GigaOm Radar for Ransomware Preventionv2.0

1. Executive Summary

Ransomware remains a high-priority threat for all organizations, continuously evolving alongside the growing sophistication of attackers and their tools. Attacks are now more complex than ever, carried out by organized and well-financed criminal gangs. The malware used is more intelligent and sophisticated, as are the tactics deployed. A rising trend involves double- and triple-jeopardy attacks, where data is not only encrypted but stolen as attackers look to maximize their return on their investment. The use of AI is as prevalent here as in any other part of the IT industry and is being used to find novel ways to evade ransomware prevention tools, better target victims, and automate attacks more effectively.

For businesses, the impact of a ransomware attack is significant. An attack will likely cause major system outages and disruption, leading to direct financial losses. This includes lost revenue, recovery costs (whether in paying a ransom or the services cost to recover), potential fines from regulators, and, of course, the impact on reputation and customer relationships. The consequences of a successful ransomware attack should not be underestimated and must be a business priority, not just a technical one. Despite widespread discussion about ransomware, it is easy to assume it has been “dealt with,” but nothing could be further from the truth. The threat remains substantial, with rapid and regular evolutions that organizations must be aware of and ensure they are sufficiently protected.

IT leaders must ensure their ransomware prevention strategies can effectively deal with modern threats. Tools that rely on spotting known malware or identifying and mitigating threats are no longer enough. A robust ransomware strategy must be comprehensive, from threat identification and stopping attacks quickly to the inevitable recovery from damage caused. This requires a holistic approach, which is why ransomware tools are often part of broader solutions. Key components typically include endpoint detection and response/extended detection and response (EDR/XDR), cloud security, threat intelligence, risk assessment, data protection, and user training. The most effective tools are those that combine these capabilities, offering businesses stronger protection against ransomware attacks and their impact.

This is our second year evaluating the ransomware prevention space in the context of our Key Criteria and Radar reports. This report builds on our previous analysis and considers how the market has evolved over the last year.

This GigaOm Radar report examines twelve of the top ransomware prevention solutions and compares offerings against the capabilities (table stakes, key features, and emerging features) and nonfunctional requirements (business criteria) outlined in the companion Key Criteria report. Together, these reports provide an overview of the market, identify leading ransomware prevention offerings, and help decision-makers evaluate these solutions so they can make a more informed investment decision.