The most consequential change in ransomware is that a growing share of it no longer encrypts anything. An intruder takes the data, proves they have it, and demands payment to keep it unpublished. Every control a business built around recovery, immutable backups, tested restores, documented failover, still works perfectly and answers none of the question being asked. That is the shift leadership teams have not absorbed: preparation that was correct in 2022 addresses the half of the problem that is receding, and the half that is growing is a disclosure and legal problem wearing a technical costume.
Overview: 5 Changes That Matter This Year
- Extortion without encryption is now common. Recovery capability does not resolve a threat to publish, so response planning needs a second track.
- Dwell time has compressed. Intrusion to impact is frequently hours rather than the weeks defenders once had, which moves value from detection to prevention.
- Attackers prefer your own tools. Remote management software, PowerShell and legitimate administrative utilities leave far less signal than malware does.
- Backup infrastructure is a primary target. It is attacked first and deliberately, because removing recovery is what creates the leverage.
- Insurers now dictate controls. Multifactor, endpoint detection, immutable backup and tested response plans have moved from advice to conditions of cover.
What Actually Changed
The threat has professionalised rather than intensified in some abstract sense. Understanding which specific things moved is what separates useful preparation from another checklist. Our cybersecurity practice sees these three shifts consistently.
Encryption became optional, and often unnecessary
Encrypting a network is noisy, technically demanding, and increasingly unprofitable, since a business with working backups simply restores. Stealing data is quieter, easier and produces leverage that backups cannot touch. Many groups now run exfiltration only, and others encrypt as a secondary step after the data is already gone.
There is an argument that this makes attacks less damaging, and in one narrow sense it does. Operations often continue uninterrupted, staff keep working, and there is no outage to explain.
What replaces it is worse in other respects. The business faces notification obligations, client contracts with disclosure clauses, and a counterparty holding material it can release at any moment. No technical control resolves that once the data has left, which is why the preventive controls, and knowing quickly that data moved, now carry the weight that restore capability used to. Our guidance on incident response team roles covers who owns that decision, because it is not an IT decision.
The window between entry and impact has closed
Intrusions that once dwelled for weeks while attackers explored now move to impact in hours. The industrialisation of access, with one group selling entry to another that specialises in extortion, removed most of the exploratory phase.
Some argue this makes detection worthless. That overstates it, since fast detection still contains an attack that would otherwise widen.
The honest implication is a shift in weighting. When the window is hours, controls that prevent entry and limit movement, multifactor everywhere including remote access, tight administrative privilege, network segmentation, do more than a detection programme tuned for a leisurely hunt. Patch velocity matters for the same reason, and the discipline behind it is set out in our vulnerability management process guidance.
Attackers use your administrative tools rather than their own
Malware is detectable. A legitimate remote management agent, already installed and trusted, is not. Intruders increasingly operate with the tools your own administrators use, which means the signal is not a suspicious file but an administrator account doing something slightly unusual at an unusual hour.
The counterargument is that behavioural detection handles this, and modern platforms genuinely do better than signature matching ever could.
The limit is that behaviour is judged against a baseline, and most environments have a noisy one: shared administrative accounts, scripts run by hand, third party vendors connecting irregularly. Tightening that baseline, unique administrative identities, controlled vendor access, predictable maintenance patterns, is what makes behavioural detection work.
One consequence is worth stating plainly to anyone reviewing a security budget. Cleaning up administrative hygiene is unglamorous work with no product attached, and it raises the value of every detection tool already bought. A platform watching an environment where four people share one administrator account cannot distinguish the legitimate use from the illegitimate one, because from its side they are the same principal doing similar things. The same platform in an environment with named administrative identities and scheduled maintenance windows is suddenly able to flag the account that logged in at 03:00 from an unfamiliar location. Nothing about the tool changed. The signal it was given did. The tooling side is covered in our review of AI cybersecurity tools, and the human side, particularly for remote staff, in common remote workforce security mistakes.
What This Means for How a Business Prepares
Three adjustments follow, and none requires abandoning what is already in place.
Keep the recovery plan and add a disclosure plan
Everything built for restoration remains necessary, since encryption has not disappeared. What has to be added is the other track: who decides whether an incident is notifiable, on what advice, within what deadline, and who speaks to clients. Those questions take days to answer under pressure and an afternoon to answer in advance.
Write down which regulator or contractual clock applies to your data, who your counsel is, and what your insurer requires you to do before engaging anyone. Businesses that have this on one page respond in hours, and those that do not spend the first day assembling the people rather than making decisions.
Client contracts are the part most often missed, because the obligations sit in agreements signed by different people in different years. Many enterprise contracts now carry notification clauses shorter than the regulatory ones, sometimes 24 or 48 hours from awareness, and a business meeting its regulator’s deadline can still breach a commercial one it forgot it had made. Pull the notification clauses from your ten largest client agreements into a single sheet, with the shortest deadline at the top. It is an afternoon of reading, and it produces the actual clock you are running against, which is usually tighter than anyone assumed. Our business continuity and disaster recovery team builds both tracks together for that reason.
Assume the backup platform is a target, not a refuge
Attackers reach backup infrastructure deliberately and early. Immutable storage, a backup identity separated from the production domain, and multifactor on the backup console are the controls that decide whether recovery survives contact.
Some teams treat this as covered by having offsite copies. Offsite is not offline, and a copy reachable with domain credentials is reachable by whoever holds them. The distinction is worth checking rather than assuming, because it is the single point where preparation most often turns out to be weaker than believed.
