For years ransomware made the news through large organisations. Hospitals, airlines, public administrations. The 2026 data tells another story and it reads directly for any audit team. When Verizon analysed more than 22,000 confirmed breaches across 145 countries for its annual report, ransomware appeared in 48% of them, four points more than the year before.

There is a second figure that lands on the same number and widens the scope of the work. Breaches involving a third party are now 48%, and supply chain breaches grew 60% in a year. The incident happens at the supplier and the impact reaches the organisation that hired them.

In Spain, INCIBE handled 122,223 incidents in 2025, 26% more than the year before, and 392 of them were ransomware cases.

Where it comes in

Not where it used to. For the first time in nineteen years of the report, vulnerability exploitation overtakes credentials as the leading entry point, with 31% of breaches against 13% for credential abuse. One in three attacks comes in through something published, with a patch available and not applied.

That moves the focus of the review. It is not an awareness matter, it is the patching window on anything facing the internet, and it is tested with evidence inside the organisation and at its critical suppliers.

The damage is no longer downtime

Today's attack adds a layer. Before encrypting, attackers copy the data and threaten to publish it or to contact customers directly. Restoring backups no longer closes the incident, because what they took is still out there, and with it the notification to the data protection authority and the conversation with the people affected.

69% of victims did not pay the ransom. More organisations can say no. You say no with backups that work.

Four tests that produce evidence

  1. Patching of anything internet facing. A committed window for VPN, firewall, mail and any exposed service, plus evidence of the last cycle. That is where one in three attacks comes in.
  2. Second factor on all remote access and on email. The test is coverage across the full user population, supplier accounts included, not the written policy.
  3. Backups off the network and tested. Ask for the date of the last tested restore, who ran it and how long it took. Without that date the control is not demonstrated.
  4. Supplier inventory and access. What each critical supplier holds up, who connects from outside and with which privileges. You cannot protect what is not in the inventory.

The first three are tested in house. The fourth crosses the contract boundary, which is where the obligation arrives by the route described in NIS2 and the supply chain.

The conclusion for the annual plan is simple. Ransomware is not a security job that audit watches from a distance. It is four concrete controls, inside and outside the organisation, and all of them leave evidence.