Ransomware Has Changed and Your Defenses Need to Change With It
KnowBe4, Wednesday, August 19th, 2026
KnowBe4's Erich Kron argues ransomware is now a business disruption model built on stolen identities and social engineering.
KnowBe4's Erich Kron argues that ransomware has stopped being primarily a malware problem. For years the model was straightforward: a user clicked something bad, files were encrypted, a ransom note appeared, and everyone had a bad week.
That version still exists, but the dominant model is now business disruption built on stolen identities and social engineering rather than on a malicious attachment.
Attackers increasingly log in with valid credentials rather than breaking in. The post argues defenses built around malware detection miss the path attackers actually take.