In short. A ransomware attack has four stages: initial access, expansion inside the network, data theft, then encryption and the demand. The first two decide the outcome and almost always rely on ordinary weaknesses (phishing, reused passwords, remote access without MFA, unpatched systems), which are exactly the routes a penetration test is designed to find first.
A ransomware attack has four stages: initial access, expansion inside the network, theft of data, and encryption with a ransom demand. The first two are where it is decided, and they are almost always achieved through ordinary weaknesses: a phishing email, a password that was reused or guessed, a remote-access service without multi-factor authentication, or an unpatched system with a public exploit. Those are precisely the routes a penetration test is designed to find. This guide walks through each stage as it actually happens, what the current data says about how attackers get in, and how testing closes the doors before they are used.
How serious the threat is
The NCSC’s Annual Review 2025 reported 204 nationally significant incidents in the year to August 2025, more than double the previous year, of which 18 were rated highly significant. Ransomware runs through the sectors it lists: academia, finance, engineering, retail, health and manufacturing. The 2025 attack on Marks & Spencer, which the company estimated would cost it around £300 million in operating profit, showed that the impact of an attack on a well-resourced organisation is measured in months of disruption, not days. Smaller organisations are hit more often and recover more slowly; they simply do not make the news.
Stage one: initial access
Sophos’s 2026 State of Ransomware survey of more than two thousand organisations hit in the previous year found the root causes were malicious email (26%), phishing (24%), compromised credentials (23%), exploited vulnerabilities (18%) and brute-force attacks (6%). Put another way, half of attacks began with a person and an email, a quarter with a password that was already known or easily guessed, and a fifth with a system that had not been patched.
None of these is exotic. The remote desktop gateway with no MFA. The VPN with a password that also appears in a breach dump from 2021. The internet-facing server missing a critical patch for which exploit code has been public for weeks. The finance user who opened an invoice. Attackers do not need anything more, so they do not use anything more.
Stage two: expansion
Ransomware does not usually detonate on arrival. Having a foothold on one machine, the attacker works to become a domain administrator, because that is what lets them encrypt everything at once and disable the backups first. Mandiant’s M-Trends 2026 put the global median dwell time, the gap between compromise and detection, at 14 days. That is two weeks in which the attacker maps the network, harvests credentials from memory and from shared local administrator passwords, moves from workstation to server across a flat network, finds the backup infrastructure, and turns off the endpoint protection that might have stopped the final stage.
Every step of that depends on internal weaknesses: shared local administrator passwords, over-privileged service accounts, legacy name-resolution protocols that hand over credentials, no segmentation between user devices and servers, backup servers joined to the same domain they protect. These are the findings of a routine internal infrastructure penetration test, which starts from the same position the attacker holds after stage one and asks the same question: how far can I get?
Stage three: data theft
Most ransomware groups now steal data before encrypting it, so that they can threaten to publish it if the ransom is not paid. This turns an availability problem into a data breach with all that follows: notification to the ICO within 72 hours, notification to affected individuals, regulatory scrutiny and reputational damage that outlasts the outage. The theft itself is usually unsubtle, gigabytes leaving over a few days, and is a further failure of logging and alerting if nobody notices.
Stage four: encryption and the demand
Encryption is fast and is timed for maximum disruption, often overnight or before a weekend. Systems become inaccessible, files are renamed, and ransom notes appear on every screen with a deadline and a payment portal. If the attacker has done stage two well, the backups are gone or encrypted too.
The NCSC’s guidance for organisations considering payment, written with the Association of British Insurers and others, is unambiguous. Payment does not guarantee recovery, attackers frequently retain stolen data regardless, the ICO does not treat payment as mitigation when considering penalties, and payment may be unlawful if the group is sanctioned. The government has also consulted on banning payments by public sector bodies and critical national infrastructure. The organisations that recover well are the ones with tested, isolated backups and a clear picture of their own estate, because that is what lets them rebuild rather than negotiate.
What a penetration test finds, mapped to the attack
| Attack stage | What the attacker relies on | What testing finds |
|---|---|---|
| Initial access | Exposed services without MFA; unpatched internet-facing systems; weak or reused passwords | External infrastructure testing: every exposed service, missing patches, password spraying against remote access |
| Expansion | Shared local admin passwords; over-privileged accounts; flat networks; credential relaying; unpatched internal systems | Internal infrastructure testing: privilege escalation routes, lateral movement, reach of a single compromised device |
| Data theft | No alerting on large transfers; permissive egress | Logging and alerting gaps observed during testing; egress controls reviewed |
| Encryption | Backups reachable from the domain; endpoint protection that can be disabled | Build and configuration review of backup and endpoint controls against a hardening standard |
The point of the mapping is that ransomware is not a separate category of risk needing a separate product. It is the consequence of the weaknesses a standard test programme is built to find, and the report you receive is, in effect, the attacker’s route map with the routes closed.
The controls that matter most
- Multi-factor authentication on every remote-access path and cloud service. This alone removes the compromised-credential route for most attackers.
- Patching within 14 days for critical and high-rated vulnerabilities, with nothing internet-facing left out of support.
- Unique local administrator passwords and least-privilege service accounts, so that one compromised machine does not become all of them.
- Segmentation between user devices, servers and backup infrastructure.
- Backups following the 3-2-1 rule with one copy offline or immutable, and restores tested.
- Phishing-resistant staff, through short regular training and a reporting route that is used.
- Testing, so that all of the above is verified rather than assumed, with a retest to confirm the fixes.
The first five are the Cyber Essentials controls plus segmentation and backups. An organisation holding Cyber Essentials Plus and testing annually has closed the routes used in the large majority of ransomware attacks.
Frequently asked questions
How do most ransomware attacks start?
Through email (malicious attachments and phishing), compromised credentials, and exploited vulnerabilities in internet-facing systems, in roughly that order according to Sophos’s 2026 survey. Remote-access services without MFA are the commonest single target.
How long are attackers inside before they encrypt?
Mandiant’s M-Trends 2026 reports a global median dwell time of 14 days across all intrusions. Ransomware operators often move faster once they have administrative access; the point is that there is usually a window in which the intrusion could have been detected.
Should we pay the ransom?
The NCSC advises against it. Payment does not guarantee recovery or deletion of stolen data, is not treated as mitigation by the ICO, and may be unlawful if the group is sanctioned. Tested, isolated backups are what make the decision unnecessary.
Does a penetration test prevent ransomware?
It finds the weaknesses ransomware attacks rely on, so that you can fix them first. Prevention then depends on the fixes being made and verified, which is why we include a retest.
Where should we start?
An external infrastructure test to establish what is exposed and whether it can be reached without MFA or through a missing patch, followed by an internal test to see how far a single compromised device could get. Contact us and an active tester will scope both with you.