Why Ransomware Defence Is a Stack, Not a Single Product

Ask ten businesses how they protect themselves against ransomware and most will name a product. An antivirus, a firewall, perhaps a backup tool. Ask a security team the same question and you will get a different kind of answer: a stack.

That difference matters more in 2026 than it ever has. Ransomware has evolved into an extortion business with a supply chain behind it. Access brokers sell footholds, affiliates run the intrusion, and the group that owns the encryption software takes a cut. Attackers steal data before they encrypt it, threaten to publish it, and increasingly use AI to scale up the convincing lures that get them in.

No single product covers that whole chain of events. Each layer of a proper defence exists because one of the others will eventually miss. The useful question is not "which product stops ransomware" but "at how many separate points in an attack could we interrupt it, and how quickly would we notice".

What a ransomware attack actually looks like from the inside

Encryption is the last thing that happens, not the first. By the time files start locking, the attacker has usually been in the environment for a while, quietly doing the work that makes the payload effective.

A typical intrusion runs roughly like this:

Initial access. A phished credential, a reused password found in a breach dump, a malicious attachment, or an unpatched service exposed to the internet such as a remote desktop gateway or a VPN appliance.
Foothold and persistence. The attacker installs something that survives a reboot, or simply keeps using the valid account they stole, which is far harder to spot.
Credential theft and privilege escalation. They harvest cached credentials and work towards a domain administrator or global administrator account.
Discovery and lateral movement. They map file shares, hypervisors, domain controllers and backup servers, moving between machines using legitimate administration tools.
Defence and backup sabotage. They try to disable endpoint protection, clear logs, and delete or encrypt backups. Backup infrastructure is a primary target, not an afterthought.
Exfiltration. Data is copied out, usually to ordinary cloud storage so the traffic looks unremarkable.
Encryption and extortion. The payload runs, often out of hours, followed by a ransom note that leans on both the outage and the threat of publication.

Every one of those steps is an opportunity. A layered stack is simply a defence that has something to say at more than one of them.

Attack stage	What the attacker needs	Layer that interrupts it
Initial access	A valid login or an unpatched service	Identity and access, email and web filtering, patching
Foothold and persistence	To run code and survive reboots	Endpoint detection and response
Credential theft	Local admin rights and cached credentials	Least privilege, privileged account separation
Lateral movement	Flat internal network, shared admin passwords	Network segmentation, unique local admin credentials
Backup sabotage	Write access to backup storage	Immutable backups, separate backup credentials
Exfiltration	Bulk outbound data transfer	Monitoring and response, egress controls
Encryption	Time, usually out of hours	24/7 detection, automated host isolation
Extortion	Your inability to recover	Rehearsed restore, incident response plan

The eight layers, and what each one really does

Every layer below has a hard limit. Being honest about those limits is the whole point of the exercise, because the gaps between layers are where attackers make their living.

1. Identity and access

Stolen credentials remain one of the most reliable ways into a business, and an attacker using a real account looks like an employee until they do something unusual.

Stops: password spraying, credential stuffing, and most opportunistic account takeover. Does not stop: an attacker who has already compromised a device with a live session, or a user who approves a push prompt they did not initiate. Good looks like: phishing-resistant multi-factor authentication on every account including administrators and service accounts, conditional access rules that consider device and location, no standing global administrator rights, and separate admin identities that are never used for email or browsing.

2. Email and web filtering

Intrusions still routinely start with a message. Filtering is the cheapest layer to improve and the easiest to over-trust.

Stops: bulk phishing, known malicious attachments and links, spoofed sender domains when SPF, DKIM and DMARC are properly configured. Does not stop: a well-written message from a genuinely compromised supplier mailbox, which carries no bad attachment and no bad link until the moment it does. Good looks like: filtering that rewrites and checks links at click time, DMARC moving beyond monitoring to enforcement, external sender warnings, and blocking the file types your business genuinely never needs to receive.

3. Endpoint detection and response

Signature-based antivirus catches what is already known. Modern intrusions use legitimate tools, so the detection has to be behavioural: mass file modification, credential dumping, suspicious process chains, shadow copy deletion.

EDR, XDR and MDR are capabilities rather than a specific product. EDR watches endpoints and records what happened. XDR correlates that with identity, email, network and cloud signals. MDR adds the people who read the alerts. Which combination is right depends on your environment and your budget, and there is no single platform that is correct for every business. What matters is that the capability exists and that somebody is accountable for acting on it.

Stops: the execution stage of most attacks, and it can isolate a host automatically before encryption spreads. Does not stop: anything on a device it is not installed on, which in practice means unmanaged laptops, older servers, hypervisors and network appliances. Good looks like: full coverage with no exceptions, tamper protection enabled so the agent cannot be switched off with local admin rights, and alerts going somewhere staffed rather than to an unread mailbox.

