not publishing or selling the stolen information.

For defenders, this means that attackers are increasingly adopting stealthier techniques to avoid detection and remain undetected within the environment for longer periods, which is why improving the detection and response capabilities has become even more important.

Is your company prepared for such an incident? Are detection capabilities in place to identify such an attack early? Are disaster recovery plans in place to enable rebuilding from a worst-case scenario, and is their effectiveness regularly tested? The answers you can find with a ransomware readiness assessment.

Our ransomware readiness assessment can help you to get an overview of the current situation, assess and verify your defenses and provide simulated ransomware attacks in a Purple Teaming approach. Based on the maturity of your environment and the results of previous security assessments or penetration tests, we tailor the project’s approach and scope to your specific needs.

Workshop-Based Assessment
In Interview-based workshops, we evaluate the processes, policies and instructions with key IT and SOC stakeholders. The goal is to assess how people actually work in practice. The operational effectiveness is reviewed by verifying whether security controls are not only designed correctly but also followed consistently in day-to-day activities. In addition, interviews are useful to assess awareness, revealing whether employees understand their responsibilities, applicable processes, and security expectations.

Topics include:

• Asset and Risk Management
• Network Architecture
• Patch Management
• User and Access Management
• Privileged access and admin tiering model
• Password hygiene
• Backup and Recovery
• Logging and Monitoring
• Incident Response.

Configuration Review Assessment
Configurations of relevant components and services are assessed to ensure that they are hardened according to best practices.

This includes for example:

• Email gateway services
• Identity and Access
• Management solutions
• End user workstations
• User and computer policies
• File sharing services

Technical Penetration Testing
In addition to reviewing processes and configurations, technical penetration testing helps identify potential attack paths from both an external attacker’s perspective and an internal scenario (e.g., assuming compromise of a workstation). This approach highlights how an attacker could move through the environment, escalate privileges, and reach critical assets once an initial foothold has been gained.

Ransomware Attack Simulation (Purple Team Exercise)
To verify the detection and response capabilities, different attack scenarios are simulated by 2NS’ Red Team in close collaboration with the Blue Team (SOC). The scenarios are planned together with the customer and the SOC to ensure they are tailored to the organization’s specific environment, including its infrastructure, services, and threat landscape.

Ransomware is a significant threat to organization’s security, but there are several measures that can be taken to reduce the risk of a successful ransomware attack. Our ransomware readiness assessment provides a comprehensive view of an organization’s ability to prevent, detect and respond to ransomware attacks. It helps identify security gaps, validate existing defenses and, where needed, test the organization’s readiness through simulated ransomware attack scenarios.

Would you like to hear more about ransomware readiness assessment?

Ville Koch, Principal Security Specialist, 2NS Cybersecurity