Topic starter
25/06/2026 3:23 pm
TL;DR: Ransomware can cost U.S. organisations more than $40 billion, with median payments rising from $200,000 in early 2023 to $1.5 million by July 2024, according to Imprivata. The real lesson is that identity controls, especially MFA, least privilege, and privileged access containment, are now central to ransomware resilience.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Stopping ransomware: Advanced safeguards for your organization”.
By the numbers:
- In 2024, ransomware attacks were projected to cause over $40 billion in losses for U.S. organizations.
Key questions
Q: What breaks when ransomware victims rely on backups without tightening identity controls?
A: Backups help restore data after encryption, but they do not stop attackers from reaching the systems that matter most.
Q: Why does least privilege reduce ransomware impact?
A: Least privilege reduces ransomware impact because it limits what a compromised identity can reach after the initial foothold.
Q: What are the signs that privileged access controls are not stopping ransomware activity?
A: Warning signs include unexplained privilege escalation, unusual lateral movement, abnormal session activity, and privileged commands that do not match normal administrative work.
Practitioner guidance
- Tighten MFA on high-risk paths Apply multifactor authentication first to administrator, remote access, vendor, and recovery accounts that can reach critical systems.
- Reduce standing privilege Remove always-on elevation from accounts that can administer endpoints, servers, backup platforms, and directory services.
- Segment backup access from production access Separate backup administration from routine user and server management so a compromised production credential cannot also tamper with recovery assets.
Bottom line: Ransomware remains a business continuity threat, but the article shows that identity reach is what determines how disruptive it becomes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:54 pm
Ransomware resilience is now an identity governance problem, not only a backup problem. The article is correct to elevate MFA, least privilege, passwordless access, and privileged access containment because ransomware operators typically exploit the gap between authentication and operational reach. Backups help recovery, but identity controls determine whether the attacker can turn a login event into enterprise disruption.
A few things that frame the scale:
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
Q: When should organisations prioritise identity controls over backup tooling for ransomware defence?
A: Identity controls should come first when the environment still relies on shared admin accounts, weak MFA, exposed third-party paths, or long-lived service credentials. Backups matter, but they do not stop the attacker from deleting recovery points or exfiltrating data before encryption if access governance is weak.
👉 Read our full editorial: Ransomware resilience depends on identity controls, not just backups