More sweeping isn't going to solve the problem. https://ericalexander.org/post/devops-and-ransomware/ https://ericalexander.org/post/devops-and-ransomware/ I

More sweeping isn't going to solve the problem. https://ericalexander.org/post/devops-and-ransomware/ https://ericalexander.org/post/devops-and-ransomware/ I maintain an open dataset on breaches: https://ericalexander.org/SecurityBreach/#/ https://ericalexander.org/SecurityBreach/#/ What does the data suggest? It suggests ransomware is criminal entities who've adopted APT tactics and tooling. Those tactics and tooling depend on active directory, along with bad domain admin practices. Get to zero domain admins and most ransomware tools and tactics won't work. Granted, they'll evolve. The bigger problem is a false sense of safety. Force ruggedization through cyber insurance policies that require bug bounty participation, where it's fair game to phish, and probe all perimeter systems.