Topic starter
11/07/2026 1:58 pm
TL;DR: Ransomware attacks now cost organisations an average of $5.08 million, median dwell time is six days, and nearly half of attacks are surfaced by the adversary before defenders detect them, according to Zero Networks and cited research. The operational lesson is clear: prevention depends on containing identity misuse and lateral movement, not just improving detection.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “How to Protect Against Ransomware (2026 Guide)”.
By the numbers:
- Ransomware attacks cost organizations an average of $5.08 million, according to Zero Networks.
Key questions
Q: What breaks when ransomware operators can reuse one compromised identity across multiple systems?
A: Containment breaks first.
Q: Why do standing administrator rights increase ransomware and lateral movement risk?
A: Standing rights let a compromised identity do more without friction.
Q: How do organisations know whether ransomware identity controls are actually working?
A: Look for reduced privilege breadth, shorter-lived elevated sessions, and faster revocation when suspicious activity appears.
Practitioner guidance
- Define identity containment zones Separate critical systems into explicit access zones so a compromised account cannot move freely across the environment.
- Reduce standing administrative privilege Replace persistent admin rights with task-scoped elevation and remove broad permissions from service accounts that do not need them.
- Constrain lateral movement paths Block unnecessary east-west access, especially remote administration tools and file-sharing channels that attackers commonly abuse after initial access.
Bottom line: Ransomware now succeeds by abusing legitimate identity and admin pathways as much as by exploiting software flaws.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:07 pm
Identity containment has become the decisive ransomware control: modern ransomware succeeds when valid identity paths remain broad enough to move from one foothold to enterprise disruption. The problem is not that attackers always break authentication, but that organisations often let legitimate credentials, admin tools, and internal trust do the work for them. That makes containment a governance issue, not just a security control issue. Practitioners should treat identity path restriction as a core resilience objective.
A few things that frame the scale:
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
A: Segmentation should be prioritised alongside recovery because backups restore availability, but they do not limit what attackers can steal before detection. If the environment allows broad cross-domain access, the next intrusion can still turn a recoverable outage into a disclosure event.
👉 Read our full editorial: Ransomware protection in 2026 depends on identity containment