The Reality Check
59% of organizations were hit by ransomware last year (Sophos 2024). Average ransom payment: $2M. Average recovery cost: $2.83M — and that excludes reputational damage, regulatory fines, and lost revenue during downtime.
Modern ransomware groups do not spray and pray. They run multi-week intrusions: mapping Active Directory, exfiltrating data for double extortion, disabling backup systems, then deploying payloads. CrowdStrike’s 2026 Global Threat Report clocks the fastest breakout time at 27 seconds. The average is 29 minutes.
A point-in-time assessment cannot capture this threat. This framework applies CTEM principles to ransomware defense — continuous assessment, not a static checklist.
Scoring Methodology
Rate each domain 1-5. A composite score below 15 (out of 25) means ransomware operators will find your gaps before you do.
- 1 — Critical gaps: No controls or visibility in this domain
- 2 — Minimal: Ad hoc controls, no continuous monitoring
- 3 — Developing: Controls exist but are not validated
- 4 — Mature: Validated controls with continuous monitoring
- 5 — Optimized: Automated detection, validated defenses, tested response
Domain 1: Attack Path Exposure
Ransomware follows predictable paths. Initial access through exposed RDP, VPN vulnerabilities, or compromised credentials. Lateral movement via SMB, WMI, PsExec. Privilege escalation through Active Directory misconfigurations.
Checks:
- Identify all internet-facing RDP, VPN, and remote access services. Verify MFA on every one. A single RDP instance with password-only auth is sufficient initial access.
- Map lateral movement pathways: SMB shares, admin shares (C$, ADMIN$), WMI/WinRM access between systems.
- Enumerate Kerberoastable accounts, unconstrained delegation, and AdminSDHolder misconfigurations. Assess continuously — AD changes daily.
Domain 2: Credential Hygiene
Compromised credentials are the initial access vector in over 60% of ransomware incidents. The Verizon 2025 DBIR confirms credential-based attacks remain dominant.
Checks:
- Monitor dark web and infostealer logs for employee credentials. Prioritize accounts with VPN, email, or privileged access.
- Test whether AD password policy defeats credential lists ransomware groups purchase. Audit password reuse across systems.
- Identify service accounts with interactive logon rights, non-expiring passwords, and excessive privileges.
Domain 3: Backup Validation
Ransomware operators specifically target backup infrastructure. If your backups are accessible from compromised production networks, they will be encrypted or deleted.
Checks:
- Verify backup systems are unreachable from production network segments. Test whether domain admin credentials can access or delete backups.
- Conduct actual restore tests — not backup job completion checks. Measure time to restore critical systems from offline backups.
- Confirm at least one backup copy uses immutable storage (WORM, air-gapped, or cloud object lock) that cannot be modified with admin credentials.
Domain 4: Detection Readiness
Checks:
- Measure actual dwell time through purple team exercises. How quickly does your SOC detect lateral movement, credential dumping, and data staging?
- Test endpoint isolation speed. Can you contain a compromised host within minutes?
- Deploy canary files, honey tokens, and deception systems across file shares and AD. These catch reconnaissance that bypasses signature-based detection.
Domain 5: Incident Response Readiness
Checks:
- Verify a ransomware-specific IR playbook exists covering negotiation policy, law enforcement notification, communication protocols, and recovery sequencing.
- Confirm tabletop exercises reflect current TTPs — data exfiltration before encryption, ESXi targeting, supply chain compromise.
- Validate retainers with IR firms, outside counsel, and crisis communications. Establishing these during an active incident costs days.
Making It Continuous
Score once and you have a snapshot. Score continuously and you have a program. Map these five domains to CTEM: scope your ransomware attack surface, discover new exposures as they emerge, prioritize by attack path impact, validate through BAS mapped to MITRE ATT&CK techniques (T1486, T1490, T1021), and mobilize remediation with automated workflows.
VirtueThreatX automates ransomware readiness scoring through continuous attack path analysis, credential exposure monitoring, and BAS validation. Request an assessment to identify your specific gaps.