What is Ransomware Target Risk Profile?
A ransomware target risk profile assesses how a business compares against the targeting patterns and security gaps that ransomware actors commonly exploit. It considers industry, company size, MFA coverage, backup design, security-awareness training, endpoint protection, remote-access security, patching cadence, and cyber-insurance posture. The output is a directional risk profile relative to industry-baseline controls, not a prediction of an attack.
The Formula
Formula
Risk Profile = (Industry) + (Company Size) + (MFA Coverage) + (Backup State) + (Training) + (Endpoint Protection) + (Remote Access) + (Patching) + (Cyber Insurance)
Sophos State of Ransomware research consistently identifies industry, observable security gaps, and recovery capability (rather than randomness) as the dominant factors in ransomware targeting and outcomes.
Worked Example
Worked example
A 120-employee manufacturing business has MFA on critical applications only, untested writable backups, annual training, business antivirus, VPN with MFA, monthly patching, cyber insurance but unclear on controls requirements.
- 01Industry: manufacturing (elevated targeting)
- 02Company Size: 120 (elevated)
- 03MFA Coverage: critical apps only (elevated)
- 04Backup State: untested writable (high risk)
- 05Training: annual (elevated)
- 06Endpoint Protection: business antivirus (elevated)
- 07Remote Access: VPN with MFA (moderate)
- 08Patching: monthly (moderate)
- 09Cyber Insurance: unclear controls (elevated)
Result
Risk profile lands in the elevated-to-high band. This is not a prediction of an attack; it is a description of operational gaps relative to industry-baseline controls. Highest-leverage fixes for risk reduction: complete MFA across every application, move to immutable backups with tested restores, upgrade to EDR plus quarterly awareness training, and confirm cyber-insurance controls requirements. A 90-day remediation with a cybersecurity firm typically closes the highest-leverage gaps.
Why This Matters
Ransomware targeting is patterned, not random
Sophos State of Ransomware research and incident-response practice consistently show that ransomware actors target based on industry, observable security gaps, and visible attack-surface exposure rather than choosing victims randomly. Reducing observable gaps materially reduces targeting attractiveness.
Recovery capability matters as much as prevention
Two businesses with similar risk profiles can have dramatically different outcomes based on recovery capability. Immutable backups with tested restores plus a practiced ransomware-recovery scenario typically reduce recovery time by weeks compared with untested writable backups.
Cyber insurance increasingly requires baseline controls
Coalition and Corvus cyber-insurance underwriting data from 2024-2025 shows that carriers now routinely require MFA on all remote access, EDR on all endpoints, and immutable backups as minimum conditions for coverage. Businesses that fail to meet these control requirements face policy exclusions, higher premiums, or outright denial of coverage. Closing the baseline control gaps simultaneously reduces attack risk and maintains insurability.
Common Mistakes
Treating risk profile as a prediction of an attack
A risk profile describes operational conditions relative to baseline controls; it does not predict that an attack will happen, is imminent, or is likely on any specific timeline. High-risk profiles can go years without incident; low-risk profiles can still be targeted by sophisticated actors.
Buying ransomware-protection tools without addressing fundamentals
Advanced ransomware-protection tools (deception platforms, ransomware-specific EDR features) add value on top of solid fundamentals; they do not substitute for missing MFA, untested backups, or absent training. The fundamentals come first.
Assuming small company size means low targeting risk
Verizon DBIR data consistently shows that businesses under 250 employees account for a substantial share of confirmed ransomware incidents. Automated attack tools scan for vulnerable endpoints regardless of company size, and smaller businesses typically have weaker controls, making them easier targets per dollar of attacker effort. Size provides no meaningful protection against automated targeting.
Industry Benchmarks
Source: Sophos State of Ransomware Report, Verizon Data Breach Investigations Report, and CISA ransomware advisory publications