CISA groups ransomware initial access into six categories: internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, precursor malware, advanced social engineering, and third parties or managed service providers. Each has a specific control that closes it, so you can work through them one at a time.
1. Internet-facing vulnerabilities and misconfigurations
Anything reachable from the internet is a candidate. CISA's guide advises you not to expose services such as remote desktop on the web, to patch internet-facing systems, and to scan for vulnerabilities. The NCSC adds that firewalls and VPN products deserve prompt patching.
Start with an inventory. You cannot patch what you do not know exists.
2. Compromised credentials
CISA recommends phishing-resistant MFA for all services, unique passwords of at least 15 characters, separate administrator accounts, and least privilege. The NCSC suggests that administrators should not use privileged accounts for email and web browsing.
3. Phishing
The guide recommends awareness training, flagging external email, attachment filters, DMARC, and disabling macros in Office files received by email. It also notes that password-protected archives can slip past scanning.
4. Precursor malware
CISA names QakBot, Bumblebee and Emotet as common precursors to ransomware, and lists Dridex and Anchor among dropper examples to hunt for. A commodity infection today can be a ransomware incident next month, so treat it as more than a cleanup job.
5. Advanced social engineering
The guide lists this as its own category. A call to a help desk asking for a password reset is the practical example. Controls here are process controls: verify identity out of band before resetting credentials or MFA for anyone, and write that procedure down.
6. Third parties and managed service providers
CISA advises applying least privilege to third parties and managed service providers. Review which vendors have standing remote access into your network, and whether that access is logged, limited and removable.
Where to start
If you can only do two things this quarter, close exposed remote access and move administrators to phishing-resistant MFA. Those two address categories one and two. That ordering is a judgement call, not a statistic, so adjust it to your own incident history.
For the software side of category one, Safeguard's dependency scanning and reachability analysis can show which known vulnerabilities in your own applications are exploitable in practice. You can try the free scan at https://gold.safeguard.sh/scan.
Quick check
Is phishing the main way in?
CISA lists it as one of six categories without ranking them. Do not assume your own exposure matches an average. Check your own incident history and external attack surface.
Do third parties really belong on the list?
Yes. CISA names third parties and managed service providers as a distinct initial access route, so their access needs the same least privilege rules as staff.
Sources
Last reviewed: 19 October 2026.
