Blog
Stay informed about the latest ransomware threats, security best practices, and product updates.
AI and vulnerabilities: php2shell, Massive Patch Batch, Mythos and more
It’s been just over six months since Project Glasswing was announced, and we’re still starting to understand what it means for the industry.
Ransomware Recovery vs. Prevention: Backups Aren't a Plan
Backups and DR get you back online after ransomware has already done the damage. How recovery and prevention differ, and why you need both.
How to Protect Legacy and OT Systems You Can't Patch
Can't patch a legacy Windows MES server or engineering workstation? What actually happens to unpatched endpoints, and how to keep ransomware from encrypting them.
Funded, Audited, and Still Exposed: Why Public Sector Ransomware Defense Keeps Coming Up Short
State and local governments have strengthened their cybersecurity defenses, but ransomware continues to expose gaps between compliance and true ransomware prevention.
EDR Can Be Disabled. Encryption Can Still Be Stopped.
Learn why ransomware attackers target EDR and how an independent layer of ransomware prevention can help stop encryption even if detection is bypassed.
Memphis-Shelby County Schools vs. Zero-Day Ransomware
Memphis-Shelby County Schools (TN) tested RansomSnare alongside its EDR and MDR. Every ransomware variant was stopped before a single file was encrypted.
Your Security Stack Wasn't Built for Zero-Day Ransomware
In our article, If Ransomware Can Encrypt, It Has Already Won, we drew a hard line between detection and prevention. Detection tells you ransomware is there. Prevention stops it before the damage begins. This post goes one level deeper: what happens when the ransomware arriving at your door is one your tools have never seen?
Their EDR Missed 4 of 6 Zero-Day Ransomware Strains. RansomSnare Stopped All of Them.
Most K-12 school districts aren't sitting on sophisticated security stacks. They're running lean IT teams, aging infrastructure, and endpoint tools that were built for a different threat environment. That's not a criticism. It's just the reality of how public education operates. A Michigan school district serving 7,500 students across 15 facilities knew this as well as anyone. They had MDR and EDR in place, which is more than a lot of districts can say. When a zero-day ransomware variant hit their environment, neither tool caught it. The attack had no signature. It slipped through their existing defenses and targeted exactly the surfaces most EDR tools leave exposed: file servers, administrative workstations, and systems running legacy operating systems that vendors stopped supporting years ago.
If Ransomware Can Encrypt, It Has Already Won
Most organizations think they have ransomware prevention, but they don’t. What they actually have is detection, and that distinction might matter more than anything else sitting in your security stack right now.
What Happens When a University Encounters Ransomware Its EDR Has Never Seen Before?
Universities invest heavily in ransomware detection, but what happens when a threat is new? Explore the limitations of detection-based security and why more institutions are adding protection focused on preventing encryption itself.
K-12 Ransomware Is Evolving. Is Your District Prepared?
K-12 schools remain one of the most targeted sectors for ransomware, and today's attacks are faster, broader, and more disruptive than ever. Watch the webinar replay featuring a technology leader from Memphis-Shelby County Schools and learn what districts can do to reduce operational risk before disruption begins.
Before Encryption: Where Ransomware Intrusions Are Decided — Part 2 of 2: Detecting the Window That Actually Matters
Part 2 of the pre-encryption ransomware series. The decisive window is observable, but only if defenders instrument the right techniques: shadow copy deletion, EDR tamper, LSASS access, SMB fan-out, and RMM-from-temp. A focused detection set, an honest answer to the 'we can't detect everything' objection, and a five-item action list for SOCs to implement this week.
The Three Hours Before Ransomware Encryption (Part 1)
Shadow copy deletion, EDR tampering, share discovery and exfiltration: the steps ransomware operators run before encryption, and the telemetry each leaves.
Canvas Breach: Why "Contained" Wasn't Contained
Five days after Instructure called the Canvas breach contained, ShinyHunters struck again. What schools and SaaS-dependent teams should ask their vendors now.
From Dispatch to Drones: Five Ransomware Risks Reshaping Law Enforcement Operations
Field observations from Carahsoft's 2026 Law Enforcement Innovation Summit on how ransomware risk is expanding across modern policing — from CAD outages to drone ecosystems to digital evidence pipelines.
Ransomware Succession: Who Replaced LockBit and ALPHV
LockBit, ALPHV, RansomHub and BlackBasta are gone, yet 2026 is on pace for record ransomware victims. The new groups, and what it means for defenders.
Why Qilin and Akira Are Reshaping Ransomware Defense in 2026
Ransomware group names change. The business model does not. In 2026, groups like Qilin and Akira show how ransomware operations continue to outpace traditional defenses, where encryption is no longer the first step but the final stage of the attack.
When There Is No Key: What the Stryker Wiper Attack Signals for Security Leaders in 2026
Three weeks. That is how long it reportedly took for medtech manufacturer Stryker to restore operations after a destructive cyberattack that wiped systems across parts of its environment. This wasn't ransomware—there was no key to recover, no ransom demand, no negotiation. This was a wiper attack designed to destroy, not extort.
Strengthening Ransomware Defense: SecuritySnares Partners with Pondurance to Stop Attacks Earlier
SecuritySnares and Pondurance partner to stop ransomware before encryption and data exfiltration, adding prevention to MDR security operations.
Expanding Ransomware Prevention for the Public Sector: SecuritySnares Partners with Carahsoft
SecuritySnares has partnered with Carahsoft to bring a new standard of ransomware prevention to the Public Sector, making RansomSnare available through trusted government contract vehicles.
Defender Spotlight Tyler Hudak
In this series, we highlight security professionals and their work behind the scenes. Questions are based on their experiences over their careers, not necessarily reflective of their current employer.
Defender Spotlight Andy Jackman
In this series, we highlight security professionals and their work behind the scenes. Responses and opinions are based on their experiences over their careers, not necessarily reflective of their curr...
Defender Spotlight Aaron Shelmire
* Aaron * : There’s a few!
Defending Against Ransomware and Wipers with the Purdue Model for OT Networks
How the Purdue model's layered segmentation and controls at each level limit the spread of ransomware and wipers across OT networks, plus a case study.
Understanding Akira: A Persistent Ransomware Threat
In the ever-evolving landscape of cybersecurity, staying informed about emerging threats is crucial for organizations to protect their digital assets. One such threat that has garnered attention is th...
Volt Typhoon A multi year Chinese Cyber Assault on Critical Infrastructure
In a very public fashion, FBI Director Christopher Wray recently discussed the extent of China’s ongoing hacking campaign, known as Volt Typhoon. The campaign, as reported by Reuters on April 18th, 20...