The Best Ransomware Protection for 2023

People create malware for one reason—to make money—but they take various approaches to raking in cash. Bot herders spread their infestation far and wide, creating an army of compromised computers that they rent out for nefarious purposes. Some write Trojans that look like useful programs but steal your passwords in the background; if they get a financial password, you’re in trouble. As for ransomware writers, they go straight for the money. “Pay us now, or you’ll never get your files back!” (Pro tip: If you do suffer a ransomware attack, tell the FBI about it—they can help!) Given the dire nature of this attack, you need to make sure your antivirus handles ransomware well, and consider adding ransomware-specific protection as another layer of defense.

It’s even worse when your business gets attacked by ransomware. Depending on the nature of the business, every hour of lost productivity might cost thousands of dollars, or even more. Fortunately, while ransomware attacks are on the rise, so are techniques for fighting those attacks.

Read on for our reviews of the top tools you can use to protect yourself from ransomware. After that, we’ll dive deeper into what ransomware is, as well as what to look for in deciding the right protection for you.

Bitdefender Antivirus Plus

Best for Multi-Layered Ransomware Protection

Why We Picked It

Bitdefender Antivirus Plus is a top choice for general-purpose malware protection, with consistently excellent scores from the independent testing labs and top scores in most of our hands-on tests. Among the many security bonuses that justify the “Plus” in its name is a multi-layered system of ransomware detection and remediation. If the behavior-based detection system gets any hint of a problem, the remediation system makes secure backups of important files.

Bitdefender’s real-time malware protection wiped out all my ransomware samples, so I turned off that protective component and tried again. In hands-on testing with from-the-wild samples, Bitdefender detected every single file-encrypting ransomware threat. It did miss one sample designed to encrypt the whole disk, but remember—that sample only got a chance to run because I turned off the regular antivirus.

Who It’s For

Does installing a separate ransomware protection program seem like an imposition? Do you feel like an antivirus utility should simply take care of the problem? Bitdefender Antivirus Plus is just what you need, combining an award-winning antivirus engine, a set of features specifically aimed at ransomware protection, and a boatload of security bonus features.

PROS

• Outstanding scores in independent lab tests and our phishing protection tests
• Multi-layered ransomware protection
• Isolated browser for banking safety
• Active Do Not Track
• Offers a VPN
• Many security-centered bonus features

CONS

• Unlimited VPN access requires separate subscription
• Remarkably slow first full scan

Webroot SecureAnywhere AntiVirus

 Best for Reversing Ransomware Effects

Why We Picked It

Webroot SecureAnywhere AntiVirus doesn’t work like most antivirus tools. Oh, it does wipe out malicious programs that it recognizes, and it sends known valid programs on their way with a pat on the head. But when it encounters an unknown program, it virtualizes and journals any system changes by the program, prevents any irreversible actions (such as sending your data to an unknown server), and sends telemetry to the big Webroot brain in the cloud. If the cloud returns a guilty verdict, Webroot wipes out the malicious program and rolls back all its actions.

On the one hand, this emphasis on cloud analysis means Webroot is the tiniest antivirus around in terms of disk space used, and its scans run very quickly. On the other hand, the fact that it can take a while to get a judgment on an unknown program means it’s not compatible with most third-party tests.

Webroot quickly eliminated all my ransomware samples. The only way I could test its protection was to create new, never-before-seen modified versions of those samples. Some of the modified files just didn’t perform, perhaps due to internal integrity checks. Webroot caught most of the rest, wiping out the ransomware and restoring encrypted files.

Who It’s For

Like Bitdefender, Webroot is an antivirus with ransomware protection built in, so you don’t have to layer on separate ransomware protection. Its small size and speedy scans will appeal to those with a preference for efficiency.

PROS

• Near-perfect score in our malware protection and phishing protection tests
• Light on system resources
• Fast scan, tiny size
• Can remediate ransomware damage
• Advanced features

CONS

• Limited lab test results due to unusual detection techniques
• Mixed results in testing with hand-modified ransomware
• Firewall component not working at this time

Acronis Cyber Protect Home Office

Best for Ransomware File Recovery

Why We Picked It

In a very real way, backup is the ultimate security, and backup is the main function of Acronis Cyber Protect Home Office. Ransomware creators know this, and some design their nasty programs to attack both local files and backups—but Acronis actively prevents such attacks. In addition, it has its own malware and ransomware protection components built in.

