Is EDR enough to stop ransomware? What the 2025–2026 attacks actually show

The short answer, before the detail

No, EDR alone is not enough to stop ransomware in 2026, and that is not a knock on EDR. Endpoint Detection and Response is one of the most valuable controls a hospital or enterprise can run, and nothing here argues for removing it. The point is narrower and more uncomfortable. Ransomware operators have spent the last two years building their entire playbook around defeating, disabling, or simply sidestepping EDR, and the incident data shows they succeed often enough that it can no longer be the last line you rely on.

We will walk through what EDR does well, the specific ways attackers get around it, the real 2025–2026 incidents that prove the pattern, and what a resilient organization adds on top. Every figure below is sourced, and the references are listed at the end. If you take one thing away, let it be this: the question is not whether to run EDR. It is what you run alongside it.

What EDR is genuinely good at

It helps to be fair to the technology before criticizing it. EDR installs an agent on a managed endpoint, whether a laptop, workstation, or server, and watches process creation, file activity, registry changes, and network connections. When it sees something that matches a known-bad pattern or behaves like malware, it alerts, blocks, and gives responders a timeline to investigate. For commodity malware, phishing payloads, and a great many intrusions, that is exactly the right tool, and it stops attacks every day.

A hospital running good EDR on its Windows fleet is meaningfully safer than one without it. We are not here to sell you off EDR. We are here to explain why, when the CrowdStrike 2026 Global Threat Report found that 82% of detections in 2025 were malware-free, a control built primarily to catch malicious software is working with one hand tied behind its back.

Gap 1: Attackers simply don't bring malware anymore

The single biggest shift in the threat landscape is that modern ransomware intrusions increasingly involve no malware for EDR to detect. According to CrowdStrike's 2025 reporting, roughly 79% of initial-access activity now uses no malware at all. Attackers log in with stolen or purchased credentials and then operate using the tools already present on the system: PowerShell, WMI, rundll32, CertUtil, and the rest of the so-called "living off the land" toolkit.

To an endpoint agent, an administrator using PowerShell looks a great deal like an administrator using PowerShell. When the attacker is holding a valid credential and using sanctioned tools, there is often no obviously malicious binary to flag. The Picus Security Red Report 2026, which analyzed more than a million malicious files and tens of millions of adversarial actions, found that 80% of the top ten attacker techniques are now dedicated to evasion and persistence rather than to dropping detectable payloads. Ransomware actors have, in effect, optimized themselves against the thing EDR is best at.

Gap 2: They disable the EDR before they encrypt

When attackers do need to run a tool EDR would catch, a now-standard move is to turn the EDR off first. The technique is called "bring your own vulnerable driver" (BYOVD): the attacker loads a legitimately signed but flawed driver, exploits it to gain kernel-level control, and from there kills or blinds the security agent. These purpose-built tools are known in the trade as "EDR killers."

This is not theoretical. In April 2026, Cisco Talos and Trend Micro documented threat actors tied to the Qilin and Warlock ransomware operations using BYOVD to silence more than 300 different EDR and security products on compromised hosts, as reported by The Hacker News. CISA's November 2025 advisory update on Akira described the group deploying POORTRY malware to tamper with vulnerable drivers, create rogue administrator accounts, and bypass protections. More recently, Security Affairs documented Akira attempting to boot machines into Safe Mode specifically to start them without the EDR agent running. The pattern is consistent across unrelated groups because it works.

Gap 3: The devices that can't run an agent at all

Here is the gap that matters most in healthcare, and the one that gets the least attention: EDR requires an agent, and a large share of a hospital's attack surface cannot run one. Think of infusion pumps, imaging and PACS controllers, patient monitors, lab analyzers, building systems, and cameras. These connected devices run closed, embedded, or long-unsupported operating systems. You cannot install an endpoint agent on them, and in many cases the manufacturer's regulatory certification forbids you from modifying them at all.

Attackers have noticed. In a case first reported by BleepingComputer in March 2025, the Akira ransomware group was blocked by EDR when it tried to run its encryptor on the victim's Windows machines. So it scanned the network, found an unsecured webcam running a stripped-down Linux OS with no agent on it, and used that camera to launch the encryption attack across network file shares. The EDR did its job on the endpoints it could see. The attack succeeded anyway, because the decisive move happened on a device EDR structurally could not watch. For a hospital running ten to fifteen thousand such connected devices, this is not an edge case. It is the shape of the modern attack.

