What causes the most downtime in a ransomware incident?

Untested restoration, weak identity controls, no manual fallback for core operations, and leadership decisions that were never made in advance. The attacker matters less than the preparation.

What is the cheapest way to reduce cyber downtime risk?

Enforce MFA on finance and administrative accounts, test one backup restoration end to end, and write down who decides what in the first 72 hours. Little of that costs money.

The day the trucks stop: what downtime actually costs an operating business

For a distributor, a carrier, a manufacturer or a dealership group, the real cost of a cyber incident is not the ransom. It is the days the operation cannot run - and most of that cost is decided before the incident, by choices nobody wrote down.

Security coverage talks about data. Operating businesses run on motion: trucks dispatched, lines scheduled, parts ordered, deals funded. When ransomware hits a company like that, the breach headline is beside the point — the event that hurts is the operation standing still while everyone works out who decides what.

The confidence trap

In RSM's January 2026 survey of 501 midmarket executives, 96% said they felt good about their security posture. In the same survey, roughly one in four had taken a ransomware attack or demand within the year. Both numbers are real. The gap between them is where operating companies live: confident, busy, and untested.

What actually determines the length of your outage

Not the sophistication of the attacker. Four things, all decided in advance or not at all:

Whether identity was locked down. Most intrusions still walk in through accounts, and enforced MFA on the accounts that matter is frequently free. Only 23% of midmarket firms prioritize identity, per the same RSM report. It is the cheapest fix with the biggest downtime effect.
Whether restoration was ever tested. Nightly backups that have never been restored are a hope, not a plan. The test takes a day and turns a two-week outage into a two-day one.
Whether anyone can run the manual version. The companies that suffer least are the ones where dispatch, scheduling, or the parts counter can limp along on paper for 72 hours. That is an operations decision, not an IT one.
Whether leadership had already decided. Who calls the insurer and counsel, who talks to customers, what gets said in hour three. Hesitation at the top is the most expensive line item in any incident, and it never appears on an invoice.

The afternoon of work that changes the math

List the five systems the operation cannot run without. For each: who can restore it, has that restore been tested, and what is the paper fallback. Then enforce MFA on finance and admin accounts if it is not already on. None of that requires buying anything, and it moves more downtime risk than most six-figure tools.

If you want the whole picture ranked and costed, that is what the Exposure & Opportunity Review produces. If the question arrived stapled to an insurance renewal, start with what carriers now ask for.

Ask about your situation More articles