Acronis isn’t an antivirus product, so it’s no surprise that the antivirus testing labs don’t include it. Its antivirus component earned a range of scores in our hands-on tests, from mediocre to excellent. To test ransomware protection, I turned off the usual real-time antivirus before releasing ransomware samples. The ransomware-specific detection layer caught all the samples and restored all affected files, pulling clean copies from backup as necessary.

Who It’s For

If your documents are of utmost importance and you don’t want to take even the slightest chance that ransomware might take them from you, Acronis is a great choice. Behind everything else it does to keep your files safe, there’s the ultimate security of a full backup.

PROS

• More backup tools than any other app
• Local and cloud backup options
• Full disk image backup and restore
• Includes file syncing
• Protects against ransomware and malicious URLs

CONS

• Some cutting-edge technology may be risky to use
• Disk-cloning feature didn’t work in our tests
• Performance issues with upload speed and mobile apps
• Poor phishing and middling malware blocking results

Check Point ZoneAlarm Anti-Ransomware

Best for Dedicated Ransomware Protection

Why We Picked It

A few years ago, dedicated ransomware protection seemed like an up-and-coming security category. Check Point ZoneAlarm Anti-Ransomware was one of almost a dozen such products. Fast forward to today and most competitors are gone, but ZoneAlarm soldiers on. Speaking of soldiering on, part of ZoneAlarm’s behavioral detection strategy involves strewing “bait” files around your system as cannon fodder, hoping they’ll take any ransomware hits instead of your valuable files.

ZoneAlarm’s antivirus includes some elements of ransomware protection, enough that I had to disable the antivirus portion before I could directly test the ransomware system. In testing, ZoneAlarm detected all my file-encrypting ransomware samples and recovered most affected files. One ransomware sample encrypted all the other samples—ZoneAlarm didn’t recover those, but then, executable files aren’t the usual target for ransomware.

Who It’s For

Say you’re perfectly happy with your existing choice of antivirus or security suites, but you’re not entirely sure how well it would protect against ransomware. Add ZoneAlarm to your arsenal and you have all bases covered.

PROS

• Successfully detects real-world ransomware attacks
• Restores files affected by ransomware
• Includes some antivirus features

CONS

• Routinely allows (and then reverses) file encryption
• Did not recover all files in testing

NeuShield Data Sentinel

Best for Cautious Users

Why We Picked It

Systems that rely on detecting ransomware behavior can potentially be fooled by the latest, cleverest attacks, leaving you defenseless. NeuShield Data Sentinel doesn’t even try to detect an attack—hey, the ransomware will announce itself with a ransom note. This unusual product focuses on recovering from a ransomware attack. Its One-Click Restore resets your Windows installation to a safe, malware-free configuration on reboot. After wiping out the threat you Revert protected files such as documents and pictures to a clean version saved by the program.

It’s true that One-Click Restore eliminates any files installed today along with the ransomware, and Revert may lose changes and edits that you made today. But losing a few changes is a lot less worrisome than losing all your important files.

In testing, Data Sentinel handled every file-encrypting ransomware attack I threw at it. In some cases, ancillary files like .CAB files and logs remained encrypted, but the system didn’t exhibit any problems. Note that Data Sentinel includes special handling for disk-encrypting ransomware, and its remote control console can handle screen locker ransomware.

Who It’s For

You’re a realist. You know that software isn’t perfect. Rather than hoping a behavior-based ransomware detector never misses, you plan for the worst, choosing a solution that can undo the attack. Right? Then NeuShield Data Sentinel is just what you’re looking for.

PROS

• Reverses changes made by file-encrypting ransomware
• Proved effective in hands-on testing
• Blocks actions of disk-encrypting ransomware
• Remote recovery breaks hold of screen-locking ransomware
• Multi-factor authentication available for settings

CONS

• Recovery discards changes made on the current day
• Some low-importance files not recovered

Sophos Home Premium

Best for Protecting Family Members

Why We Picked It

In the world of enterprise security, users don’t control their antivirus—it’s all done by the IT Security team, remotely. Sophos Home Premium brings that kind of remote control to consumers. You can install it on PCs or Macs belonging to your friends and family, and handle all configuration and problems remotely. No more driving across town to fix your grandparent’s PC! Best of all, this versatile, inexpensive product includes strong protection against ransomware.

