Topic starter
10/07/2026 9:11 pm
TL;DR: Ransomware now drives operational downtime by design, with the article citing 49% growth in active groups in 2025, average losses above $5 million, and attack chains that move from initial access to escalation and lateral movement before systems fail, according to Zero Networks. Containment, not detection alone, is the decisive control when stolen credentials and fast-moving intrusions can reach critical infrastructure in seconds.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “How to Stop Ransomware Before It Disrupts Operations”.
By the numbers:
- Active ransomware groups surged 49% year over year in 2025.
Key questions
Q: What breaks when ransomware can move laterally after one endpoint is compromised?
A: Containment breaks, because one compromised identity can reach the systems that keep the business running.
Q: Why do stolen credentials make ransomware outbreaks harder to contain?
A: Stolen credentials matter because they turn the attacker into a valid user, which often bypasses basic trust checks.
Q: How do microsegmentation and just-in-time access work together against ransomware?
A: Microsegmentation limits where an attacker can go, while just-in-time access limits when a credential can be used for sensitive paths.
Practitioner guidance
- Block east-west movement by default Make internal communication explicitly allowlisted so a compromised workstation cannot reach domain controllers, backup infrastructure, or production services.
- Remove standing privileged reachability Replace broad always-on administrative access with just-in-time access that is time-bound and protocol-bound for RDP, SMB, WinRM, and SSH.
- Scope identity-based access to operational need Constrain both human and machine identities so valid credentials do not function as all-access passes across business-critical environments.
Bottom line: The article shows that ransomware becomes a business outage when attackers can move laterally into systems that support operations, recovery, and continuity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:34 pm
Ransomware containment is now a network governance problem, not just an endpoint detection problem: The article shows that the decisive failure point is internal movement after the first foothold, because that is when disruption becomes inevitable. Detection can confirm compromise, but it does not stop the attacker from reaching systems that sustain operations. Practitioners should read this as a blast-radius issue first and a malware issue second.
A few things that frame the scale:
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
Q: Should organisations prioritise containment or prevention for ransomware?
A: They should do both, but containment deserves priority when exposure is unavoidable. Prevention reduces the chance of compromise, while containment determines whether one successful intrusion becomes a business-ending event. In modern opportunistic ransomware, the second control often decides the real outcome.
👉 Read our full editorial: Ransomware containment depends on blocking lateral movement