4. Network segmentation

Segmentation does not prevent an intrusion. It decides how expensive that intrusion becomes.

Stops: one compromised workstation turning into every server. It also contains the blast radius when something inevitably goes wrong. Does not stop: an attacker who has already obtained domain administrator credentials, who can often move wherever those credentials are honoured. Good looks like: management interfaces for hypervisors, switches and backup systems on a separate network that ordinary user devices cannot reach, guest and IoT traffic isolated, unique local administrator passwords per machine, and remote access through brokered, authenticated sessions rather than exposed remote desktop.

5. Patch and vulnerability management

Attackers scan the internet continuously and weaponise new vulnerabilities in internet-facing systems quickly. Your visibility of your own gaps has to be at least as good as theirs.

Stops: exploitation of known vulnerabilities, which is one of the routes attackers rely on for initial access. Does not stop: phishing, stolen credentials, or a genuinely new vulnerability with no patch available. Good looks like: automated patching for operating systems and third-party applications on a defined cycle, a much faster emergency path for internet-facing systems, continuous vulnerability scanning that produces a ranked list rather than a raw dump, and an accurate asset inventory, because you cannot patch what nobody knows exists.

6. Immutable backup and rehearsed restore

Recovery is the layer that turns a business-ending event into a bad week. It is also the layer attackers attack first.

Stops: the extortion leverage that comes from the outage itself. If you can restore, the encryption half of double extortion loses most of its power. Does not stop: the data theft half. A perfect backup does nothing about a copy of your client database sitting on a leak site. Good looks like: at least one copy that cannot be altered or deleted within its retention window, backup credentials that are not domain credentials, alerting on failed and unusually small jobs, and restores tested on a schedule with the time recorded. We went into the specific ways this fails in a separate piece on why backup plans fail when you need them, and the pattern is almost always the same: the backups existed, the restore had never been rehearsed. For the systems your business genuinely cannot trade without, managed backup and disaster recovery is what closes the gap between "the data is safe somewhere" and "we are running again".

7. Monitoring and response

Ransomware operators favour nights, weekends and public holidays precisely because nobody is at the keyboard. Prevention decides whether you get hit. Response time decides how much it costs.

Stops: an intrusion in progress, provided somebody sees it and has authority to act. Isolating three machines at 02:00 is a very different outcome from discovering the problem at 08:00 on Monday. Does not stop: anything, if alerts land in an inbox that is reviewed during office hours. Tooling without staffed response is expenditure, not defence. Good looks like: 24/7 monitoring with a defined escalation path, pre-agreed authority to isolate hosts and disable accounts without waiting for a meeting, log retention long enough to reconstruct what happened, and a written, rehearsed incident response plan that names who calls the insurer, who talks to clients, and who decides when systems come back.

8. The human layer

People are not the weakest link so much as the most targeted one. The goal is not zero clicks, which is unachievable, but fast reporting.

Stops: phishing, invoice fraud and pretexting that would otherwise land, particularly where staff are trained to verify payment changes out of band. Does not stop: a convincing, well-researched approach on a busy Friday afternoon. Somebody will eventually click. Good looks like: short, regular, role-relevant training rather than an annual video, simulated phishing used to find weak spots rather than to punish, a one-click report button, and a culture where reporting a mistake quickly is rewarded, because the minutes between the click and the report are the most valuable minutes you have.

The newest layer: AI inside your environment

Two years ago this was not a line item. Now staff use generative AI tools daily, which raises practical questions: what company data is being pasted into them, which tools are sanctioned, how are those accounts secured, and what can an AI assistant connected to your mailbox or file store actually reach if the account behind it is compromised. On the other side, attackers use AI to produce fluent, well-targeted lures at volume, which quietly removes the spelling mistakes and awkward phrasing that staff were trained to notice.

Securing this layer is part policy, part identity control and part training. If your business is adopting AI, the protection has to be adopted alongside it rather than after the first incident.

Microsoft 365 is the whole stack in miniature

For most South African businesses, Microsoft 365 holds the crown jewels: email, documents, Teams conversations and the identities that unlock everything else. It needs both halves of the stack. Security, meaning strong multi-factor authentication, conditional access, sensible sharing defaults and mailbox rule alerting. And backup, because the built-in retention Microsoft provides is not the same thing as an independent, restorable copy under your control. It is easy for an otherwise well-protected business to treat the tenant as somebody else's problem.

The POPIA dimension

Because modern ransomware steals before it encrypts, a ransomware incident in South Africa is usually a personal information incident too. Under POPIA, a responsible party that has reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person must notify the Information Regulator and, in most cases, the affected data subjects. That obligation does not disappear because you restored quickly from backup.

