--- title: The Five Controls That Decide Whether Ransomware Ruins You description: Not another threat-landscape piece. The five specific controls that separate a bad week from a closed business, and an honest note on what each one costs in effort. image: https://axcede.us/hubfs/Technician%20checking%20routers%20in%20server%20room.jpeg --- [![AxcedeWordMark-s](https://axcede.us/hs-fs/hubfs/Axcede/Logos/AxcedeWordMark-s.png?width=261&height=191&name=AxcedeWordMark-s.png "AxcedeWordMark-s")](https://axcede.us/home) - [About](https://axcede.us/about) - Services - [Managed IT](https://axcede.us/managed-it) - [App Development](https://axcede.us/app-development) - [Cybersecurity](https://axcede.us/cybersecurity) - [Cloud Hosting](https://axcede.us/cloud-hosting) - [Disaster Recovery](https://axcede.us/disaster-recovery) - Industries - [Medical](https://axcede.us/industries/medical) - [Retail](https://axcede.us/industries/retail) - [Law](https://axcede.us/industries/law) - [Accounting](https://axcede.us/industries/accounting) - [Education](https://axcede.us/industries/education) - Resources - [Blog](https://axcede.us/blog) - [Portfolio](https://axcede.us/portfolio) - [Contact](https://axcede.us/contact) [![Axcede Wordmark](https://axcede.us/hs-fs/hubfs/Axcede/Logos/AxcedeWordMark-s.png?width=624&height=191&name=AxcedeWordMark-s.png "Axcede Wordmark")](https://www.axcede.us) - Menu Item 1 - Sub-menu Item 1 - Another Item - Sub-menu Item 2 - Menu Item 2 - Yet Another Item - Menu Item 3 - Menu Item 4 [✕](https://axcede.us/blog/the-five-controls-that-decide-whether-ransomware-ruins-you#atbs-offcanvas-primary) #### Title text name text name text name text name #### Title text name text name text name text name search - There are no suggestions because the search field is empty. [✕](https://axcede.us/blog/the-five-controls-that-decide-whether-ransomware-ruins-you#atbs-offcanvas-mobile) [![Axcede Wordmark](https://axcede.us/hs-fs/hubfs/Axcede/Logos/AxcedeWordMark-s.png?width=624&height=191&name=AxcedeWordMark-s.png "Axcede Wordmark")](https://www.axcede.us) - Menu Item 1 - Sub-menu Item 1 - Another Item - Sub-menu Item 2 - Menu Item 2 - Yet Another Item - Menu Item 3 - Menu Item 4 #### EXPLORE MORE [Follow us on Facebook](https://www.facebook.com) [Follow us on LinkedIn](https://www.linkedin.com) [Follow us on Twitter](https://www.twitter.com) [![AxcedeWordMark](https://axcede.us/hs-fs/hubfs/AxcedeWordMark.png?width=185&height=191&name=AxcedeWordMark.png "AxcedeWordMark")](https://www.axcede.us) - [About](https://axcede.us/about) - Services - [Managed IT](https://axcede.us/managed-it) - [App Development](https://axcede.us/app-development) - [Cybersecurity](https://axcede.us/cybersecurity) - [Cloud Hosting](https://axcede.us/cloud-hosting) - [Disaster Recovery](https://axcede.us/disaster-recovery) - Industries - [Medical](https://axcede.us/industries/medical) - [Retail](https://axcede.us/industries/retail) - [Law](https://axcede.us/industries/law) - [Accounting](https://axcede.us/industries/accounting) - [Education](https://axcede.us/industries/education) - Resources - [Blog](https://axcede.us/blog) - [Portfolio](https://axcede.us/portfolio) - [Contact](https://axcede.us/contact) # The Five Controls That Decide Whether Ransomware Ruins You [Axcede](https://axcede.us/blog/author/axcede) 8 Sep 2026 [0 Comments](https://axcede.us/blog/the-five-controls-that-decide-whether-ransomware-ruins-you#comments) There is no shortage of writing about how ransomware is getting worse. There is much less about what actually determines the outcome once it happens to you. Having watched how these incidents go, the difference between a business that loses a week and a business that does not recover is rarely sophistication. It is usually five things, and they are the same five things almost every time. ## 1. Backups that are isolated and have been restored This is the control that decides everything else. If you can restore, you have a bad week. If you cannot, you are negotiating with criminals about your own data. Two details matter more than the backup product: **Isolation.** Modern ransomware looks for backups and encrypts them first. A backup on a mapped network drive, or on a NAS reachable with the same credentials as everything else, is part of the target. Backups need to be somewhere the compromised network cannot reach and cannot delete, whether that is immutable storage or genuinely offline copies. **Restore testing.** A backup that has never been restored is a hypothesis about a backup. Test restores catch the things nobody expects: the database that backs up mid-transaction, the application that needs a license key nobody kept, the restore that technically works and takes eleven hours per server. *Effort: moderate to set up, small to maintain. This is the one to do first if you only do one.* ## 2. Multi-factor authentication, everywhere that matters Most ransomware does not break in. It logs in, with credentials from a phishing page, an infostealer, or a password reused from a breached site. MFA removes almost all of that, which is why insurers now insist on it. The failure mode we see is not an absence of MFA but an incomplete rollout. Enabled on email, missing on the VPN. Enabled for staff, skipped for the administrator account because it was inconvenient. Attackers find the gap, because finding the gap is the entire job. Email, remote access, VPN, administrative accounts, and any cloud service holding real data. No exceptions for convenience, and especially not for admins. *Effort: small technically, moderate in change management. The complaints last about two weeks.