Why Firewalls Alone Can’t Stop Ransomware?

The firewall remains one of the most widely deployed security tools in the enterprise. It screens incoming and outgoing traffic by IP address, port, and protocol—allowing port 80 web traffic while blocking port 3389 remote-desktop connections by default. Sounds robust. But the ransomware gangs that paralysed hospitals, manufacturers, and governments throughout 2025 barely glanced at it.

A landmark report from Barracuda Networks, drawing on more than two trillion IT events collected across 2025, found that 90 percent of ransomware incidents exploited firewalls through a classified CVE vulnerability or a compromised account—not by smashing through the front gate, but by slipping past it entirely. The fastest observed attack moved from initial breach to full encryption in under three hours.

This article examines, claim by claim, the six reasons a firewall alone cannot stop modern ransomware, corrects the one factual error that circulates in popular summaries of this topic, and closes with the layered framework that leading security teams are actually deploying.

1. Phishing Emails: The Primary Entry Point

The original article claims that phishing initiates “over 90 percent of intrusions.” The Sophos State of Ransomware 2025 report offers a more granular breakdown: 18 percent of 2025 ransomware attacks began with phishing (up from 11 percent in 2024), 32 percent via exploited vulnerabilities, and 23 percent via compromised credentials. Phishing is therefore not the dominant vector by count—but it remains the most visible and human-dependent one, and those three pathways are not mutually exclusive (phishing is often used to harvest the credentials exploited later).

The mechanism is accurate: a malicious Office macro or weaponised PDF downloads a PowerShell stager that installs a command-and-control implant—and because all of that traffic moves over legitimate HTTPS on port 443, a stateful firewall sees nothing abnormal. Groups such as LockBit, BlackCat/ALPHV, and RansomHub invest heavily in social-engineering research, harvesting LinkedIn profiles to craft convincing spear-phishing lures before a single packet is sent.

2. Remote Access Vulnerabilities

Since pandemic-era remote-work expansion, exposed VPN endpoints and Remote Desktop Protocol (RDP) services have become a primary hunting ground for ransomware operators. The original article references CVE-2022-40684 in FortiGate—a real and severe authentication-bypass flaw. A more recent illustration: the Qilin ransomware group exploited FortiGate vulnerabilities CVE-2024-21762 and CVE-2024-55591 between May and June 2025, achieving remote code execution on unpatched FortiGate and FortiProxy devices. CVE-2024-21762, patched in February 2025, remained exploitable on a significant number of internet-facing systems months later.

The structural issue is that a firewall verifies whether a connection can be established—it has no authority over what an authenticated session does afterward. A legitimate VPN login by a stolen credential looks identical to a legitimate VPN login by the real employee.

3. Flat Internal Networks Enable Lateral Movement

Once ransomware achieves its initial foothold, the internal network architecture determines how far it spreads. In most organisations with a traditional flat LAN, every workstation and server shares the same VLAN and can freely access shared folders and administrative services. Attackers use tools such as BloodHound to map Active Directory permissions, identify the domain controller within minutes, and then use legitimate Windows administration utilities—PsExec, WMI, PowerShell remoting—to move laterally without triggering network-based alerts.

A July 2025 breach of a US electric utility cooperative illustrates the pattern precisely: attackers entered via a phishing email to a facilities contractor, used native Windows tooling (a technique known as “living off the land”) to bypass EDR alerts, and ultimately encrypted SCADA control systems, forcing power outages across three counties. The firewall logs showed only normal VPN connections.

4. Encrypted Traffic Is Opaque to Traditional Firewalls

Modern ransomware command-and-control (C2) infrastructure overwhelmingly relies on HTTPS. Attackers increasingly route C2 traffic through legitimate cloud services—Google Drive, OneDrive, Dropbox, GitHub—so that even deep-packet inspection sees nothing more suspicious than “accessing Microsoft cloud services.” The widespread adoption of TLS 1.3 makes passive interception significantly harder, and many enterprises have abandoned SSL inspection due to the cost, complexity, and privacy concerns it introduces.

Unit 42 has documented the growing use of “EDR killers”—tools specifically designed to terminate endpoint-detection agents before the encryption phase begins—indicating that attackers are aware of and actively circumventing the compensating controls organisations have put in place.

5. Backup Strategies That Don’t Survive an Attack

Ransomware gangs have systematically evolved to target backup infrastructure. An attacker who gains domain-administrator privileges—often achievable within hours of initial access—can enumerate backup servers, delete shadow copies, and corrupt or encrypt backup repositories before the primary encryption payload runs. The median time from initial intrusion to ransomware execution was five days in 2025, giving adversaries ample time to locate and neutralise backups.

