--- title: "Ransomware protection: how endpoint security and backup work together" description: Ransomware hit 44% of breaches in 2025. See how endpoint protection, behavioral detection and backup and disaster recovery work together to stop it. canonical_url: https://www.acronis.com/en/blog/posts/leveraging-ransomware-protection-software-and-backup-and-disaster-recovery-solutions/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Ransomware protection: how endpoint security and backup work together According to Verizon’s 2023 Data Breach Investigations Report, ransomware was the primary method used in 24% of data breaches in 2023. To protect sensitive data, companies must implement proactive measures for ransomware protection. Understanding the nature of ransomware attacks is essential for developing effective prevention and recovery strategies. [Join our events](https://acronis.events/) [![Image 2: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)](https://www.acronis.com/en/blog/authors/acronis/ "Acronis Editorial Team") [Acronis Editorial Team](https://www.acronis.com/en/blog/authors/acronis/) 6 min read Last updated 29 July 2026 **Quick definition** Ransomware protection combines two things that work at different points of an attack: endpoint protection software that detects and blocks ransomware before it encrypts data, and backup and disaster recovery solutions that let an organization restore its systems if an attack still gets through. **Key takeaways**Ransomware was present in 44 percent of data breaches analyzed in Verizon's 2025 Data Breach Investigations Report, up from 32 percent the year before.The FBI and CISA both advise against paying a ransom, since payment does not guarantee data recovery and can invite further attacks. That advice only works if backups actually work.Endpoint protection stops attacks at the entry point. Backup and disaster recovery are the safety net when prevention fails.A disaster recovery plan built around clear recovery time and recovery point objectives turns "how fast can we recover" from a guess into a target. Ransomware protection is not one product or one control. It is prevention and recovery working together, because no endpoint tool catches every attack and no backup plan replaces the need to stop attacks before they spread. ## Why does ransomware protection matter right now? Because ransomware keeps growing as a share of the breaches organizations actually experience. Verizon's 2025 Data Breach Investigations Report found ransomware present in 44 percent of breaches analyzed that year, up from 32 percent the year before. The median ransom payment fell to 115,000 US dollars, and 64 percent of victim organizations refused to pay, evidence that more organizations are relying on recovery instead of negotiation. That shift only works for organizations whose backups and detection tools are actually ready. The cost of getting this wrong shows up well after the initial attack. In March 2023, the Money Message ransomware group breached the network of PharMerica, a US pharmacy services provider, compromising the personal information of 5,815,591 individuals, including names, birth dates, Social Security numbers and health insurance data. Nearly three years later, in January 2026, a federal court gave preliminary approval to a 5.2 to 5.3 million US dollar class-action settlement tied to the breach, on top of the direct costs of the incident itself. A single ransomware attack can generate legal and financial consequences for years. ## What are the most common ransomware attack vectors? Ransomware typically enters a network through malicious email attachments, drive-by downloads or compromised websites, and increasingly through social engineering that tricks a user into granting access rather than exploiting a technical flaw. Once inside, attackers often use automated tools to move across a network before encrypting data and demanding payment. Some groups go further, threatening to leak stolen data, launching denial-of-service attacks or contacting a victim's clients directly to increase pressure to pay. Understanding these vectors matters because prevention has to cover more than one path in. A defense built entirely around blocking malicious email attachments does nothing against an attacker who logs in with stolen credentials. ## What does endpoint protection software actually stop? Endpoint protection software is the first line of defense, monitoring the devices where ransomware most often lands: desktops, laptops and mobile devices. Effective endpoint protection combines several capabilities rather than relying on one: * **Signature-based detection**, which compares files against known malware signatures. Fast and reliable against known threats, but blind to anything new. * **Sandboxing**, which runs suspicious files in an isolated environment to observe whether they behave maliciously before they reach the real system. * **Application control and URL filtering**, which restrict what can run and block known-malicious sites before a download happens. * **Patch and vulnerability management**, which closes the security gaps attackers exploit to gain initial access in the first place. * **Data loss prevention**, which limits how much sensitive data can leave the network even if an attacker gets partway in. Layering these controls matters because ransomware groups adapt quickly. A multilayered setup, current patching, strong authentication with multifactor verification, and endpoint detection and response tooling that watches for suspicious activity in real time gives an organization several chances to catch an attack rather than one. ## How does behavioral detection catch what signatures miss? Signature-based tools can only stop ransomware they already recognize. Behavioral detection and machine learning close that gap by watching what a program does rather than what it looks like. Behavioral analysis establishes a baseline for normal file, network and system activity, then flags deviations, such as a process suddenly encrypting large numbers of files, as a potential attack in progress. Machine learning models trained on large datasets of known ransomware extend this further, recognizing the characteristics of new strains based on behavior rather than a matching signature. Real-time monitoring ties this together. By watching network traffic, system logs and endpoint activity continuously, a security team can catch indicators of compromise, unusual network connections, unauthorized access attempts, abnormal file activity, early enough to contain an attack before it spreads to backups or other systems. ## How do backup and disaster recovery protect against ransomware? Regular backups let an organization restore data to its state before an attack rather than negotiate with an attacker for a decryption key. That is the practical version of the FBI and CISA's shared guidance: both agencies advise against paying a ransom because payment does not guarantee data recovery and can encourage further attacks. That guidance is only realistic for an organization with backups it can actually trust. Two practices make backups meaningful in a ransomware scenario rather than theoretical: * **Off-site backups.