* ## 3. Endpoint detection that someone is actually watching Antivirus asks "have I seen this file before." Endpoint detection and response asks "is this behavior normal," which is what catches an attacker using legitimate tools, as they generally do now. The word that carries the weight is *watching*. Ransomware deployment is usually the last step of an intrusion that has been underway for days or weeks. In that window the tooling generates alerts. Whether those alerts reach a human who acts on them at two in the morning is the difference between containing an incident and discovering one. *Effort: small to deploy, ongoing to monitor. Monitoring is the part businesses most often skip and most often regret.* ## 4. Network segmentation Flat networks are why one infected laptop becomes ninety encrypted machines. Segmentation limits how far an intrusion travels. The reception PC does not need to reach the server holding client files. The security cameras do not need to reach anything. The old machine running software that cannot be patched needs to be somewhere it can do the least harm. This is unglamorous and it is the control that most reliably converts a catastrophe into an inconvenience. *Effort: moderate, and disruptive to retrofit. Much cheaper to do alongside a network refresh than on its own.* ## 5. A plan that exists on paper At the point you need it, nobody is thinking clearly. Someone has to know who to call, in what order, with what authority. A workable plan is short and answers plain questions. Who decides to take systems offline? Who calls the insurer, and what is the number? Who tells clients, and what do they get told? Where are the backups and who can restore them? What is the minimum set of systems the business needs to function tomorrow morning? Print it. Keep a copy somewhere that does not depend on the network you just lost. *Effort: an afternoon. It is the cheapest item on this list and the most commonly missing.* ## What is deliberately not on this list Security awareness training is worth doing and we do not consider it a control you rely on. Every well-run business gets phished eventually. The point is that a click should not be able to end the company, so plan for the click landing. Likewise, nothing here is exotic. There is no threat intelligence platform and no AI-powered anything. These five are unfashionable precisely because they work, and because most of the businesses that get hurt badly were missing two or three of them. ## An honest assessment Almost nobody has all five properly in place. That is not a sales line. It is what makes the list useful, because you can read it and usually tell within a minute which two you are missing. If you want a second opinion on where you actually stand, [book a discovery call](https://axcede.us/discovery). We will tell you which of the five are solid, which are partial, and which are absent, in that order of usefulness. [0](https://axcede.us/blog/the-five-controls-that-decide-whether-ransomware-ruins-you#comments) RELATED ARTICLE ### May Be You Like ### [The Hidden Risk: Non-Human Identities and Why They Matter Now](https://axcede.us/blog/the-hidden-risk-non-human-identities-and-why-they-matter-now) September 16 2025 [Axcede](https://axcede.us/blog/author/axcede) ### [Your Cyber Insurance Renewal Is a Security Audit Now](https://axcede.us/blog/your-cyber-insurance-renewal-is-a-security-audit-now) July 14 2026 [Axcede](https://axcede.us/blog/author/axcede) ### [Still Running Windows 10? The Math Has Changed](https://axcede.us/blog/still-running-windows-10-the-math-has-changed) June 16 2026 [Axcede](https://axcede.us/blog/author/axcede) ### [Agentic AI: From Tool to Teammate](https://axcede.us/blog/agentic-ai-from-tool-to-teammate) August 19 2025 [Axcede](https://axcede.us/blog/author/axcede) ### Heading Title There are many variations of passages of Lorem Ipsum available, but the majority have suffered alteration in some form 1 ### [The Five Controls That Decide Whether Ransomware Ruins You](https://axcede.us/blog/the-five-controls-that-decide-whether-ransomware-ruins-you) [Read More](https://axcede.us/blog/the-five-controls-that-decide-whether-ransomware-ruins-you) 2 ### [You May Be Under the FTC Safeguards Rule Without Knowing It](https://axcede.us/blog/you-may-be-under-the-ftc-safeguards-rule-without-knowing-it) [Read More](https://axcede.us/blog/you-may-be-under-the-ftc-safeguards-rule-without-knowing-it) 3 ### [Your Cyber Insurance Renewal Is a Security Audit Now](https://axcede.us/blog/your-cyber-insurance-renewal-is-a-security-audit-now) [Read More](https://axcede.us/blog/your-cyber-insurance-renewal-is-a-security-audit-now) ![Axcede Wordmark](https://axcede.us/hubfs/AxcedeWordMark.png) Providing technology solutions for Southern California businesses: Orange County, LA, and surrounding areas. #### Contact Us - 2020 Main St. STE 1200 - Irvine, CA 92614 - Phone: (888) 390-6551 - Mail: info@axcede.us #### Company - [About](https://axcede.us/about) - [Contact Us](https://axcede.us/contact) ##### Newsletter Stay informed with the latest IT tips, trends, and updates from our team. [Follow us on Facebook](https://www.facebook.com/profile.php?id=61559302571408) [Follow us on LinkedIn](https://www.linkedin.com/company/axcede-corporation/) [Follow us on Instagram](https://www.instagram.com/axcede.us/) Axcede Corporation © All Rights Reserved ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Axcede", "url" : "https://axcede.us/blog/author/axcede" }, "dateModified" : "2026-09-22T00:51:31.421Z", "datePublished" : "2026-09-08T16:15:00.000Z", "headline" : "The Five Controls That Decide Whether Ransomware Ruins You", "image" : [ "https://axcede.us/hubfs/Technician%20checking%20routers%20in%20server%20room.jpeg" ], "mainEntityOfPage" : { "@id" : "https://axcede.us/blog/the-five-controls-that-decide-whether-ransomware-ruins-you", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://axcede.us/hubfs/Axcede/Logos/AxcedeWordMark-s.png" }, "name" : "Axcede Corporation" } } ```