What is Ransomware Target Risk Profile?
A ransomware target risk profile assesses how a business compares against the targeting patterns and security gaps that ransomware actors commonly exploit. It considers industry, company size, MFA coverage, backup design, security-awareness training, endpoint protection, remote-access security, patching cadence, and cyber-insurance posture. The output is a directional risk profile relative to industry-baseline controls, not a prediction of an attack.
The Formula
Risk Profile = (Industry) + (Company Size) + (MFA Coverage) + (Backup State) + (Training) + (Endpoint Protection) + (Remote Access) + (Patching) + (Cyber Insurance)
Sophos State of Ransomware research consistently identifies industry, observable security gaps, and recovery capability (rather than randomness) as the dominant factors in ransomware targeting and outcomes.
Worked Example
A 120-employee manufacturing business has MFA on critical applications only, untested writable backups, annual training, business antivirus, VPN with MFA, monthly patching, cyber insurance but unclear on controls requirements.
- Industry: manufacturing (elevated targeting)
- Company Size: 120 (elevated)
- MFA Coverage: critical apps only (elevated)
- Backup State: untested writable (high risk)
- Training: annual (elevated)
- Endpoint Protection: business antivirus (elevated)
- Remote Access: VPN with MFA (moderate)
- Patching: monthly (moderate)
- Cyber Insurance: unclear controls (elevated)
📌 Risk profile lands in the elevated-to-high band. This is not a prediction of an attack; it is a description of operational gaps relative to industry-baseline controls. Highest-leverage fixes for risk reduction: complete MFA across every application, move to immutable backups with tested restores, upgrade to EDR plus quarterly awareness training, and confirm cyber-insurance controls requirements. A 90-day remediation with a cybersecurity firm typically closes the highest-leverage gaps.
Why This Matters
Ransomware targeting is patterned, not random
Sophos State of Ransomware research and incident-response practice consistently show that ransomware actors target based on industry, observable security gaps, and visible attack-surface exposure rather than choosing victims randomly. Reducing observable gaps materially reduces targeting attractiveness.
Recovery capability matters as much as prevention
Two businesses with similar risk profiles can have dramatically different outcomes based on recovery capability. Immutable backups with tested restores plus a practiced ransomware-recovery scenario typically reduce recovery time by weeks compared with untested writable backups.
Common Mistakes
❌ Treating risk profile as a prediction of an attack
A risk profile describes operational conditions relative to baseline controls; it does not predict that an attack will happen, is imminent, or is likely on any specific timeline. High-risk profiles can go years without incident; low-risk profiles can still be targeted by sophisticated actors.
❌ Buying ransomware-protection tools without addressing fundamentals
Advanced ransomware-protection tools (deception platforms, ransomware-specific EDR features) add value on top of solid fundamentals; they do not substitute for missing MFA, untested backups, or absent training. The fundamentals come first.
Industry Benchmarks
| Category | Good | Average | Poor |
|---|---|---|---|
| Industry targeting pattern (Sophos data) | Lower-target industries (general SMB, retail) with strong controls | Mid-target industries (manufacturing, education, professional services) | High-target industries (healthcare, financial services, government) with weak controls |
| Backup recovery capability | Immutable plus tested quarterly plus practiced ransomware scenario | Off-site backups with annual tests | Untested writable backups |
| Cyber insurance posture | Insurance plus all controls requirements met plus annual review | Insurance with most requirements met | No insurance or unclear on requirements |
Source: Sophos State of Ransomware Report, Verizon Data Breach Investigations Report, and CISA ransomware advisory publications
Benchmark data sourced from Sophos State of Ransomware Report, Verizon Data Breach Investigations Report, and CISA ransomware advisory publications.