There are definitely strategies that significantly reduce the cost of such an attack - one being append-only backups of a sufficient frequency and with a fast e

There are definitely strategies that significantly reduce the cost of such an attack - one being append-only backups of a sufficient frequency and with a fast enough restore time. We have the tech to do this cheaply (mount user shares via ZFS-backed NFS, for example) but I’m not sure many places have the organizational competence to implement something so simple and effective. They need to spend 100x more money on something 10% as useful. It’s also possible to eliminate these attacks entirely, but it probably requires corporate tech infra that looks totally different from what most orgs now. If it were my job to set up some sort of hardened corporate setup, my first step would probably be to restrict most employees to iPads. There’s not really any reason a shift manager at a meat packing plant or whatever needs or benefits from a Windows box.