Only one of the labs I follow has tested Sophos recently, but SE Labs(Opens in a new window) certified it at the tip-top AAA level. It earned perfect scores in our malware protection and malicious URL detection tests. Better still, even with regular antivirus protection disabled, the ransomware behavior detection system caught all but one of a dozen ransomware samples, and that one escaped only because it did not do anything. With no behavior, there’s no behavior-based detection.

Who It’s For

You love your family…and they love to call you when they hit a tech snag. Once you protect them all with Sophos Home Premium, you can handle any problems without ever leaving your Fortress of Solitude.

PROS

• Excellent scores in some hands-on tests
• Convenient mobile management app
• Protects against ransomware, keyloggers, exploits
• Remotely manages up to 10 PCs or Macs
• Inexpensive

CONS

• Limited results from testing labs
• Parental control and webcam protection limited
• So-so phishing test score
• Advanced features require uncommon tech expertise

Panda Dome Advanced

Best for Complete File Protection

Why We Picked It

Launch Panda Dome Advanced and you’re greeted with a soothing nature scene as the background for your security features. It’s a pleasant change from the common stark white or dark gray backgrounds. This is a full security suite, with antivirus, firewall, limited VPN, USB Vaccination, application allow-listing, a network scanner, simple parental control, and more. The suite didn’t do so well in my hands-on tests; overall it doesn’t compare to the best competitors. However, the Windows-only ransomware protection system stands out.

Many security products defend against ransomware by blocking all unauthorized changes to files in protected folders. When an unknown program tried to tweak a file, you get a warning, usually with an opportunity to trust or block access. Panda takes this protection to the next level, blocking all access to protected files. An unauthorized program can’t even look at your files. In testing, I confirmed that it works, both with unknown file-editing programs and with real-world ransomware.

Who It’s For

Some ransomware crews devise a double-edged attack. If you don’t pay the ransom, they won’t decrypt the files, but they also threaten the public release of those sensitive files. Sure, you’ll get your data back, but so will the rest of the world. If this thought alarms you, if having your files exposed would damage you as much as merely having them locked away, then Panda’s total hands-off protection system may be just what you need.

PROS

• Permission-based ransomware protection
• Parental content filter
• Includes firewall, VPN, USB vaccination
• Supports Windows, macOS, Android
• Calm, nature-themed user interface

CONS

• So-so protection against dangerous and fraudulent websites in testing
• Mediocre score in our malware protection test
• Expensive, especially on macOS and Android
• May allow ransomware to encrypt some files

Buying Guide: The Best Ransomware Protection for 2023

Where’s Kaspersky (and What Else Isn’t Here)?

You may have noticed that previous versions of this article mentioned Kaspersky and its Kaspersky Free product. Kaspersky is among the companies that maintain a collection of ransomware decryption tools for those who need them, and its free security tool is among the products that supplement day-to-day antivirus protection with behavior-based ransomware detection. Here’s what happened.

For years, Kaspersky has faced accusations and censure based on its Russian origins, though none of the accusations have come backed by hard evidence of malicious behavior. We at PCMag focused on the capabilities of the products, not on the brouhaha around the company. However, the current war in Ukraine has raised the stakes. Governments and third parties are cutting ties with Kaspersky. The FCC labeled Kaspersky a national security risk.

After consideration, we can no longer recommend that you purchase Kaspersky security products. We’ve left the reviews in place, with a warning, since they provide useful information. But at least for now, we’re removing Kaspersky products from our “best of” lists.

In addition, this article looks specifically at ransomware protection solutions that are available to consumers. There’s no point in including the free, one-off decryption tools, since the tool you need totally depends on which ransomware encrypted your files. Better to prevent the attack in the first place.

CryptoPrevent Premium, created when CryptoLocker was new, promised several levels of behavior-based ransomware protection. However, at the top security level, it inundated the desktop with bait files, and even at this level, several real-world samples slipped past its detection. We can’t recommend this tool in its current form.

We’ve also omitted ransomware solutions aimed at big business, which typically require central management or even a dedicated server. Bitdefender GravityZone Elite and Sophos Intercept X, for example, are beyond the scope of our reviews, worthy though these services may be.

