Ransomware Didn’t Create the Problems. It Connected Them.
Ask the Trusted Advisors who sell cybersecurity what’s stickiest, and you’ll hear the same answer. AVANT’s own data backs them up, with nearly half (48%) of the security deals Advisors close leading to cross-sell compared with fewer than one in five (18%) when connectivity leads.
That’s because security has no finish line. It touches every device, application, user and vendor a customer has while the threats underneath it keep evolving. This can turn a single sale into an ongoing relationship.
It also makes security a reason customers choose to stay with a provider, or leave one. In ConnectWise’s 2025 State of SMB Cybersecurity report, 47% of SMBs said they’d switch providers for the right cybersecurity solution.
So whoever owns the security conversation tends to own the customer. If security isn’t part of your portfolio yet, that’s an opportunity worth a closer look.
As Cybersecurity Awareness Month continues, let’s take a real-world look at the why.
This story is about one organization where a ransomware attack exposed a chain of connected weaknesses, and what it took for the org to start rebuilding. The events described here are real, with certain details changed or removed to provide anonymity:
A Business That Couldn’t Stop
This organization was a regional senior-care operator with dozens of healthcare facilities across several states, thousands of employees, and hundreds of millions of dollars in annual revenue. The business was dependent on two things happening without interruption: residents receiving care, and the organization getting paid for that care.
The ransomware attack stopped both at the same time.
The Door Was a Trusted Vendor
The attack wasn’t any kind of dramatic zero-day exploit. It came through credentials belonging to a third-party vendor, and MFA for outside vendors was virtually nonexistent. Internal employees had MFA, but reauthentication could stretch into weeks instead of hours.
That’s a common weak spot. Third parties were involved in 48% of confirmed breaches in Verizon’s 2026 Data Breach Investigations Report, up from 30% the year before. Even in healthcare, they show up in roughly one out of every three breaches. Vendor access isn’t a footnote in vendor management. It’s part of the attack surface.
The Backups Existed. Recovery Didn’t.
The organization had backups. What was lacking was proof they could be restored. The backup environment had never been tested for immutability, and the attackers encrypted most of the backups along with production systems.
That’s the standard playbook now. In a 2024 Sophos survey of nearly 3,000 IT and security professionals, 94% of organizations hit by ransomware said attackers tried to compromise their backups, and recovery costs ran eight times higher when backups were compromised.
The organization had to rebuild major parts of its environment, including servers, email and software, but significant business records were lost for good.
One Outage, Three Crises
Processes across the organization had to move to manual workarounds. Residents missed physician appointments, and medication schedules were disrupted as staff tried to keep providing care without systems and records they had relied on.
At the same time, billing and collections stalled. Without current and historical billing records, pursuing money owed became slow and difficult. As cash tightened, the organization struggled to keep up with what it owed creditors.
A tech incident turned into a patient-care and cash-flow crisis at once.
Then the Next Breach Hit
While the org was still recovering, it was hit again; this time by an attack on a company it didn’t even control. Ransomware took down a critical claims-processing partner its payors relied on, and reimbursements slowed or stopped.
That raises an uncomfortable question for any customer: Which outside company could stop your cash flow even if your own network is running fine?
The Real Weakness Wasn’t a Missing Product
A closer look reveals that the deeper failure was organizational. Patient-care leaders focused on residents. Finance focused on billing and cash cycles. IT focused on keeping systems running. Vendor management and cybersecurity sat beside those instead of being built into them.
Everyone was likely doing their job, but no one owned a shared view of how care, technology, security, vendors and recovery fit together, and that left the whole business fragile.
What Came Next
The financial damage was severe, and the organization was pushed to the brink. Accuracy is important here: ransomware didn’t create its financial problems. It accelerated the pressure on a business that was already stretched.
Even so, resilience spending didn’t stop, because the business still had to operate. The organization:
- Rolled out managed MFA and identity and access management (IAM)
- Moved its IT help desk to a fully managed model
- Added managed detection and response (MDR) with SOC coverage and incident response
- Shifted backups to a service-provider model with stronger recovery protections
- Built and tested new disaster recovery and incident response plans
- Created a third-party risk management policy
And the work isn’t finished. Like most organizations coming out of a crisis like this, it still has projects on the roadmap, from tightening vendor oversight to strengthening network and access controls.
That’s what sticky looks like.
Look Past the First Problem
A Trusted Advisor looking only for the ransomware solution would have missed most of this opportunity. The first conversation might be about MFA, backup or MDR. The better discovery question is What else fails when that control fails?
Who can access the environment? Which vendors can interrupt operations? Can recovery actually be performed? Can staff keep serving customers, and can the business keep billing and collecting? Those questions open the door to identity, managed IT, detection and response, recovery, third-party risk, segmentation and privileged access.
The goal isn’t to stack products after a breach. You need to help customers design continuity across the business before the next dependency breaks.
How the Cybersecurity Assessment Finds It First
That’s the conversation AVANT’s Cybersecurity assessment tool is built to guide. Inside Pathfinder, it walks you and your customer through devices, applications, network, data and users, and the story above maps onto it almost point for point.
- The vendor door and the untested backups are the kinds of weaknesses that surface as critical gaps in the live Cyber Assessment, flagged now instead of after an attack. And because the assessment covers third-party risk management, vendor access gets a real look rather than being treated as a footnote.
- The recovery failure is covered directly, because the assessment goes past prevention into incident response planning, backup and recovery.
- The leadership silos are where the tool’s foundation matters. It’s built on NIST CSF 2.0, Govern included, so ownership and supply-chain risk are part of the conversation from the start. The exportable PDF then gives care, finance and IT leaders one shared picture of where they stand today and where they could be.
- The size of the opportunity comes into focus with annual value estimates for each opportunity based on customer size, so you know where to focus before the meeting.
- The unfinished work is why every assessment is saved. You can revisit it as your customer’s environment changes and bring your AVANT team in with one click when you’re ready for the next steps.
Ransomware didn’t create this organization’s problems. It connected them. The Advisors who find those connections first won’t just make a sale. They’ll keep a customer long-term.