The main points of entry into any business for ransomware is through Remote Desktop Protocol or other remote access mechanisms, phishing emails and software vulnerabilities. Knowing that these are the three main mechanisms is a huge help in focusing the scope of where to invest the most effort to be resilient from an attack vector