The short version. Every ransomware defense is a detection bet: catch the encryption before it finishes. Sometimes you lose that bet, because a novel variant, a living-off-the-land technique, or a disabled agent got there first. When you lose it, the only thing that matters is how fast and how completely you can get your files back. Deterministic rollback from filesystem snapshots turns a lost detection bet into a bad hour instead of a bad quarter, and it works even against the attack your detector never saw.
Detection is a bet you will eventually lose
Ransomware defense is built on a single premise: notice the malicious encryption in progress and stop it before it finishes. Behavioral detectors watch for the tell-tale pattern, mass file reads followed by mass writes of high-entropy data, and kill the process mid-stream.
This works, often. It also fails, predictably, in the cases that hurt most. A never-before-seen variant has no signature. An attacker who encrypts slowly, or uses the operating system's own tools, may not trip the behavioral threshold. And the first thing capable intruders do is try to disable the security agent, so the detector that would have caught the encryption is not running when it starts. Detection is probabilistic, and against a motivated adversary the probability is not one.
Here is the strategic error most programs make: they pour everything into making the detection bet more likely to win, faster alerts, better models, more telemetry, and almost nothing into what happens when the bet loses. But losing the bet is not a rare edge case. It is the scenario in every ransomware incident that made the news. The question that decides your outcome is not "will detection ever fail," it is "when detection fails, how bad is it."
The metric that actually decides the outcome
When encryption completes on some of your files, two numbers determine whether this is an incident or a catastrophe: how much data you lose, and how long you are down. Everything else is commentary. A company that restores to five minutes ago in twenty minutes had a bad morning. A company restoring from last night's backup over three days, assuming the backups were not also encrypted, had a bad quarter and maybe a disclosure obligation.
Backups are the traditional answer, and they are necessary, but they are a coarse instrument for this. They are periodic, so you lose everything since the last one. They are slow to restore at scale. And they are a target: attackers hunt and encrypt backups precisely because they know they are the recovery path. Nightly backup is a floor, not a plan.
Decouple recovery from detection
The key move is architectural: stop making recovery depend on detection working. Instead of only trying to prevent the encryption, continuously preserve the ability to undo it, so that even a completely missed attack is reversible.
Modern filesystems give you the primitive for free. Copy-on-write snapshots, APFS on macOS, Btrfs and ZFS on Linux, Volume Shadow Copy on Windows, capture point-in-time states cheaply, because they store only what changed. Take them on a frequent cadence and you hold a fine-grained history of the filesystem. When ransomware encrypts files, the pre-encryption versions still exist in the snapshots. Recovery becomes: identify the affected files, roll them back to the last clean snapshot, done. In minutes, not days, and, critically, without needing to have detected the attack while it happened.
This changes the shape of the whole problem. Detection stops being the single point of failure. If the detector catches the ransomware, great, you stop it early. If it misses entirely, you still get your files back, because recovery never depended on detection in the first place. You have converted a bet you can lose into a bet whose downside is bounded.
The design has to be honest about a few things to be trustworthy:
- Cadence bounds your loss. Snapshots every few minutes bound worst-case loss to a few minutes. This is a tunable, measurable coverage guarantee, and it should be stated as one.
- The snapshots must be protected. If the attacker can delete the snapshot history the way they delete backups, the backstop is gone. Snapshot integrity is part of the design, not an afterthought.
- Rollback restores availability, not confidentiality. If the attacker exfiltrated data before encrypting, and modern ransomware usually does, rollback gets your files back but does nothing about the copy they already stole. It is a recovery control, not an anti-exfiltration control, and conflating the two is dishonest.
How Nemesis Blue approaches it
Nemesis Blue pairs detection with a recovery backstop built on the operating system's native copy-on-write snapshots, APFS, Btrfs, Volume Shadow Copy, so that a missed or slow-detected ransomware event is reversible rather than terminal. The snapshot cadence gives a bounded, stated worst-case data loss, and rollback targets the affected files rather than requiring a full-system restore, so recovery is measured in minutes.
It sits behind the same driverless, tamper-aware endpoint design covered elsewhere in this series: telemetry from the operating system's sanctioned streams rather than a kernel driver, and an out-of-band heartbeat so that an attacker disabling the agent is itself an alarm rather than a silent success. The detection layer tries to stop the encryption early. The recovery layer assumes it sometimes will not.
We draw the boundary plainly. This is deterministic recovery of availability. It bounds downtime and data loss from encryption. It does not undo data theft that already happened, and we do not market it as if it does. Against the double-extortion reality, rollback solves half the problem completely and is honest about the half it does not touch.
What to change in your ransomware plan
- Add a recovery metric to your program. Not just "can we detect it," but "when we miss it, what is our worst-case data loss and time to restore." If you cannot state those numbers, that is the gap.
- Get recovery granularity below "last night." Frequent snapshots turn a day of loss into minutes.
- Protect the recovery path. Snapshots and backups an attacker can delete are not a backstop. Assume they will try.
- Separate availability from confidentiality. Rollback handles downtime. Exfiltration is a different control and a different disclosure question. Plan for both, and do not let one hide the other.
The mature version of ransomware defense is not a better bet on detection. It is a program that expects to lose that bet occasionally and has made losing it survivable. Assume detection fails, and build so that when it does, you are back in minutes with your files intact.
Nemesis Blue pairs driverless detection with deterministic ransomware rollback from native filesystem snapshots, so a missed attack is reversible in minutes. nemesislabs.xyz