It’s also worth noting that several years ago you could choose from a dozen or so standalone ransomware protection tools from consumer security companies, and many of those tools were free. Most of those have since vanished, for one reason or another. For example, Acronis Ransomware Protection used to be a free standalone tool, but now it only appears as a component in the company’s backup software. Likewise, Malwarebytes Anti-Ransomware now exists only as part of the full Malwarebytes Premium. As for Heilig Defense RansomOff, its web page used to say “RansomOff will be back at some point.” Now there’s no mention of the product.

Trend Micro telegraphed the end of life for its free, standalone RansomBuster product more than a year in advance. RansomBuster no longer exists as a separate product. However, its ransomware-fighting skills live on, embedded in Trend Micro’s full-blown antivirus utility.

A few ransomware protection tools come from enterprise security companies that decided to do the world a service by offering just their ransomware component as a freebie for consumers. And quite a few of those have also fallen by the wayside, as companies find that the free product eats up support resources. For example, CyberSight RansomStopper is no longer with us, and Cybereason RansomFree has likewise been discontinued.

Bitdefender Anti-Ransomware is gone for a more practical reason. While it existed, it took an unusual approach. A ransomware attack that encrypted the same files twice would risk losing the ability to decrypt them, so many such programs leave some kind of marker to avoid double-dipping. Bitdefender would emulate the markers for many well-known ransomware types, in effect telling them, “Move on! You’ve already been here!” This approach proved too limited to be practical. CryptoDrop, too, seems to have vanished, leaving the CryptoDrop domain name up for grabs.

How Does a Ransomware Attack Work?

The idea behind ransomware attacks is simple. The attacker finds a way to take something of yours and demands payment for its return. Encrypting ransomware, the most common type, takes away access to your important documents by replacing them with encrypted copies. Pay the ransom and you get the key to decrypt those documents (you hope). There is another type of ransomware that denies all use of your computer or mobile device. However, this screen locker ransomware is easier to defeat, and just doesn’t pose the same level of threat as encrypting ransomware. Perhaps the most pernicious example is malware that encrypts your entire hard drive, rendering the computer unusable. Fortunately, this last type is uncommon.

If you’re hit by a ransomware attack, you won’t know it at first. It doesn’t show the usual signs that you’ve got malware. Encrypting ransomware works in the background, aiming to complete its nasty mission before you notice its presence. Once finished with the job, it gets in your face, displaying instructions for how to pay the ransom and get your files back. Naturally, the perpetrators require untraceable payment; Bitcoin is a popular choice. The ransomware may also instruct victims to purchase a gift card or prepaid debit card and supply the card number.

It’s Surprisingly Easy to Be More Secure Online

As for how you contract this infestation, quite often it happens through an infected PDF or Office document sent to you in an email that looks legitimate. It may even seem to come from an address within your company’s domain. That seems to be what happened with the WannaCry ransomware attack a few years ago. If you have the slightest doubt as to the legitimacy of the email, don’t click the link, and do report it to your IT department.

Of course, ransomware is just another kind of malware, and any malware-delivery method could bring it to you. A drive-by download hosted by a malicious advertisement on an otherwise-safe site, for example. You could even contract this scourge by inserting a gimmicked USB drive into your PC, though this is less common. If you’re lucky, your malware protection utility will catch it immediately. If not, you could be in trouble.

Until the massive WannaCry attack, CryptoLocker was probably the best-known ransomware strain. An international consortium of law enforcement and security agencies took down the group behind CryptoLocker ages ago, but other groups kept the name alive, applying it to their own malicious creations.

(Credit: PCMag)

Can You Recover Ransomware Files?

Even if ransomware gets past your antivirus, chances are good that within a short while an antivirus update will clear the attacker from your system. The problem is, of course, that removing the ransomware itself doesn’t get your files back. The only reliable guarantee of recovery is maintaining a hardened cloud backup of your important files.

Even so, there’s a faint chance of recovery, depending on which ransomware strain encrypted your files. If your antivirus (or the ransom note) gives you a name, that’s a great help. Many antivirus vendors, among them Trend Micro and Avast, maintain a collection of one-off decryption utilities. In some cases, the utility needs the unencrypted original of a single encrypted file to put things right. In other cases, such as TeslaCrypt, a master decryption key is available.

