Why Ransomware Defence Is a Stack, Not a Single Product

Ask ten businesses how they protect themselves against ransomware and most will name a product. An antivirus, a firewall, perhaps a backup tool. Ask a security team the same question and you will get a different kind of answer: a stack.

That difference matters more in 2026 than it ever has. Ransomware has evolved into an extortion business. Attackers steal data before they encrypt it, threaten to publish it, and increasingly use AI to scale up the convincing lures that get them in. No single product covers that whole chain of events. Each layer of a proper defence exists because one of the others will eventually miss.

Here is what the stack looks like, layer by layer.

Prevention: stop threats before they spread

The foundation is modern endpoint protection with EDR or XDR capability: software that does not just block known malware, but watches for the behaviour of an attack in progress, such as mass file encryption or credential theft, and can isolate a machine automatically.

Prevention also means closing the doors attackers walk through. Most ransomware incidents still begin with a phishing email or an unpatched, internet-facing system. That makes two unglamorous disciplines enormously valuable: security awareness training for staff, and relentless patching.

Vulnerability management: eliminate the easy routes in

Patching works best when it is systematic rather than heroic. Automated patch management keeps operating systems and applications current without relying on someone remembering. Continuous vulnerability management closes the loop: it maintains a live view of the weaknesses across your environment and ranks what to fix first. This is exactly the job our Vikelus platform was built for. Attackers scan constantly; your visibility of your own gaps has to be at least as good as theirs.

Detection and response: someone watching, all the time

However strong the prevention layer is, some attacks get through. What decides the outcome is how quickly someone notices and acts. Ransomware operators favour nights, weekends and public holidays precisely because nobody is at the keyboard.

That is the case for 24/7 managed detection and response (MDR): expert analysts monitoring your environment around the clock, investigating suspicious activity and shutting attacks down while they are still small. We deliver this through Sophos MDR, which gives mid-sized businesses the kind of always-on security operation that used to be reserved for enterprises.

The new layer: your AI attack surface

The newest layer of the stack barely existed two years ago. Staff now use generative AI tools daily, which raises real questions: what company data is being pasted into them, which tools are sanctioned, and how are AI accounts secured? At the same time, attackers use AI to craft better phishing and impersonation at scale.

Securing this layer is partly policy (clear rules on approved tools and data handling), partly technology (identity and access controls around AI services) and partly training. If your business is adopting AI, protection needs to be adopted alongside it, not after the first incident.

Recovery: the layer that makes ransom demands negotiable

Every layer above can reduce the odds of a bad day. Recovery is what caps the damage when one arrives. Two properties matter most. Backups must be immutable, so an attacker who gets in cannot encrypt or delete them. And recovery must be tested, because a backup that has never been restored is a hope, not a plan. For systems your business cannot operate without, disaster recovery as a service (DRaaS) shortens the gap between "everything is down" and "we are running again" from days to hours.

We covered this in depth in a recent post on why backup plans fail; the short version is that recovery time, not backup frequency, is the number that decides how bad an incident gets.

Do not forget Microsoft 365

For most businesses, Microsoft 365 is where the crown jewels live: email, documents, Teams, identities. It needs both halves of protection. Security, meaning MFA, conditional access and email filtering. And backup, because Microsoft's built-in retention is not the same as an independent, restorable copy of your data. A surprising number of otherwise well-protected businesses still treat M365 as someone else's problem.

Why "unified" beats a pile of products

A stack is not the same as a sprawl. Six disconnected tools from six vendors create gaps between them, and gaps are where attackers live. The layers work best when they are managed together: the endpoint agent that spots trouble should inform the team doing response; the vulnerability view should drive the patching; the recovery plan should reflect what the monitoring actually protects.

That is the real argument for having one partner manage the stack end to end. Prevention, detection, response and recovery stop being separate purchases and become one working system.

The takeaway

If your ransomware defence is a single product, you have a single point of failure. Walk through the layers honestly: prevention, patching and vulnerability management, 24/7 detection and response, AI usage, recovery, and Microsoft 365. Most businesses find one or two layers missing entirely. Knowing which ones is the first step to fixing them.