Staying Ahead of the Ransomware Industry
September 25, 2026 – Published on Security Magazine
Mark Lance, SVP of Digital Forensics and Incident Response (DFIR) and Threat Intelligence at GuidePoint Security, shares with Security Magazine how ransomware is evolving — and how organizations can stay ahead.
Security Magazine: Tell us about your background and experience in the security
industry.
Lance: I’ve been in cybersecurity for nearly 27 years, with roughly the last 17 focused specifically on incident response. I first got into IT almost by accident, having built my first computer to play video games in college. While I was studying for my Microsoft certifications, a friend’s parent wanted to develop a security professional rather than hire one and gave me a shot at a managed security services startup. I came up through the analyst ranks, moving from analyst to senior, principal, and eventually to the first lead analyst the company ever had, because I’ve always had an inquisitive, puzzle-solving mindset that pulled me toward the investigative side of the work. From there I moved fully into incident response, eventually building out global IR functions at multiple companies, and over the years I’ve helped organizations respond to everything from business email compromise to ransomware to nation-state and APT activity. Today, as SVP of DFIR and Threat Intelligence at GuidePoint Security, that investigative instinct and technical background still drives how I approach the work.
Security: How have you seen ransomware evolve?
Lance: Ransomware started out very opportunistic, taking a shotgun approach aimed at individuals, locking their systems and demanding a ransom to get access back. Threat actors quickly realized organizations had deeper pockets and more to protect, so they shifted from individuals to companies, and then from broad targeting to deliberately going after specific organizations where operational impact would increase the odds of getting paid. As defenders matured and adopted backups, the actors adapted again by moving laterally, establishing persistence, and specifically targeting backups to take recovery off the table. When organizations responded with immutable and segmented backups, the actors pivoted to stealing data and threatening to publish it, which is how we arrived at the double-extortion model, and now even exfiltration-only extortion with no encryption at all. The through-line is that every time defenders raise the bar, the ransomware ecosystem evolves to protect its ability to monetize.
Security: What are the most effective entry points for malicious actors?
Lance: Despite all the new and novel techniques out there, the most effective initial entry points are still the old, foundational ones. We consistently see attackers get in through bad cyber hygiene, whether that’s unpatched systems, shadow IT, or exposed and vulnerable perimeter devices, along with successful phishing, lack of MFA, and more. The exploit or vulnerability may change, but the underlying methods to gain that first foothold have stayed remarkably consistent. Where we actually see the new and novel tradecraft is after they’re already inside, when they leverage that access to move laterally, tunnel, and exfiltrate data. In other words, they don’t need to reinvent how they get in when the basics keep working
Read More HERE.