The encryption stage is the point in a ransomware operation when the attacker’s tool begins locking files or systems, usually by encrypting data so normal access is lost. This is the most visible moment of extortion because it turns a hidden intrusion into an obvious business disruption, often paired with a ransom note or recovery demand.
It matters in cyber security because it is often the last step, not the first. By the time encryption starts, attackers may already have stolen credentials, moved through the network, or disabled defenses. For defenders, the encryption stage is a sign of an active incident, but the better warning signs appear earlier: unusual logins, privilege escalation, lateral movement, and suspicious file activity. Monitoring and response should focus on those pre-encryption indicators so teams can stop the attack before files are locked.