Practically, this means two things. First, your incident response plan needs a legal and notification workstream running in parallel with the technical recovery, not after it. Second, logging matters for more than detection: if you cannot tell which systems the attacker touched and what was copied, you will end up notifying on the assumption of the worst, which is more damaging and more expensive than notifying precisely.

Where to start if you are behind

Nobody builds all eight layers at once. Sequence them by how much risk each removes per rand spent:

Multi-factor authentication everywhere, administrators first, and remove standing privileged access.
Get every endpoint and server onto behavioural endpoint protection with tamper protection on, with no exceptions.
Make one backup copy immutable and test a real restore of one critical system, end to end, with a stopwatch.
Take internet-facing remote access behind authenticated brokered access and patch those systems on an emergency cycle.
Arrange out-of-hours monitoring and response, whether in-house or through a partner.
Write the incident response plan, then rehearse it around a table for an hour.
Segment management interfaces and backup infrastructure away from the user network.
Start regular, short security awareness training with a one-click reporting route.

A readiness checklist

Work through these honestly. Each is either true today or it is a gap. There is no partial credit.

Every user and administrator account requires multi-factor authentication, and administrators use phishing-resistant methods.
No day-to-day account holds standing global or domain administrator rights.
Endpoint detection and response is installed on 100% of endpoints and servers, with tamper protection enabled.
Security alerts are monitored outside business hours by someone with authority to isolate a machine.
At least one backup copy cannot be modified or deleted by any credential in the production domain.
A full restore of a critical system has been tested in the last six months and the recovery time was recorded.
Internet-facing services are inventoried, and critical patches for them are applied on an emergency cycle.
Local administrator passwords are unique per machine.
Backup, hypervisor and network management interfaces are not reachable from an ordinary user workstation.
A written incident response plan exists, names roles, and has been rehearsed in the last twelve months.
Staff have a one-click way to report a suspicious email and know that reporting is welcome.
You know who you would phone first, at 02:00 on a Sunday, if this happened tonight.

Anything on this list you cannot answer yes to is a gap. Knowing which ones is the whole point.

Why a managed stack beats a pile of products

A stack is not the same as a sprawl. Six disconnected tools from six vendors create gaps between them, and gaps are where attackers live. Nobody owns the space between the email filter and the endpoint agent, so the alert that would have joined the two never gets raised. That ownership problem is what managed cybersecurity services exist to solve: one team accountable for every layer, and for the seams between them.

The layers work best when they are managed together. The endpoint agent that spots trouble should inform the team doing the response. The vulnerability view should drive the patching schedule. The recovery plan should reflect what the monitoring actually protects. That coordination is the real argument for having one partner run the stack end to end, and it is the thinking behind how the layers fit together as a single defence system rather than a shopping list. Prevention, detection, response and recovery stop being separate purchases and start behaving like one working thing.

Frequently asked questions

If our backups are good, do we still need the rest of the stack?

Backups solve the outage. They do nothing about the stolen copy of your data, the notification obligations that follow, or the reputational damage of a leak site. Recovery is the layer that caps the damage, not the layer that prevents it. You still want the attacker stopped before exfiltration.

What is the difference between EDR, XDR and MDR?

EDR watches endpoint behaviour and gives you the ability to investigate and respond. XDR widens that view to include identity, email, cloud and network signals so related events can be correlated. MDR is the service layer: analysts who monitor, triage and act on what the tooling produces, around the clock. They are capabilities to be matched to your environment and budget rather than a single product decision, and the right answer for a thirty-person firm is not the right answer for a multi-site operation.

Should we ever pay the ransom?

It is a business and legal decision rather than a technical one, and it should involve your insurer and your legal advisers. What is worth knowing in advance is that payment buys a decryption tool of variable quality, not a guarantee, and it does nothing to un-steal data that has already left. The best position to negotiate from is not needing to.

How long do attackers stay in a network before encrypting?

It varies enormously, from hours in a smash-and-grab to weeks in a patient, hands-on intrusion. Assume it is long enough to be caught if somebody is watching, and short enough to matter if nobody is. That variability is precisely why detection and response time is the metric worth improving.

We are a small business. Is this realistic for us?

The layers do not change with size, but the implementation does. Multi-factor authentication, immutable backups and tested restores are within reach of any business. The parts that are genuinely hard to run in-house, particularly 24/7 monitoring and response, are the parts most commonly bought as a service. Start with the controls that remove the most risk for the least effort and build from there.

The takeaway

If your ransomware defence is a single product, you have a single point of failure. Walk the layers honestly: identity, email and web, endpoint detection and response, segmentation, patching, immutable backup and rehearsed restore, staffed monitoring, and your people. Then ask the only question that really counts. If it started tonight, at how many points would we interrupt it, and how quickly would anyone know?

This article is general information, not legal advice. POPIA decisions, correspondence with the Information Regulator and enforcement responses should be taken with a South African admitted attorney, and accountability rests with your Information Officer.