Buyer’s Guide: Ransomware Protection

KuppingerCole’s Buyer’s Guide on endpoint-based ransomware protection is designed to streamline vendor selection by clarifying primary use cases, key functional and non-functional criteria, prerequisites, and targeted vendor questions. It is positioned as a strong starting point—not a complete procurement blueprint—and emphasizes that a full anti-ransomware architecture also requires network-layer defenses such as perimeter firewalls, web application firewalls, and email gateway scanners.

The guide frames ransomware as malware that locks screens or encrypts data and highlights why prevention matters: detection is often “easy” only after compromise, leaving organizations with poor options—paying (discouraged and unreliable) or wiping and restoring from backup. Because backups are sometimes missing, outdated, or slow to restore, the guide argues for prioritizing prevention while maintaining tested backup/restore processes because no tool is fully effective.

It identifies major ransomware delivery paths, especially weaponized Microsoft Office documents delivered via phishing, with additional risk from drive-by downloads and malvertising. It stresses enterprise-wide endpoint coverage (including servers and virtual desktops), notes Windows as most vulnerable while Android threats are rising, and states that iOS and Mac are not immune.

For evaluation, the guide provides five top use cases (data loss, productivity loss, hardware destruction, endpoint management, and compliance) and outlines 20 high-impact functional criteria such as multi-engine detection, heuristic pre-execution analysis, sandboxing/VM execution, crypto-API and filesystem monitoring, file-less malware detection, agent autonomy, telemetry/dashboards, and security intelligence integration. It adds 10 non-functional criteria (deployment options, vendor scale and focus, testing participation, partner ecosystem, documentation, responsiveness, roadmap, and price), plus technical and organizational prerequisites (endpoint management maturity, integration planning, defined ownership, incident response, processes, risk-based policies, and awareness training) and a concise set of vendor questions to expose product maturity and fit.

• The Buyer’s Guide focuses on ransomware protection on the endpoint rather than providing a complete anti-ransomware architecture.
• A complete anti-ransomware architecture includes network-layer defenses such as content-aware perimeter firewalls, web application firewalls, and email gateway scanners.
• Many outlets predict ransomware will be a $1 billion-dollar business this year.
• Ransomware either locks users’ screens or encrypts users’ data and demands payment for control restoration or decryption keys.
• Weaponized Microsoft Office documents delivered via phishing campaigns are the most common delivery method described.
• Drive-by downloads and malvertising are listed as less common infection paths.
• Windows platforms are described as the most vulnerable, with increasing amounts of ransomware for Android.
• iOS and Mac devices are described as not immune from ransomware or malware in general.
• Once infected, stated recovery options include paying the ransom or wiping the machine and restoring from backup.
• Most vendor products’ endpoint agents can be delivered via Microsoft SCCM.

• “This document is not a complete guideline for selecting vendors, but should provide an excellent starting point to streamline the decision-making process.”
• “Needless to say, but paying the ransom only emboldens the perpetrators and perpetuates the ransomware problem.”
• “Thus, preventing ransomware infections is preferred.”
• “However, no anti-malware product is 100% effective at prevention.”
• “It is still necessary to have good, tested backup/restore processes for cases where anti-malware fails.”
• “Most ransomware attacks arrive as weaponized Office docs via phishing campaigns.”
• “It is important to remember that Apple’s iOS and Mac devices are not immune from ransomware, or malware in general.”
• “These are the criteria that, from our experience, are best suited to separate the wheat from the chaff in the first.”
• “We see many situations that struggle not because of technical weaknesses and wrong products, but because of a lack of organizational maturity.”
• “The endpoints themselves are the place where the last stand will occur between ransomware and the users’ computers.”