Ransomware gets framed as a single catastrophic event, but it's usually the last step in a longer intrusion — an attacker gets in through phishing or an exposed service, moves laterally through the network, finds and often exfiltrates valuable data, and only then deploys the encryption payload. That means most of the opportunities to stop it happen well before the ransom note appears.
Backups are the most talked-about defense, and for good reason — but only if they're done right. Backups that live on the same network as production systems can be encrypted right along with everything else. The standard now is offline or immutable backups that a compromised admin account can't modify or delete, tested with real restores, not just scheduled and forgotten.
Because modern ransomware groups often steal data before encrypting it, backups alone don't solve the exposure problem — if your data was already copied out, restoring from backup stops the operational damage but not the leak. That's why detection matters as much as recovery: catching lateral movement or unusual data transfers early can stop an incident before it reaches the encryption stage at all.
Practical priorities, roughly in order of impact: multi-factor authentication everywhere, especially for remote access and admin accounts; network segmentation, so one compromised machine can't reach everything; offline/immutable backups with tested restores; and an actual incident response plan — written down, assigned to specific people, and rehearsed — so the first hours of a real incident aren't spent figuring out who's in charge.
The organizations that recover fastest from ransomware aren't the ones who never get targeted — everyone eventually is. They're the ones who had already answered "what do we do when this happens" before it happened.