Ransomware Claims Rose 23% in Q3 as Mimic Raises $27M for Kernel-Level Defense

Attack volume justifies expanded ransomware budgets beyond EDR

NCC Group recorded 2,865 ransomware victim claims in Q3 2026, up from 2,325 in Q2—a 23% quarterly increase. North America and Europe accounted for the largest share of reported activity. The figure measures publicly reported or claimed incidents, not confirmed successful intrusions or total financial loss, but the trajectory strengthens the case for expanding ransomware defense budgets beyond endpoint detection and response licenses.

The practical implication: procurement teams should quantify recovery-point objectives, recovery-time objectives, isolated backup capacity, restore testing frequency, and incident-response retainers rather than treating EDR as complete ransomware protection. A quarter-over-quarter increase of this magnitude supports investment in layered programs that combine endpoint prevention from CrowdStrike, Microsoft, SentinelOne, or Palo Alto Networks with immutable backup and recovery platforms from Veeam, Rubrik, Cohesity, Commvault, or Arcserve.

Mimic's $27M seed round backs kernel-level encryption blocking

Mimic raised a $27 million seed round led by Ballistic Ventures, with participation from Menlo Ventures, Team8, Wing Venture Capital, and Shield Capital. The company's approach uses "known-good enforcement" at the operating-system kernel level, where software interacts directly with system resources. Mimic positions itself against conventional EDR products that detect, investigate, and remediate suspicious activity after execution. Its stated differentiation is preventing ransomware encryption at the kernel layer rather than relying primarily on post-event detection.

Mimic enters a market dominated by endpoint platforms from CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, and Palo Alto Networks. It also competes indirectly with data-layer controls such as immutable snapshots, clean-room recovery, and application allowlisting. The funding makes Mimic a vendor to watch for high-value endpoints, legacy applications, and environments where encryption speed can outrun human or cloud-based detection.

Buyers should demand independent testing on encryption-blocking rates, false-positive rates, CPU overhead, support for Windows and Linux workloads, rollback behavior, and compatibility with existing EDR agents. No public enterprise pricing, customer count, or independently validated benchmark was disclosed. That makes Mimic a potential pilot candidate—not yet a defensible broad replacement for an incumbent EDR platform.

Arcserve packages ransomware protection and recovery for lean IT teams

Arcserve made its Ransomware Protection and Recovery Suites generally available, with two subscription tiers aimed at small and midsize organizations. The Core tier combines Arcserve Unified Data Protection Premium with Arcserve Cloud Cyber Resilient Storage. The Pro tier adds Arcserve Disaster Recovery Runbooks and the Rapid Ransomware Response Service. Existing Arcserve UDP customers can move to either tier at renewal without changing their current UDP configuration.

The packaged offering competes with integrated cyber-recovery platforms from Rubrik, Cohesity, Commvault, Veeam, and Dell Data Protection. Arcserve's differentiator is bundling protected recovery points, recovery validation, runbooks, and response services into tiers for lean IT teams. The company says both tiers cost less than purchasing the included products and services separately, but the announcement does not disclose list prices or per-workload rates.

New buyers should compare not only subscription price but also immutable-storage duration, cloud egress fees, restore throughput, recovery orchestration, ransomware scanning, and the number of included incident-response hours. The lack of disclosed pricing, customer counts, restore benchmarks, and independently verified recovery results makes the announcement commercially relevant but quantitatively thin. Buyers should require a proof of restore using production-scale datasets before committing.

What to watch: prevention and recovery, not one or the other

The market is moving toward two defenses simultaneously: pre-encryption endpoint prevention, represented by Mimic's kernel-level approach and $27 million financing, and operationally packaged cyber recovery, represented by Arcserve's Core and Pro suites. Enterprise procurement should not choose between these categories.

The practical buying test is whether a platform can both stop or contain encryption quickly and restore verified clean data within the organization's stated RTO, with independently measured results and transparent total cost. The 2,865 reported victim claims in Q3 and the 23% quarterly increase justify investment in both layers. Buyers who fund only endpoint prevention or only backup-and-recovery remain exposed to either encryption that outruns detection or recovery that takes longer than the business can tolerate.