The surest way to survive a ransomware attack is to maintain a secure, up-to-date backup of all your essential files. Beyond just backing up your files, Acronis Cyber Protect Home Office actively works to detect and prevent ransomware attacks. We expect to see similar features in other backup tools.

(Credit: PCMag)

CryptoDrop Anti-Ransomware maintained copies of your sensitive files in a secure folder that’s not visible to any other processes. Alas, CryptoDrop has vanished.

As noted, when Trend Micro detects a suspicious process encrypting a file, it backs up the file. If it sees a flurry of suspicious encryption activity, it quarantines the process and restores the backed-up files. ZoneAlarm also tracks suspicious activity and repairs any damage caused by processes that turn out to be ransomware.

NeuShield Data Sentinel takes an unusual approach. Given that ransomware must announce its presence to request the ransom, it makes no attempt to detect ransomware activity. Rather, it virtualizes file system changes to protected folders and lets you reverse all changes after an attack. To get rid of the ransomware itself, it rolls back the system to the previous day’s state. In testing, it proved effective, though you could lose one day’s changes to your files.

But really, the best defense against ransomware involves keeping it from taking your files hostage. There are several different approaches to accomplishing this goal.

What Are the Best Strategies for Fighting Ransomware?

A well-designed antivirus utility ought to eliminate ransomware on sight, but ransomware designers are tricky. They work hard to get around both old-school signature-based malware detection and more flexible modern techniques. It only takes one slipup by your antivirus to let a new, unknown ransomware attack render your files unusable. Even if the antivirus gets an update that removes the ransomware, it can’t bring back the files.

Modern antivirus utilities supplement signature-based detection with some form of behavior monitoring. Some rely exclusively on watching for malicious behavior rather than looking for known threats. And behavior-based detection specifically aimed at encryption-related ransomware behaviors is becoming more common.

Ransomware typically goes after files stored in common locations like the desktop and the Documents folder. Some antivirus tools and security suites foil ransomware attacks by denying unauthorized access to these locations. Typically, they pre-authorize known good programs such as word processors and spreadsheets. On any access attempt by an unknown program, they ask you, the user, whether to allow access. If that notification comes out of the blue, not from anything you did yourself, block it!

Of course, using an online backup utility to keep an up-to-date backup of your essential files is the very best defense against ransomware. First, you root out the offending malware, perhaps with help from your antivirus company’s tech support. With that task complete, you simply restore your backed-up files. Note that some ransomware attempts to encrypt your backups as well. Backup systems in which your backed-up files appear in a virtual disk drive may be especially vulnerable. Check with your backup provider to find out what defenses the product has against ransomware.

How to Detect Ransomware

During its lifespan, Cybereason’s free RansomFree utility had just one purpose: to detect and avert ransomware attacks. One very visible feature of this utility was its creation of “bait” files in locations typically targeted by ransomware. Any attempt to modify these files triggered a ransomware takedown. It also relied on other forms of behavior-based detection, but its creators were naturally reluctant to offer a lot of detail. Why tell the bad guys what behaviors to avoid? Alas, maintaining this free product for consumers proved impractical for the Enterprise-focused company.

Quite a few antivirus products use behavior-based detection to take down any ransomware that gets past your regular antivirus. They don’t use “bait” files; rather they keep a close eye on how programs treat your actual documents. On detecting ransomware, they quarantine the threat.

ZoneAlarm Anti-Ransomware also uses bait files, but they’re not as visible as RansomFree’s. And it clearly uses other layers of protection. It defeated all our real-world ransomware samples in testing, fixing any affected files and even removing the spurious ransom notes that one sample displayed.

Webroot SecureAnywhere AntiVirus relies on behavior patterns to detect all types of malware, not just ransomware. It leaves known good processes alone and eliminates known malware. When a program belongs to neither group, Webroot closely monitors its behavior. It blocks unknowns from making internet connections, and it journals every local action. Meanwhile, at Webroot central, the unknown program goes through deep analysis. If it proves to be malicious, Webroot uses the journaled data to undo every action by the program, including encrypting files. The company does warn that the journal database isn’t unlimited in size, and it also advises keeping all important files backed up. In our latest round of testing, Webroot successfully rolled back the actions of several real-world ransomware samples but let a couple of others slip past.