** Storing copies in a location separate from the primary network means that even if an attacker encrypts everything reachable on that network, an independent, isolated copy remains untouched. * **Encrypted backups.** Encrypting backup data means that even if backup files are somehow accessed, they stay unreadable without the correct key, protecting the recovery path itself from becoming a second point of failure. ## What is a disaster recovery plan? A disaster recovery plan is a written document outlining the policies and procedures an organization follows to recover its IT systems and data and resume operations after a disruption, including a ransomware attack. Two objectives anchor a workable plan: **Recovery time objective (RTO)** is the maximum acceptable downtime, how quickly systems and services need to be operational again after a disruption. An RTO of two hours means the goal is full operational recovery within two hours of an incident. **Recovery point objective (RPO)** is the maximum acceptable data loss, measured as a point in time rather than a duration. An RPO of one hour means the backup and recovery process needs to be able to restore data to within one hour of when the disruption started, tolerating at most an hour of lost work. Setting both objectives explicitly turns disaster recovery from an aspiration into something that can actually be tested and measured. ## What should a backup solution include for ransomware protection? Not every backup approach recovers cleanly from ransomware. Three features matter specifically for this use case: * **Versioning**, so an organization can restore files to a point before encryption happened rather than being stuck with only the most recent, possibly compromised, backup. * **Incremental backups**, which store only the changes since the last backup, reducing both backup time and storage requirements compared to repeated full backups. * **Cloud storage**, which adds scalability without new hardware and typically replicates backups across multiple data centers, adding resilience against both cyberattacks and physical failures. ## How does Acronis Cyber Protect help with ransomware protection? [Acronis Cyber Protect](https://www.acronis.com/en/products/cyber-protect/) combines backup and recovery, endpoint security, anti-malware and management features in a single console, so prevention and recovery are not managed as separate tools with separate blind spots. It includes URL filtering, vulnerability assessments and patch management alongside its backup capabilities, and runs in the Acronis Cloud so endpoints are protected regardless of location, useful for remote and mobile work environments. [Try it free for 30 days](https://www.acronis.com/en/products/cyber-protect/trial/). ## Frequently asked questions **What is ransomware protection software?** It is software that detects and blocks ransomware before it can encrypt data, typically combining signature-based detection, behavioral analysis and real-time monitoring rather than relying on any single method. **Should organizations pay a ransomware ransom?** The FBI and CISA both advise against it. Payment does not guarantee data recovery and can encourage attackers to target more victims. That advice is realistic only when an organization has reliable, tested backups. **What is the difference between RTO and RPO?** Recovery time objective (RTO) measures how quickly systems need to be back online after a disruption. Recovery point objective (RPO) measures how much data loss is acceptable, expressed as a point in time. Both are set before an incident, not during one. **Why do backups need to be off-site and encrypted?** Off-site backups survive an attack that reaches everything on the primary network. Encryption protects the backup itself from becoming a second point of failure if an attacker manages to access it. **How common is ransomware in data breaches today?** Verizon's 2025 Data Breach Investigations Report found ransomware present in 44 percent of the breaches it analyzed that year, up from 32 percent the year before. ## Sources * Verizon, 2025 Data Breach Investigations Report * Federal Bureau of Investigation, ransomware guidance * Cybersecurity and Infrastructure Security Agency, #StopRansomware advisories * SecurityWeek and BleepingComputer, reporting on the 2023 PharMerica data breach * HIPAA Journal and TechTarget, reporting on the 2026 PharMerica settlement [Ransomware protection](https://www.acronis.com/en/blog/tags/ransomware-protection/) [Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/) [Antivirus protection](https://www.acronis.com/en/blog/tags/antivirus-protection/) [Data protection](https://www.acronis.com/en/blog/tags/data-protection/) [Cyber protection for businesses](https://www.acronis.com/en/blog/tags/cyber-protection-for-business/) [Disaster recovery](https://www.acronis.com/en/blog/tags/disaster-recovery/) [Data loss prevention](https://www.acronis.com/en/blog/tags/data-loss-prevention/) ## Written by ![Image 3: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png) Acronis Editorial Team Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), and enterprise IT departments. [Previous post](https://www.acronis.com/en/blog/posts/ransomware-attack-cost-atlanta-over-10m-would-have-been-stopped-acronis-active-protection/) [Atlanta's $17M Ransomware Attack: What Could Have Stopped It](https://www.acronis.com/en/blog/posts/ransomware-attack-cost-atlanta-over-10m-would-have-been-stopped-acronis-active-protection/) [Next post](https://www.acronis.com/en/blog/posts/acronis-accelerate-the-journey-to-autonomous-it-continues/) [Acronis Accelerate: The journey to autonomous IT continues](https://www.acronis.com/en/blog/posts/acronis-accelerate-the-journey-to-autonomous-it-continues/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: Acronis Cloud Storage adds a recovery warranty](https://staticfiles.acronis.com/images/blog-card/6a693ef2012c6324f65b0b452c11b3d6.png) [Acronis Cloud Storage adds a recovery warranty](https://www.acronis.com/en/blog/posts/acronis-cloud-storage-adds-a-recovery-warranty/) Secure, scalable cloud storage with a recovery commitment backed by Acronis. The Anti-Ransomware Recovery Warranty that helps MSPs make recovery a visible part of the service they deliver. **October 12, 2026**4 min read ![Image 5: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read ![Image 6: From AI vision to MSP action: The journey continues this October](https://staticfiles.acronis.com/images/blog-card/65821c3bd72f935cd680e584fe43de66.png) [From AI vision to MSP action: The journey continues this October](https://www.acronis.com/en/blog/posts/from-ai-vision-to-msp-action-the-journey-continues-this-october/) The first event answered why AI matters and the second event demonstrated what's possible. Acronis Accelerate: Time to Act brings those ideas to life through a practical, workflow-driven experience that follows a future day in the life of an MSP. **September 23, 2026**4 min read