It’s a nightmare scenario for any user or organization: in the middle of an ordinary day, your screen is taken over by an alert that your data has been encrypted and your computer’s essential functions have been locked down. You have two choices: pay a ransom—or accept that you’ll never see your data again, including any sensitive or regulated information they may contain (which, in turn, may well be leaked or sold to the highest bidder). A countdown clock shows how little time you have left to make your decision. You may be able to determine later how it got to this point—a phishing email? An infected file or web page? An exploit kit?—but you’d do anything to have prevented it from happening in the first place. Fortunately, there are steps you can take now to lower the risk of ransomware, and to minimize its impact in the event of an attack.