The most effective way to prevent ransomware is to use layered security: phishing-resistant multi-factor authentication, timely patching, isolated backups, least-privilege access, network segmentation, endpoint protection and a tested incident-response plan. No single tool guarantees prevention. These controls make ransomware harder to deliver, limit how far it can spread and improve recovery if an attack succeeds.

Ransomware is malware that blocks access to files, systems or networks. Modern attacks may also steal data before encrypting it and demand payment for both restoration and non-disclosure.

The 10 steps below draw on CISA recommendations and NIST's 2026 ransomware guidance.

Ransomware Prevention Checklist

Priority What to Do Who Needs It
Critical Use MFA, preferably phishing-resistant MFA All users, especially businesses
Critical Maintain offline or immutable backups and test restoration Home users and businesses
Critical Patch operating systems, applications and internet-facing systems Home users and businesses
High Use standard accounts and restrict administrator privileges Businesses and advanced home users
High Protect email and train users to identify phishing Businesses and families
High Disable or secure exposed RDP and remote-access services Businesses
High Use endpoint protection, logging and alerts Businesses
High Segment networks to limit lateral movement Businesses
High Maintain and exercise an incident-response plan Businesses

1. Keep Secure, Isolated Backups

Backups are the main ransomware recovery control, but they only help if attackers cannot encrypt or delete them.

Back up important documents, databases, configuration files and business-critical systems regularly. Keep at least one backup disconnected from normal operations or stored in a protected, immutable format. CISA and NIST recommend securing and isolating backups because ransomware can search for accessible backup systems and corrupt or delete them.

Use these backup practices:

  • Automate backups so they run consistently.
  • Keep an offline, disconnected or separately administered copy.
  • Use cloud storage with version history, deletion protection or object lock where appropriate.
  • Encrypt backup data.
  • Use separate credentials for backup administration.
  • Test restoring individual files and complete systems.
  • Maintain clean system images or golden images for critical devices.
  • Document how long restoration should take and which systems must be restored first.

A backup that has never been restored successfully is not a proven backup.

2. Enable Multi-Factor Authentication

Multi-factor authentication reduces the risk that a stolen password will give attackers access to email, VPNs, cloud services or administrator accounts.

Enable MFA on:

  • Email accounts
  • VPNs and remote-access services
  • Cloud administration consoles
  • File-sharing platforms
  • Financial and payroll systems
  • Password managers
  • Privileged administrator accounts

For organizations, CISA recommends phishing-resistant MFA for email, VPNs and accounts that access critical systems. Passkeys, hardware security keys and certificate-based authentication generally provide stronger phishing resistance than passwords or SMS codes.

Use unique passwords and a reputable password manager. Keep administrator accounts separate from normal user accounts, and do not use an administrator account for everyday email, browsing or document editing.

3. Patch Operating Systems, Applications and Internet-Facing Systems

Ransomware attackers often exploit weaknesses in internet-facing devices, remote-access tools, operating systems, browsers, VPN appliances and business applications.

To reduce this exposure:

  1. Turn on automatic updates for personal devices where possible.
  2. Patch internet-facing systems first.
  3. Replace unsupported operating systems and applications.
  4. Maintain an inventory of hardware, software and cloud services.
  5. Scan for known vulnerabilities.
  6. Prioritize vulnerabilities known to be actively exploited.
  7. Remove software and services that are no longer needed.

CISA identifies timely patching as an efficient way to reduce exposure to cyber threats.

4. Reduce Phishing Risk

Phishing is a common ransomware delivery method. Attackers may use malicious links, attachments, fake invoices, password-reset messages, document-sharing notifications or impersonated suppliers.

Users should:

  • Verify unexpected payment, password-reset and account-lockout requests.
  • Avoid opening unexpected attachments, especially executable files and macro-enabled documents.
  • Check the sender's full address, not just the display name.
  • Open websites using a known bookmark instead of an email link.
  • Confirm urgent requests through a separate communication channel.
  • Report suspicious messages instead of forwarding them.
  • Never install remote-access software at the request of an unsolicited caller.

Organizations should use email security filtering, label external messages, block dangerous attachment types and provide a simple way for employees to report suspicious emails. Security training should focus on reporting and verification, not only on recognizing spelling mistakes.

5. Restrict Administrator Privileges

Ransomware can cause more damage when the first compromised user or account has excessive permissions.

Apply the principle of least privilege:

  • Give users only the access required for their roles.
  • Use standard accounts for everyday work.
  • Separate administrator accounts from normal user accounts.
  • Restrict who can install software.
  • Remove inactive accounts promptly.
  • Review administrator and group memberships regularly.
  • Prevent ordinary users from accessing backup systems.
  • Require additional approval for sensitive changes.

Least privilege limits what an attacker can access after compromising one account or device. CISA recommends separating administrator accounts, restricting root access and reviewing excessive privileges.

