Ransomware protection that assumes the worst

How ransomware beats ordinary backups

Modern ransomware does not encrypt your files the moment it arrives. It waits, looks around, and goes hunting for your backups first — because a business with a working backup does not pay. It finds mapped drives, network shares, NAS boxes with saved credentials, and any backup software it can log in to. Then it encrypts those, and only then does it encrypt you.

This is why so many businesses discover on the same morning that they have been hit and that their backup is gone too.

What actually stops it

• Separation. The backup copy is not on a drive letter, a share or a path that a compromised machine can reach.
• Credentials that do not sit on the machine. If the workstation cannot authenticate to the backup store, neither can what is running on the workstation.
• History that cannot be rewritten. Older versions are retained so that overwriting today does not destroy last week.
• Alerts on the strange. A sudden jump in changed data is often the first visible sign of encryption in progress.

The rule we design to

Three copies of your data, on two different kinds of storage, with at least one copy off-site and out of reach, and zero errors in the last restore test. The last part is the part everybody skips.

If it has already happened

Do not pay yet, and do not wipe the machines. Disconnect them from the network and call us. What is recoverable depends on what was reachable, and that is worth finding out before any money changes hands.