Despite years of security awareness training, email remains one of the most common ways ransomware gets its first foothold on a network.

How It Usually Gets In

• Malicious attachments, especially Office documents that prompt "Enable Content" or "Enable Macros" to view the document — that click runs a script that downloads the actual ransomware payload.
• Links to fake login pages that harvest credentials, which are then used to log in directly and deploy ransomware manually across the network.
• Compromised attachments from a real, previously-hacked contact, which is why "I know this sender" isn't a reliable safety check on its own.

What Actually Prevents It

1. Backups that are tested and isolated from the network (offline or immutable) — this is the single most important protection, since it's what lets you recover without paying if prevention fails.
2. Disable Office macros from the internet by default at the organization level, rather than relying on individual users to decide.
3. Keep systems patched. Many ransomware strains spread further using known vulnerabilities once they have a foothold.
4. Use endpoint detection and response (EDR), not just traditional antivirus, to catch the behavior of ransomware (mass file encryption) even if the initial file wasn't flagged as malicious.
5. Segment your network so a single infected device can't reach every file share and system in the company.
6. Train staff regularly on attachment and macro risks — this is cheap compared to a single incident.

Common Questions

Should we ever pay the ransom?

Most security agencies (including the FBI) recommend against it — payment doesn't guarantee you get usable decryption keys, and it funds further attacks. This is exactly why tested, offline backups matter more than any other single control.

If one computer gets infected, does the whole company?

Not necessarily, if your network is properly segmented and the infected machine is isolated quickly — but ransomware actively tries to spread to file shares and other connected systems, so speed of detection and containment matters enormously.