Notifications
Clear all
Topic starter
12/07/2026 12:19 pm
TL;DR: Ransomware remains a dominant enterprise threat because delivery, credential theft, and exfiltration now combine with weak identity controls, according to GlobalSign and the wider industry research it cites. The real problem is not just encryption, but the access pathways that let attackers expand impact once they are inside.
NHIMG editorial — based on content published by GlobalSign: a ransomware explainer covering delivery methods, attack stages, costs, and prevention guidance
By the numbers:
- In 2023, Cybersecurity Ventures predicted that one organisation will fall victim to a ransomware attack every 2 seconds by 2031.
- In the first half of 2024, the average ransom demand per attack was more than 5.2 million dollars.
Questions worth separating out
Q: What breaks when ransomware attackers get valid credentials instead of exploiting a vulnerability?
A: When attackers authenticate with stolen credentials, perimeter controls lose most of their value because the session looks legitimate.
Q: Why do weak access controls make ransomware worse?
A: Weak access controls let a single phishing event turn into broader compromise because the attacker can reuse access, discover more systems, and reach sensitive data or recovery resources.
Q: How do organisations know whether ransomware identity controls are actually working?
A: Look for reduced privilege breadth, shorter-lived elevated sessions, and faster revocation when suspicious activity appears.
Practitioner guidance
- Harden email delivery paths Use phishing-resistant authentication, attachment filtering, and URL inspection to reduce the chance that email becomes the initial ransomware delivery mechanism.
- Reduce credential reuse and standing access Review user, admin, and service account entitlements for unnecessary standing privilege, especially where one account can reach backups, file shares, or cloud consoles.
- Segment recovery systems from production identity paths Separate backup administration, recovery credentials, and incident response access from normal production authentication flows.
What's in the full article
GlobalSign's full article covers the operational detail this post intentionally leaves for the source:
- A step-by-step ransomware lifecycle breakdown from initial delivery through credential access, exfiltration, and extortion.
- Cost figures and incident examples that help teams frame ransomware risk for leadership and recovery planning.
- Practical prevention measures covering audits, incident response, backup recovery, monitoring, and workforce training.
- Identity and access management controls discussed in the source, including mobile/user access controls and authentication support.
👉 Read GlobalSign's ransomware explainer and prevention guidance →
Ransomware delivery and identity gaps: what teams need to address?
Explore further
12/07/2026 12:33 pm
Phishing remains the front door, but credential governance determines whether ransomware becomes a major incident. The article correctly places phishing at the start of the chain, yet the deeper problem is that stolen or weak credentials often turn a single click into internal reach. For IAM and PAM teams, the practical issue is not just user awareness. It is whether access pathways are segmented tightly enough that one compromised account cannot become a launch point for lateral movement.
A question worth separating out:
Q: Who is accountable for ransomware containment when identity controls fail first?
A: Accountability sits with the teams that own identity, privilege, and directory governance together, not with endpoint security alone. If identity telemetry, PAM policy, and AD visibility are not aligned, the organisation has no reliable control boundary to stop escalation. NIST CSF and internal resilience governance should reflect that shared responsibility.
👉 Read our full editorial: Ransomware persistence and identity weaknesses in enterprise defenses
