Ransomware Readiness Assessment: Is Your Organisation Actually Prepared?

Ask most leadership teams whether they are prepared for ransomware and the answer is yes: there are backups, an antivirus, an insurance policy, and a plan somewhere in a folder. 

Sophos's State of Ransomware in India 2026 report, which surveyed 240 IT and security leaders at Indian organisations that had been hit in the previous year, tells a different story about what "prepared" means in practice. 

Among its respondents, the median ransom payment was $22,000. Yet the mean cost of recovery, excluding any ransom, was $1.11 million. 

The ransom is rarely the expensive part. The expensive part is how long it takes to get the business running again, and that depends on decisions made long before the attack. A ransomware readiness assessment exists to test those decisions while they can still be changed.

 

 

What the India Data Shows

The Sophos India report, based on a Q1 2026 survey of organisations with 100 to 5,000 employees, offers a grounded picture. Because it covers only organisations that were attacked, and is a vendor survey, treat it as a snapshot of the hit population, not a national average.

 

* Encryption: 60% of attacks resulted in data being encrypted, above the global average of 56%.

* Backups: 67% of those organisations used backups to recover, up from 51% a year earlier. A third recovered some other way.

* Recovery time: 58% recovered within a week, but 10% took one to six months.

* Why it happened: the most common operational causes were a lack of protection (43%), an unknown security gap (40%), and poor-quality protection (38%). By technical cause, malicious email led at 28%, followed by phishing at 26% and compromised credentials at 19%. Exploited vulnerabilities fell to 11%.

* Size matters: in Sophos's global survey of 2,158 organisations, only 34% of those with 100 to 250 employees stopped attacks before encryption or extortion, against 46% of those with 3,001 to 5,000.

 

The "unknown security gap" figure is the one a readiness assessment targets. Four in ten victims did not know where they were exposed.

 

 

What an Assessment Should and Should Not Be

A weak assessment is a questionnaire answered from memory: Do you have backups? Yes. The answer tells you nothing about whether you can restore, in what order, or how fast.

 

A useful assessment is evidence-based. For every claim, it asks for proof: a restore log, a test result, an exercise report, a configuration screenshot. It scores each area on what can be shown, not on what is believed. CISA's #StopRansomware Guide is a good structural reference: its preparation advice and its response checklist are specific enough to test against.

 

 

Seven Areas to Assess

1. Critical services and recovery order. Which systems must return first, and what do they depend on? Without a ranked list, recovery becomes an argument during the incident. Define how long each can be down and how much data loss is tolerable.

 

2. Initial access. Identity, email, and internet-facing systems are the usual routes. Check multi-factor authentication coverage, privileged account control, email filtering, and how quickly exposed systems are patched. CISA's guide organises prevention by entry route for this reason.

 

3. Blast radius. If one machine is compromised, how far can an attacker travel? Look at network segmentation, administrator account separation, and whether domain controllers and backup systems are isolated.

 

4. Detection. Would you notice a quiet intrusion before encryption starts? This covers endpoint coverage, log collection, and whether anyone watches alerts at night. As we explored in our post on extortion-only attacks, some attackers never encrypt anything, so detection must look for the earlier stages.

 

5. Backups and recovery. CISA advises maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster recovery scenario, because many ransomware variants try to find and delete or encrypt accessible backups. The test that matters is a timed restore of a critical system from the backups you would really use.

 

6. Response. Is there a written incident response plan, exercised recently, with an offline copy? CISA recommends a hard copy and an offline version for a reason: your own systems may be unavailable. Check roles, outside contacts, legal and communications support, and a decision process for ransom demands.

 

7. Regulatory and third-party readiness. CERT-In expects serious incidents to be reported within six hours, and the DPDP Act's main duties, due from about May 2027, add a Board notification with an immediate report and a detailed one within 72 hours. Check that you know who files what, and which vendors hold or can reach your data.

 

 

Ten Questions That Separate Prepared From Hopeful

1. Which five systems must return first, and who agreed that order?

2. When did you last restore one of them from backup, and how long did it take?

3. Are any backups reachable with the same credentials an attacker would steal?

4. How many administrator accounts exist, and are they separate from daily accounts?

5. Is multi-factor authentication enforced on remote access and privileged accounts?

6. Who would see an alert at 2 a.m., and what would they do?

7. Where is the incident response plan if your network is down?

8. When did leadership last rehearse a ransomware scenario?

9. Who decides about contacting the attacker, and on whose advice?

10. Which vendors could be the way in, and what are their breach duties to you?

 

If more than a few answers start with "I think," you have found your assessment's first findings.

 

 

Turning Results Into a Plan

Score each area, then rank gaps by two measures: how likely they are to let an attacker in, and how much they would slow recovery. Fix the cheap, high-impact items first, usually privileged access, backup isolation, and a tested restore. Then schedule the harder work, and retest. Include a tabletop exercise, because a plan that has never been used will fail in unexpected places.

 

 

Where ILLUME Intelligence Can Help

ILLUME Intelligence can run a ransomware readiness assessment across these seven areas, built on evidence and not questionnaires, and deliver a ranked remediation plan. Our SOC service supports early detection, our Incident Response service prepares and supports you when an incident happens, and our vCISO service can own the improvement programme. A sensible first scope is your five most critical systems.

 

 

The Bottom Line

Being prepared does not mean having backups and a plan. It means knowing how long recovery would take, because you tested it, and knowing where an attacker could enter, because someone looked. If an honest assessment finds gaps, that is the cheapest day to find them.

---

Comments

---

No Comments Found.