6. Secure Remote Access and Disable Exposed RDP

Remote Desktop Protocol, VPNs, remote-management tools and cloud administration interfaces are frequent targets because they can provide direct access to internal systems.

Do not expose RDP directly to the public internet. If remote access is necessary:

  • Place it behind a properly configured VPN or zero-trust access solution.
  • Require MFA.
  • Restrict access by user, device, location or network.
  • Disable unused remote-access services.
  • Monitor failed and unusual login attempts.
  • Use separate administrator accounts.
  • Apply security updates promptly.

CISA advises organizations not to expose services such as RDP directly to the internet and recommends additional controls when remote access is required.

7. Use Endpoint Protection and Application Controls

Install reputable endpoint protection on computers and servers. Keep malware definitions and detection engines updated, and configure automatic scanning for email attachments, removable drives and downloaded files.

For business environments, consider:

  • Endpoint detection and response, or EDR
  • Application allowlisting
  • Attack surface reduction rules
  • Script and macro restrictions
  • USB device controls
  • Browser isolation
  • Centralized security alerts
  • Protection against tampering with security software

Allowlisting works best in environments where an organization can define which applications are permitted to run. NIST's 2026 ransomware guidance recommends malware detection software and allowing only authorized applications where practical.

8. Segment Networks to Limit Ransomware Spread

Network segmentation stops every device from automatically communicating with every other device.

Separate, where practical:

  • User workstations
  • Servers
  • Backup infrastructure
  • Domain controllers
  • Production systems
  • Guest Wi-Fi
  • Operational technology
  • Cloud administration environments

Restrict traffic between segments and monitor unusual connections. Segmentation may not stop the initial infection, but it can limit lateral movement and reduce the number of systems an attacker can encrypt.

9. Monitor for Early Warning Signs

Ransomware activity may be detectable before widespread encryption occurs. Monitor for:

  • Unusual sign-ins or impossible-travel events
  • New administrator accounts
  • Repeated failed logins
  • Unexpected use of PowerShell or remote-management tools
  • Large numbers of file changes
  • Disabled security software
  • New scheduled tasks or startup entries
  • Abnormal access to file shares
  • Backup deletion or configuration changes
  • Large data transfers to unfamiliar locations

Enable logging on identity systems, endpoints, servers, cloud services and backup platforms. Configure alerts for suspicious account, file and backup activity. NIST recommends continuous monitoring, endpoint detection and protected backup systems as part of ransomware risk management.

10. Create and Test an Incident-Response Plan

A ransomware plan should identify what people must do during the first minutes and hours of an attack.

Document:

  • Who has authority to isolate systems
  • Internal and external contact details
  • IT, legal, insurance and incident-response contacts
  • Which systems are mission-critical
  • How to communicate if email is unavailable
  • How to preserve logs and evidence
  • How to restore systems from clean backups
  • When and how to notify customers, regulators or law enforcement
  • Who will make decisions about ransom demands

Exercise the plan regularly. NIST recommends a ransomware response and recovery plan with defined roles, restoration priorities and backup-recovery procedures.

How Individuals Can Prevent Ransomware at Home

Home users should focus on six controls:

  1. Turn on automatic updates for the operating system, browser and applications.
  2. Enable MFA on email, cloud storage, banking and social-media accounts.
  3. Use a password manager and never reuse passwords.
  4. Install reputable security software and keep it updated.
  5. Back up photos, documents and other irreplaceable files.
  6. Disconnect external backup drives when they are not being used.

CISA warns that an external drive left connected can be reached by ransomware, allowing its backups to be deleted or corrupted.

Do not install pirated software, unknown browser extensions or applications from unofficial sources. Treat unexpected delivery notices, invoices, account alerts and technical-support calls as potential scams.

What to Do if Ransomware May Already Be Running

If you see a ransom note, files changing unexpectedly or widespread access failures:

  1. Disconnect the affected device from Wi-Fi, Ethernet and shared network storage if doing so is safe.
  2. Contact your IT team or incident-response provider immediately.
  3. Do not delete ransom notes, logs or suspicious files.
  4. Protect backup systems by taking them offline or restricting access.
  5. Avoid restoring from backups until they have been checked for malware.
  6. Preserve evidence before rebuilding systems.
  7. Report the incident to the FBI's Internet Crime Complaint Center, or IC3, and contact the relevant law-enforcement agency.
  8. Do not assume that paying guarantees data recovery or prevents stolen data from being published.

The FBI states that paying a ransom does not guarantee recovery, may result in further targeting and can encourage additional criminal activity. The FBI recommends reporting ransomware incidents even when an organization is considering all available recovery options.

Can Antivirus Alone Prevent Ransomware?

No. Antivirus and endpoint protection are useful, but they cannot compensate for exposed remote services, stolen credentials, unpatched systems or inaccessible backups.

If you are choosing where to start, turn on MFA, patch internet-facing systems and create a backup that normal users and devices cannot alter. Then test restoring it.