How One Click Can Cost Your Company Millions

Ransomware 101: know your enemy

Ransomware is a catch-all term for malicious software that encrypts or locks access to your systems until a payment is made. The ecosystem has matured into a professionalised industry. Crypto ransomware encrypts files with strong cryptography; victims need the attacker's key to recover. Common families include LockBit, BlackCat, and Royal.

Locker ransomware takes a blunter approach, locking the entire system and blocking access to the desktop and applications. It is less common in enterprises but still shows up in targeted attacks, particularly against specific verticals.

The dominant business model in 2025 is Ransomware-as-a-Service. Affiliates rent ransomware kits from developers who collect a cut of each successful ransom. That lowered the barrier to entry and created the double- and triple-extortion campaigns we now see regularly, where attackers threaten to leak data, harass customers, or DDoS the infrastructure if the victim refuses to pay. The one click is only the opening act.

Anatomy of a modern ransomware attack

Ransomware groups follow a refined sequence. Knowing each stage is what lets you put controls where they will actually disrupt the attack.

1. 1

   Initial access

   Phishing emails, malicious attachments, compromised websites, or stolen credentials. Attackers only need one click or a leaked password.
2. 2

   Foothold and privilege escalation

   Attackers deploy loaders, use legitimate tools (PowerShell, PsExec), and escalate privileges to move laterally. Dormant periods can last weeks.
3. 3

   Reconnaissance and data theft

   They map your network, identify backups, and quietly exfiltrate sensitive files. Double extortion begins here, before encryption.
4. 4

   Encryption event

   Payloads deploy across endpoints, servers, and backups simultaneously. By the time alerts fire, the damage is done.
5. 5

   Negotiation and recovery

   Ransom notes demand payment. Victims scramble to restore systems, engage negotiators, and inform stakeholders.

The true cost, beyond the ransom

Paying the ransom is only part of the financial damage. IBM's 2025 Cost of a Data Breach report pegs the average total at $5.02 million, before regulatory fines or litigation. The ransom itself has a median of around $1.54 million (Coveware Q2 2025), and that is before cryptocurrency fees, legal counsel, negotiators, and credit monitoring pile on.

Operational downtime is the second-biggest line item. A 15-day outage is typical. That translates into lost revenue, missed SLAs, overtime labour, and delayed shipments. For manufacturing and logistics, a week of downtime can be worse than the ransom itself.

Regulatory fines (GDPR, CCPA, and their equivalents) can reach 4% of annual revenue. Mandatory disclosures invite regulatory scrutiny and a wave of lawsuits. Finally, rebuild costs (reimage devices, upgrade tooling, IR retainers) run around $750k on average. And then there is reputation. Customers hesitate, partners renegotiate, and employees lose confidence. That damage lingers long after systems come back online.

Why companies still pay

Despite FBI guidance against paying, many organisations feel they have no choice. Attackers exploit three business realities.

The first is untested backups. Air-gapped backups are not helpful if they were never rehearsed, and attackers target backup repositories first to remove your lifeline. When restoration is uncertain and downtime is expensive, the math often favours the ransom.

The second is service-level pressure. Public companies and critical infrastructure cannot afford prolonged outages. Paying can look cheaper than weeks of lost revenue and regulatory exposure, even when the board knows better.

The third is data extortion. If attackers threaten to leak sensitive data or customer records, paying can be the only way to avoid a reputational catastrophe. Prevention is far cheaper than negotiating from any of these positions.

Prevention tactics that actually work

Checklists are everywhere, but not all controls offer equal impact. Three practices drive most of the risk reduction for most organisations.

Isolate high-risk browsing. Finance, HR, vendor management, and security teams should review external content inside an isolated browser. Even if a phishing link carries ransomware, it detonates in the cloud, not on production machines. This single change eliminates the most common delivery path for modern ransomware.

Segment and monitor the network. Lateral movement should never be easy. Identity-aware segmentation, least-privilege access, and behavioural analytics catch unusual file encryption activity early enough to matter. This is less about prevention than containment, and containment is what turns a six-figure incident into a six-million-dollar one.

Rehearse backups like fire drills. Test restores quarterly. Keep multiple offline, immutable backups. Document recovery times so leadership understands what "15 days" actually means before they have to make a ransom decision under pressure.

The untested-link problem

Employees constantly receive unknown links. Suspicious invoices, contract portals, shipping notifications. Telling them never to click is not realistic. Their jobs require it. Give them a safe way to inspect content instead.

The workflow with an isolated browser is straightforward. Open the link inside a Browser.lol session so nothing touches the local machine. Record video or screenshots for evidence without risking infection. If the site requests a download, open that file inside the isolated environment first. Close the session, and Browser.lol destroys the container, wiping any malware, cookies, or trackers with it. The whole cycle takes a minute or two, which is short enough that people will actually do it.

Incident response essentials

Preparation is the difference between a contained incident and a prolonged crisis. If ransomware slips through, move fast and methodically.

The immediate moves are to disconnect infected machines from the network, engage your incident response partner and legal counsel, and preserve logs and forensic evidence before reimaging. Reimaging too early destroys evidence you will need for insurance and law enforcement.

The communication plan is just as important. Notify leadership and critical stakeholders within minutes. Have pre-approved messaging ready for employees, customers, and regulators. Document every decision, because law enforcement and insurers will ask. An incident without good notes is a much harder incident to finish.

A 21-day action plan

If you are building a resilience programme from scratch, a phased sprint beats a big-bang rollout every time.

One click does not have to become a crisis

Ransomware thrives on human nature. Curiosity, urgency, trust. Your defences need to embrace that reality instead of fighting it. Give your team tools that make safe behaviour the default: isolated browsers for risky content, rehearsed backups, and a response plan that springs into action without requiring discussion.

When the next suspicious email arrives, your employees should not have to gamble. They should have an Open Safely button that routes the threat into containment. The difference between a scare and a shutdown is measured in how prepared you are before the click ever happens.