There is a second reason to look at the backup platform specifically, which is that it holds a complete copy of everything worth stealing, indexed and convenient. An intruder who reaches it does not need to move through the estate finding data, because the data has already been collected for them. That reframes the console from a recovery tool into one of the highest value targets you operate, and it argues for treating its access the way you would treat a domain controller rather than as infrastructure that quietly runs in the background.
Know what left, not just that something did
The question asked within hours of an extortion demand is which records were taken, and most businesses cannot answer it. Attackers name a volume and show a sample, and the business has no independent way to confirm the claim, which means every downstream decision, notification scope, client conversations, insurer engagement, rests on the word of the counterparty.
Some argue the scope hardly matters, since a business will notify broadly when uncertain. That is a defensible posture and an expensive one: over-notification damages client relationships that a narrower, accurate statement would have preserved.
Closing the gap is ordinary instrumentation done in advance. Egress logging retained long enough to cover a realistic discovery delay, records of which accounts touched which repositories, and a data inventory good enough to say what lives where. None of it stops an attack. All of it converts an unanswerable question into a bounded one, and it is worth far more at hour six than at the planning meeting where it always loses to something more visible.
Rehearse the decisions, not the restore
Most tabletop exercises test the technical recovery, which is the part with an owner and a runbook. The decisions that actually stall a response are commercial: whether to engage the attacker at all, who signs off on notification, what is said to the largest client, whether the insurer has been told in time to preserve cover.
Run one exercise a year on that half, with the people who would really be in the room and no technical detail at all. Give them the realistic version, data taken, nothing encrypted, a 72 hour deadline, and see where the conversation stops. In our experience it stops at the same two places every time: nobody is certain who has authority to authorise a payment, and nobody knows the notification clock. Both are answerable in an afternoon and neither gets answered without the exercise that exposes them.
Treat insurance requirements as a floor rather than a target
Cyber insurers now require specific controls as conditions of cover, and applications ask detailed questions about them. Meeting those requirements is necessary, and treating them as the finish line is a mistake, since they describe a minimum that an insurer can price rather than a posture that stops an intrusion.
Where they help is internal. A requirement in a policy document moves a budget conversation that advice alone had not moved for two years. Use that, and be accurate in the answers, because a claim assessed against an inaccurate application is a second loss on top of the first. Accuracy also has a maintenance dimension that catches people out: a control described as in place at renewal has to still be in place a year later, and configurations drift quietly. Whoever signs the renewal should be reading a current verification rather than last year’s answers, which means somebody has to check the controls before the form is completed rather than after a claim is made. Ongoing monitoring against those commitments is part of what managed security services exist to provide.
Frequently Asked Questions
If we have good backups, are we still exposed?
Yes. Backups resolve encryption and do nothing about stolen data. A growing share of extortion involves no encryption at all, so a business can restore in an hour and still face a demand backed by a threat to publish.
Should a business ever pay?
It is a decision for leadership with legal and insurance advice, never an IT decision, and payment guarantees nothing: data is sometimes published anyway and the same business is often targeted again. Decide the position in advance so it is not being argued for the first time during an incident.
How quickly do attacks move now?
Frequently hours from initial access to impact, rather than the weeks common a few years ago. That compression is why preventive controls and privilege limits have gained weight relative to detection tuned for a long hunt.
What single control gives the most protection?
Multifactor authentication everywhere, including remote access, administrative accounts and the backup console. Credential based entry remains the most common route in, and enforcing it comprehensively closes more paths than any other single measure.
Does cyber insurance cover extortion payments?
Cover varies and is conditional. Policies increasingly require specific controls to be in place, exclude certain circumstances, and demand notification before any engagement with an attacker. Read the conditions before an incident rather than during one.
How do we verify what an attacker claims to have taken?
You verify it against your own records rather than against their sample. Egress logging, access records showing which accounts touched which repositories, and a data inventory are what let you bound the claim. Without them the scope of any notification rests entirely on the counterparty’s description, which is not a position to be in when a disclosure deadline is running.
Who should be in the room when this happens?
Leadership, counsel, whoever owns the insurance relationship, and one technical lead, with a named deputy for each. The decisions that stall a response are commercial rather than technical, and assembling those people for the first time during an incident costs most of the first day.
Is a tabletop exercise worth the time?
Yes, if it tests the decisions rather than the restore. Run the realistic scenario, data taken and nothing encrypted, with a short deadline, and note where the conversation stops. Two gaps surface almost every time: nobody is certain who can authorise a payment, and nobody knows the shortest notification clock.
The Team Behind This Guidance
Our team has worked incidents on both sides of this change, the ones where a restore ended the problem and the ones where it did not touch it. What has shifted in our advice is not the technical controls, which remain what they were, but where the unprepared part of a business now sits: in who decides on disclosure, on what timetable, with whose advice. Matt Rosenthal, our chief executive, keeps the practice focused on operational resilience for growing firms, which here means a response plan with two tracks rather than one built entirely around getting systems back.
Answer Two Questions This Week
First, if data left your network tonight and nothing was encrypted, who decides whether it is notifiable and by when. Second, can your backup platform be reached with production domain credentials. Both take an afternoon to establish and both are load bearing, and most businesses find the first has no owner and the second has an uncomfortable answer.
Neither question needs a budget or a project to answer, which is what makes them a reasonable place to start. If you want help working through either, or a review of where your current preparation assumes an encryption event that may not be the one you get, book a free strategy call with our team.