Gap 4: EDR detects, but ransomware is a race it often loses

Even when EDR does detect, speed is now the problem. CrowdStrike's 2026 report put the average "breakout time," the gap between an attacker's initial access and their first lateral movement, at just 29 minutes in 2025, with the fastest observed case at 27 seconds. Detection that generates an alert for a human analyst to triage is not operating on that clock. By the time someone reads the alert, the attacker may already be across the network.

Lateral movement is where ransomware is won or lost. One analysis cited by Threater found that 96% of incidents in which attackers successfully moved laterally still ended in ransomware deployment. Detecting the initial foothold is valuable only if you can contain the spread in seconds rather than minutes, and containment at network speed is not what endpoint agents were built to do on their own.

A real-world composite: how these gaps chain together

Put the pieces together and you get the attack pattern that defines 2025–2026. An operator buys valid VPN or RDP credentials, so there is no malware, no phishing payload, nothing for EDR to catch at the door (Gap 1). They move quietly using built-in Windows tooling, blending into normal admin activity. When they are ready to stage the encryptor and the EDR would finally see something, they load a vulnerable driver and disable the agent, or reboot into Safe Mode to start the host without it (Gap 2). If a stubborn endpoint still blocks them, they pivot to an unmonitored device such as a camera, a pump, or a scanner, and launch from there (Gap 3). The whole sequence can unfold faster than a human can respond to the one alert that did fire (Gap 4).

No single exotic exploit is required. Each step uses techniques now documented in CISA advisories and mainstream threat reports. That is precisely why "we have EDR" is no longer a complete answer to "are we protected from ransomware?"

So what actually closes the gap?

If the gaps are credential abuse, agent tampering, agentless devices, and response speed, then the additions that close them are equally specific. This is the layer HealShield / Immune is built to add on top of EDR, not to replace it.

We verify identity and behavior continuously at the network boundary, not just at login, so a valid credential behaving abnormally is caught even when no malware is present. We protect agentless devices at the network level, watching their traffic and quarantining a compromised camera or pump without needing an agent on it, and without shutting the device down in a way that could affect care. We assume the endpoint agent can be blinded, so we keep an independent, out-of-band detection and containment path that an attacker who owns one host cannot switch off. We contain at machine speed, with automatic isolation and microsegmentation that act in seconds and patient-safety gating for anything that touches clinical systems. And we make recovery a certainty through immutable, verified backups and orchestrated, clinical-order restoration, so that even a successful encryption becomes a contained incident rather than a shutdown.

• Continuous identity and behavior verification catches the 82% of malware-free, credential-driven activity EDR struggles with.
• Agentless device protection at the network boundary covers the webcams, pumps, and PACS that EDR cannot reach.
• Out-of-band detection and containment survives BYOVD "EDR killers" and Safe Mode evasion.
• Second-level containment beats the 29-minute (or 27-second) breakout clock.
• Immutable, verified, clinical-order recovery turns a breach into an incident, not a closure.

The bottom line

Keep your EDR. It is doing important work, and nothing proposed here weakens it. But the evidence from the last two years is unambiguous. Attackers now design ransomware campaigns specifically to operate where EDR is weakest: without malware, with the agent disabled, on devices that have no agent, and faster than human response. A security program that treats EDR as the finish line is defending against a 2020 threat model with a 2026 adversary.

The organizations that keep operating through a ransomware attack in 2026 are not the ones with the most endpoint agents. They are the ones that added identity verification, agentless coverage, tamper-resistant containment, and guaranteed recovery around the endpoint layer. That is the difference between detection and resilience. In healthcare, where downtime is a patient-safety event, resilience is the only standard that counts.

Related reading

If you want to go deeper on the themes here, we have written detailed companion pieces. For how attackers actually get past the endpoint today, read our breakdown of evasive ransomware and the EDR killers behind it. If you are weighing options, our guide to the right EDR alternative explains why the fix is a layer rather than a swap. And for the recovery half of the story, see what self-healing security really means and why endpoint rollback alone cannot deliver it.