Over the last 18 months, our incident response team has led 200+ ransomware engagements across financial services, healthcare, manufacturing, and SaaS. We pulled the data, anonymized the findings, and looked for patterns. Here's what we found.
1. Initial access is overwhelmingly edge devices & identity
Of the 200 incidents we analyzed, 71% began with compromise of an internet-exposed edge device or stolen credentials. Specifically:
- 34% — exposed VPN concentrator or firewall without MFA
- 22% — Citrix / RDWeb / similar remote service
- 15% — valid credentials purchased on a marketplace (initial access broker)
- 11% — phishing with payload that bypassed email security
- 9% — exposed RDP with weak password
- 9% — supply chain / third-party (including MSP compromise)
Notably, zero-day exploitation accounted for fewer than 4% of incidents. The attackers aren't using zero-days because they don't need to — the basics are still wide open.
2. Median time-to-encryption: 4.2 days
From initial access to first file encryption, the median dwell time was 4.2 days. But the distribution was bimodal: 38% of incidents encrypted within 24 hours of access (often via automated playbooks), while 31% sat for 2+ weeks while the attacker conducted reconnaissance and exfiltrated data.
The takeaway: assume you have hours, not weeks, between detection and encryption. If your SOC can't triage and contain within 4 hours, you're in the bottom 40% of our dataset.
3. The controls that actually worked
We ranked defensive controls by their correlation with successful containment (defined as: encrypted < 5% of file servers AND recovered without paying ransom):
- EDR with managed response (CrowdStrike, SentinelOne, Defender) — 73% of well-tuned EDR deployments contained the attack in <1 hour.
- Immutable, offsite backups — 91% of victims with tested, immutable backups recovered without paying.
- Network segmentation — When lateral movement was contained to a single subnet, median time-to-encryption dropped to 11 minutes.
- MFA on all remote access — Reduced the "stolen credentials" vector to near zero.
- Email security with sandboxing — Reduced successful phishing to <5% of attempts.
4. The controls that didn't work
These were present in 80%+ of victim environments but did not stop the attack:
- Next-gen antivirus without EDR behavior analysis
- Email filtering without sandboxing
- "AI-powered" network detection that nobody tuned
- Annual vulnerability scans with no remediation SLA
- Phishing training with <10% click rate that's still 10%
5. Ransom payments: a 3x increase in 18 months
Median ransom demand rose from $2.3M (2024) to $7.1M (Q2 2026). Median payment rose from $850k to $2.4M. Notably, 41% of victims who paid still didn't recover all their data — the decryption tools were buggy, slow, or both.
Of the 200 incidents, 64% did not pay — most because they had tested, immutable backups. Of the 36% who paid, only 19% recovered fully within 30 days.
6. What to do this week
If you take one thing from this report: test your backups this week. Not "we have backups" — actually restore 10 random files and time it. If you can't do that in under 4 hours, you're in the highest-risk bucket.
Second priority: turn on MFA on every remote access path, including service accounts. Attackers don't brute-force MFA-protected endpoints; they move on to the next victim.
Third: deploy a properly-tuned EDR with 24/7 managed response. Not "we have CrowdStrike" — make sure the alerts are being seen by humans within minutes.
What's next
In part 2, we'll publish a detailed technical breakdown of the 12 most common ransomware playbooks we saw — with the specific detection engineering queries that catch each one. Subscribe to the Threat Brief to get it when it drops.