Multi-extortion has become the norm: over 7,500 unique victim organisations were listed on public data-leak sites in 2025, meaning that even organisations with intact backups faced pressure to pay to suppress stolen data from being published. This fundamentally alters the calculus—a clean restore does not end the incident.

Despite this pressure, the rate of ransom payment continued to fall: only 28 percent of victims paid in 2025, the lowest recorded rate, while the median payment jumped to roughly $59,600—reflecting a shift toward lower-volume but higher-impact targets.

6. The Human Factor

No technical control eliminates human-introduced risk entirely. Removable media, personal devices connected to corporate Wi-Fi, weak or reused passwords, and unguarded privileged accounts are recurring themes in post-incident reviews. Small and mid-sized organisations are disproportionately exposed: Mastercard’s 2025 SMB cybersecurity study found that nearly one in five SMBs that suffered a cyberattack filed for bankruptcy or closed, and 80 percent had to spend time rebuilding trust with partners and clients.

Awareness training works—but only when it is continuous, scenario-based, and measured. Annual compliance tick-box exercises do not modify behaviour. Quarterly simulated phishing campaigns with department-level metrics create meaningful accountability.

Fact-Check Summary

The following table evaluates the key factual claims in the original article against current evidence.

The Layered Defence Framework

Security professionals consistently advocate a defence-in-depth model. No single control is sufficient; the goal is to force attackers to defeat multiple, independent detection and prevention layers simultaneously. The following structure reflects what leading organisations implemented in 2025:

Perimeter

Next-generation firewalls with application-layer inspection, email security gateways with sandboxing, and Web Application Firewalls (WAF) for internet-facing services. These remain necessary but are the outermost—and most easily bypassed—layer.

Identity and Access

Mandatory MFA on all remote access and privileged accounts. Zero Trust Network Access replacing legacy VPNs. Privileged Access Workstations (PAWs) for administrative tasks. Regular access reviews to remove dormant accounts—Barracuda XDR data found that forgotten accounts and rogue devices were among the most exploited entry points in 2025.

Internal Network

Micro-segmentation of business units, OT environments, and cloud workloads. East-west traffic controls enforced by next-generation firewalls or software-defined networking. SMBv1, NetBIOS, and LLMNR disabled. Network detection tools monitoring for unusual lateral movement patterns.

Endpoint

Full EDR (Endpoint Detection and Response) deployment across servers, workstations, and critical OT devices. EDR tools such as CrowdStrike Falcon, SentinelOne, and Microsoft Defender for Endpoint observe process-level behaviour and can terminate malicious PowerShell chains before the encryption payload executes.

Detection and Response

XDR (Extended Detection and Response) correlates telemetry from email, endpoint, network, and cloud into a unified alert stream. SOAR (Security Orchestration, Automation, and Response) enables automated containment of compromised hosts within seconds of detection, dramatically reducing the blast radius of an active intrusion.

Backup and Recovery

Immutable, offline backups following the 3-2-1 rule. Recovery time objectives tested under realistic conditions at least quarterly. Incident response playbooks with pre-approved decision authority to avoid the sort of 16-hour approval delay that compounded the July 2025 utility breach.

People

Continuous security-awareness training with measurable outcomes. Regular phishing simulations. Principle of least privilege enforced as an organisational norm, not an aspirational policy. Insider-threat monitoring for accounts exhibiting anomalous access patterns.

Conclusion

Firewalls are not obsolete. They remain a foundational control—the rough equivalent of a deadbolt on a front door. But a deadbolt does not prevent someone from entering through the window, posing as a repairman, or copying a key. The ransomware ecosystem of 2025 is sophisticated, well-funded (Ransomware-as-a-Service kits now drive 73 percent of attacks), and specifically designed to route around perimeter controls.

The data is unambiguous: claimed ransomware victims rose 58 percent year-on-year in 2025; total breach costs now average five million dollars when downtime, legal exposure, and business interruption are included; and median attacker dwell time before encryption was as short as five days—enough time to map, escalate, and neutralise backups before a defender realises anything is wrong.

The organisations that fared best shared a common profile: they had replaced perimeter-only thinking with identity-centric, zero-trust architectures; they ran EDR everywhere; they maintained tested, immutable backups; and they invested in people as the first and last line of defence. The cost delta versus a baseline firewall-only posture is real but modest compared to the average $5M cost of a breach they did not have.

As the Barracuda XDR report put it: attacks are stealthy, and they target gaps. Close the gaps systematically—and the firewall, properly contextualised, can do the job it was always designed to do.