Even if ransomware gets past your antivirus, chances are good that within a short while, an antivirus update will clear the attacker from your system. The problem is, of course, that removing the ransomware itself doesn't get your files back. The only reliable guarantee of recovery is maintaining a hardened cloud backup of your important files. Even so, there's a faint chance of recovery, depending on which ransomware strain encrypted your files. If your antivirus (or the ransom note) gives you a name, that's a great help. Many antivirus vendors, among them Trend Micro and Avast, maintain a collection of one-off decryption utilities. In some cases, the utility needs the unencrypted original of a single encrypted file to put things right. In other cases, such as TeslaCrypt, a master decryption key is available. The surest way to survive a ransomware attack is to maintain a secure, up-to-date backup of all your essential files. Beyond just backing up your files, Acronis Cyber Protect Home Office actively works to detect and prevent ransomware attacks. We expect to see similar features in other backup tools. CryptoDrop Anti-Ransomware maintained copies of your sensitive files in a secure folder that's not visible to any other processes. Alas, CryptoDrop has vanished. As noted, when Trend Micro detects a suspicious process encrypting a file, it backs up the file. If it sees a flurry of suspicious encryption activity, it quarantines the process and restores the backed-up files. ZoneAlarm also tracks suspicious activity and repairs any damage caused by processes that turn out to be ransomware. NeuShield Data Sentinel takes an unusual approach. Given that ransomware must announce its presence to request the ransom, it makes no attempt to detect ransomware activity. Rather, it virtualizes file system changes to protected folders and lets you reverse all changes after an attack. To get rid of the ransomware itself, it rolls back the system to the previous day's state. In testing, it proved effective, though you could lose one day's changes to your files. Data443 Ransomware Remediation Manager also uses virtualization to keep ransomware from making permanent changes. Just reboot, and the ransomware is gone. Of course, you don't want to lose your own work, so Data443 maintains protected copies of documents, pictures, and the like. In testing, it detected and eliminated all active ransomware samples but didn't always recover files perfectly. But really, the best defense against ransomware involves keeping it from taking your files hostage. There are several different approaches to accomplishing this goal.