Topic starter
12/07/2026 12:19 pm
TL;DR: Ransomware remains a dominant enterprise threat because delivery, credential theft, and exfiltration now combine with weak identity controls, according to GlobalSign and the wider industry research it cites. The real problem is not just encryption, but the access pathways that let attackers expand impact once they are inside.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “¿Qué es el ransomware?”.
By the numbers:
- Cybersecurity Ventures predicted in 2023 that one organisation will face a ransomware attack every 2 seconds by 2031, according to GlobalSign.
Key questions
Q: What fails first when ransomware reaches valid user accounts?
A: The first failure is usually trust in normal authentication.
Q: Why do stolen credentials make ransomware outbreaks harder to contain?
A: Stolen credentials matter because they turn the attacker into a valid user, which often bypasses basic trust checks.
A: The ability to keep critical operations running while an extortion campaign is active or recover quickly after impact.
Practitioner guidance
- Harden email entry points against phishing Require phishing-resistant authentication where possible, block risky attachment and link patterns, and monitor mailbox rules that redirect or hide suspicious messages.
- Reduce the value of stolen credentials Shorten session lifetime, remove unnecessary standing privilege, and segment admin access so a single captured account cannot reach critical data tiers.
- Tie incident response to identity revocation Make account disablement, token revocation and privileged session termination part of the first containment wave, not a post-incident cleanup step.
Bottom line: Ransomware is an access problem as much as a malware problem, because phishing and stolen credentials often determine how far an attack spreads.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:33 pm
Ransomware persistence is now an identity governance problem, not just a malware problem. The article shows that delivery, credential theft and exfiltration are linked stages, which means account control determines whether an initial infection becomes enterprise compromise. Backup and recovery matter, but they do not stop an authenticated attacker from moving through the environment. The practitioner conclusion is that identity governance must be measured as part of ransomware resilience.
A question worth separating out:
Q: When should organisations prioritise identity controls over backup tooling for ransomware defence?
A: Identity controls should come first when the environment still relies on shared admin accounts, weak MFA, exposed third-party paths, or long-lived service credentials. Backups matter, but they do not stop the attacker from deleting recovery points or exfiltrating data before encryption if access governance is weak.
👉 Read our full editorial: Ransomware persistence and identity weaknesses in enterprise defenses