Hi, I'm from IT.

Your Next Ransomware Attack Starts Here.

Your next ransomware incident might begin with someone offering to fix your computer.

On October 29, Cisco Talos published its Q3 incident-response report.

Attackers impersonated IT help desks and persuaded employees to grant remote access through legitimate support tools.

Three findings deserve executive attention:

• Phishing appeared in 37% of Talos response engagements.
• Ransomware and pre-ransomware activity represented 27%.
• Insufficient logging created visibility gaps in more than 40%.

These figures describe Talos’s response cases during Q3 2026, rather than the entire market.

My takeawayMake verified support the standard, and make verification easy.

Ask your team to:

• Verify unexpected support requests through a known internal channel.
• Require an authenticated support workflow before remote access.
• Restrict remote-support tools to approved users and purposes.
• Require phishing-resistant authentication for privileged access.
• Preserve security logs beyond the affected device.
• Test the process with employees and support providers.

Training should reinforce these controls.

Employees should receive clear instructions and support when they pause a suspicious request.

Security is a leadership responsibility.

Your support process belongs in the review.

Would your employees know how to verify an unexpected call from “IT”?