The main purpose of Acronis Cyber Protect Home Office is backup, of course, but this product’s Acronis Active Protection module watches for and prevents ransomware behavior. It uses whitelisting to avoid falsely flagging valid tools such as encryption software. It also actively protects the main Acronis process against modification, and it ensures that no other process can access backed-up files. If ransomware does manage to encrypt some files before being eliminated, Acronis can restore them from the latest backup.

(Credit: PCMag)

How to Prevent Ransomware

If a brand-new ransomware program gets past Trend Micro Antivirus+ Security, it won’t be able to do much damage. The Folder Shield feature protects files in Documents and Pictures, in local folders that represent online storage for file-syncing services, and on USB drives. Avast has added a very similar feature to Avast Premium Security.

Trend Micro also offers a ransomware hotline(Opens in a new window) that’s available to anyone, even noncustomers. On the hotline page, you can find tools to defeat some screen locker ransomware and decrypt some files encrypted by ransomware.

Panda Dome Essential and Panda Dome Complete offer a feature called Data Shield. By default, Data Shield protects the Documents folder (and its subfolders) for each Windows user account. It protects specific file types including Microsoft Office documents, images, audio files, and video. If necessary, you can add more folders and file types. And Panda protects against all unauthorized access, even reading a protected file’s data, so it balks data-stealing Trojans too.

Testing this sort of defense is easy enough. We wrote a very simple text editor, guaranteed not to be whitelisted by the ransomware protection system. We attempted to access and modify protected files. And in almost every case we verified that the defense worked.

How to Make Ransomware Pass You Over

Ransomware perpetrators lose credibility if they fail to decrypt files for those who pay the ransom. Encrypting the same set of documents multiple times could make it difficult or even impossible to perform that decryption. Hence, most ransomware programs include a check to make sure they don’t attack an already-infected system. For example, the Petya ransomware initially just checked for the presence of a certain file. By creating a fake version of that file, you could effectively vaccinate your computer against Petya.

Bitdefender Anti-Ransomware, during its existence, very specifically prevented infestation by TeslaCrypt, BTC-Locker, Locky, and that first edition of Petya. It had no effect on Sage, Cerber, later versions of Petya, or any other ransomware family. And it certainly couldn’t help against a brand-new strain, the way a behavior-based detection system can. These limitations, along with the ever-changing nature of malware, caused Bitdefender to withdraw the tool, relying instead on the powerful ransomware protection of its full-scale antivirus.

The most obvious way to test ransomware protection is to release actual ransomware in a controlled setting and observe how well the product defends against it. However, this is only possible if the product lets you turn off its normal real-time antivirus while leaving ransomware detection active. Of course, testing is simpler when the product in question is solely devoted to ransomware protection, without a general-purpose antivirus component.

In addition, ransomware samples are tough to deal with. For safety, we run them in a virtual machine with no connection to the internet or network. Some won’t run at all in a virtual machine. Others do nothing without an internet connection. And they’re just plain dangerous! When analyzing a new sample, and determining whether to add it to the collection, we keep a link open to a log folder on the virtual machine host. Twice now we’ve had a ransomware sample reach out and start encrypting those logs.

(Credit: PCMag)

KnowBe4 specializes in training individuals and employees to avoid getting hit by phishing attacks. Phishing is one way malware coders distribute ransomware, so developers at KnowBe4 created a ransomware simulator(Opens in a new window) called RanSim. RanSim simulates 10 types of ransomware attacks, along with two innocuous (but similar) behaviors. A good RanSim score is a plus, but we don’t treat a low score as a minus. Some behavior-based systems such as RansomFree don’t detect the simulation because no actual ransomware limits its activities to subfolders four levels below the Documents folder.

Getting your files back after an attack is good, but completely preventing that attack is even better. The products listed here take different approaches to keeping your files safe. Ransomware protection is an evolving field; chances are good that as ransomware evolves, anti-ransomware utilities will evolve as well. For now, ZoneAlarm Anti-Ransomware is our top choice for ransomware-specific security protection. It detected all of our ransomware samples, including the disk-encrypting Petya, and repaired all files damaged by the ransomware. If your budget doesn’t stretch to paying for a ransomware protection add-on, consider switching to an antivirus or security suite that includes a ransomware-specific protection layer, such as Bitdefender Antivirus Plus or Sophos Home Premium.