Topic starter
25/06/2026 3:24 pm
TL;DR: Ransomware remains a major business risk, with more than $40 billion in projected 2024 losses for US firms, a median ransom jump from $200,000 to $1.5 million, and incidents such as Change Healthcare, British Library, and MGM Resorts showing how one compromised identity can still drive broad disruption, according to Imprivata. Access governance, not just recovery planning, determines how far ransomware can spread.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Stopping ransomware: Advanced safeguards for your organization”.
By the numbers:
- In 2024, ransomware is expected to cause more than $40 billion in losses for US businesses.
- The British Library said it would use about 40% of its reserves, roughly 6 to 7 million pounds, to recover from the attack.
Key questions
Q: What breaks when ransomware operators can reuse one compromised identity across multiple systems?
A: Containment breaks first.
Q: Why do privileged accounts make ransomware harder to contain?
A: Privileged accounts let attackers turn one foothold into broad operational access.
Q: How can security teams tell whether entitlement governance is actually reducing ransomware risk?
A: They should look for fewer dormant accounts, fewer unmanaged service identities, and fewer toxic access combinations that could reach backup, admin, or data systems.
Practitioner guidance
- Tighten lateral-movement paths Remove broad cross-system access from admin, vendor, and service identities so one compromised account cannot reach backups, shared services, and security tooling in the same path.
- Separate recovery from production access Use distinct credentials, approval paths, and administrative boundaries for backup and restore operations so ransomware operators cannot tamper with the recovery plane using production access.
- Reduce standing privilege Review elevated entitlements that remain active outside short maintenance windows and rework them into task-scoped access where possible.
Bottom line: Ransomware impact is amplified when identity controls allow one compromise to spread across systems, backups, and privileged tooling.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:55 pm
Ransomware is increasingly an identity blast-radius problem, not just a malware event. Once an attacker gains one usable identity, the practical question becomes how far that identity can move before containment. That changes the control objective from clean-up after encryption to limiting reach before encryption can spread. For IAM and PAM teams, the measure of success is not authentication alone but how tightly identity paths are segmented.
A question worth separating out:
Q: What is the difference between ransomware resilience and backup resilience?
A: Backup resilience asks whether data can be restored. Ransomware resilience asks whether the organization can restore trust, authority, and control fast enough to use those backups safely. Identity governance sits between the two because compromised sessions and over-privileged accounts can prevent recovery even when backups are intact.
👉 Read our full editorial: Ransomware exposure is still being amplified by identity gaps