By the time the ransom note appears, the attacker has been inside for weeks and your backups are already gone. Here is what actually works, ordered by what stops real attacks.
Most ransomware guidance is written as though the attack begins when the ransom note appears. It does not. By the time you see the note, the attacker has usually been inside the network for days or weeks, has already found and encrypted or deleted your backups, and has copied your data out before locking anything.
That sequence determines which defences actually work. Measures that assume you will detect the attack in progress are far less reliable than measures that assume you will not. This guide is organised around that assumption.
How the attack actually unfolds
The pattern is consistent enough to plan against:
- Entry. Usually a phishing email, a reused password on a service exposed to the internet, or an unpatched remote access system. Rarely anything exotic.
- Quiet expansion. The attacker moves between machines, collects credentials, and works out what the business does and what it can afford.
- Backup destruction. Deliberately, and first. Backups are the thing that makes the ransom optional, so they are the priority target.
- Data theft. Files are copied out before encryption. This creates the second threat: publication.
- Encryption. Triggered at the least convenient moment — typically a Friday evening or the start of a holiday.
Two things follow. Backups only help if the attacker cannot reach them. And paying for a decryption key does nothing about the copy of your data already sitting on someone else's server.
Backups: the only defence that reliably works
Everything else on this list reduces the chance of an incident. Backups determine whether an incident is a bad week or the end of the business. They deserve disproportionate attention.
The 3-2-1 rule, and why the "1" is the whole point
Three copies of your data, on two different types of storage, with one held offline or otherwise out of reach. The first two parts are widely followed. The third is the one that gets skipped, and it is the one that matters.
A backup drive permanently connected to the server is not a backup against ransomware — it is another folder to encrypt. A cloud sync folder is not a backup either: it will faithfully replicate the encrypted files over your good ones. What survives is a copy the compromised network cannot write to, whether that is immutable cloud storage, a rotated offline disk, or a backup account with separate credentials and multi-factor authentication. Setting up isolated, immutable backup storage is something our cloud infrastructure team configures regularly, and it is the control most worth getting right.
Test restores, not backup jobs
A green tick on a backup job means the job ran. It does not mean the data can be restored, that the restore completes before your business runs out of patience, or that anyone on the team knows the procedure.
Restore an actual file to an actual machine on a schedule, and once a year restore something substantial and time it. The number you want is how long it takes to get trading again — and finding out during an incident is the worst possible moment to learn that it is four days.
Closing the common entry routes
Multi-factor authentication on everything exposed
Email, VPN, remote desktop, and any administrative console. Stolen passwords are among the most common ways in, and multi-factor authentication makes a stolen password insufficient on its own. Prefer an authenticator app or a hardware key over SMS codes, which can be intercepted through SIM-swap attacks — a distinction we cover in our guide to two-factor authentication.
Patch the internet-facing systems first
Perfect patching everywhere is unrealistic for most small teams. Prioritised patching is achievable. Anything reachable from the internet — firewall, VPN, remote access, mail server, public web applications — should be patched promptly. Internal workstations can follow a slower cycle.
Remove standing administrator rights
Ransomware runs with the privileges of whoever executed it. A user who is a local administrator hands the attacker that level of access immediately. Day-to-day accounts should be standard users, with administrative access as a separate credential used only when needed. This single change limits the blast radius of most incidents.
Retire remote desktop exposed directly to the internet
Remote desktop published straight to the internet is scanned continuously and is a persistent entry route. Put it behind a VPN with multi-factor authentication, or replace it with a managed remote access service.
Training that changes behaviour
Awareness training frequently fails because it tells people to spot suspicious emails without acknowledging that modern phishing is not obviously suspicious. It is well written, correctly branded, and refers to a real supplier or invoice.
What works better is teaching a verification habit for a small number of specific actions: changing bank details, approving an unexpected payment, entering credentials after clicking a link, or acting on an urgent request from a senior colleague. In each case, confirm through a channel you already had — a known phone number, not the one in the email.
Equally important is making it safe to report. If an employee who clicks something fears blame, you lose the hours that matter most. The message should be that reporting a mistake immediately is the correct action and will never be punished.
Assume they will get in
Prevention is not perfect, so the second question is how far an intruder can travel once inside.
- Segment the network. Finance systems, the server room, and general workstations do not all need to reach each other. Flat networks let one compromised laptop reach everything.
- Limit file share access by role. An account can only encrypt what it can write to. Broad "everyone has access to everything" shares maximise damage.
- Turn on detection you already own. Most business endpoint protection can alert on mass file modification. It is frequently unconfigured.
- Keep an offline copy of the recovery plan. A plan stored only on the encrypted file server is not available when you need it.
If it happens
The first hour matters. In order:
- Isolate, do not power off. Disconnect from the network to stop spread, but leave machines running — shutting down destroys evidence in memory that helps identify what happened.
- Contact your insurer before anything else. Most cyber policies require notification before you engage responders, and acting first can invalidate cover.
- Assume data was stolen. Plan for notification obligations regardless of whether you recover the files.
- Report it. Notify your national cybercrime reporting body, and where personal data is involved, your data protection regulator. Most regulators set a notification deadline that starts the moment you become aware of a breach, so find out what yours is before an incident rather than during one.
- Rebuild rather than clean. Restoring onto compromised machines frequently results in a second incident.
On paying
Law enforcement advises against it, and the practical arguments are strong: decryption tools are often slow and incomplete, payment does not retrieve the stolen copy of your data, and paying identifies you as a business that pays. There are also sanctions considerations depending on who is behind the attack. The decision belongs to you and your insurer, but it should be made with those facts rather than under pressure at 2am.
Frequently asked questions
Is a small business really a target?
Yes, and not because anyone singled you out. Most attacks begin with automated scanning for exposed services and reused credentials. Smaller organisations are attractive precisely because defences are usually thinner, and many are compromised as a route into a larger customer or supplier.
Does antivirus stop ransomware?
It stops known variants. It does not reliably stop an attacker who has valid credentials and is using legitimate administrative tools, which is the common pattern. Treat it as one layer, not the plan.
Is cloud storage a backup?
Not by itself. Sync services replicate changes, including encryption. Some offer versioning and file recovery, which helps, but the retention period and whether an administrator can delete history determine whether it survives a determined attacker. Check both.
Does cyber insurance cover ransomware?
Frequently, though policies increasingly require specific controls — multi-factor authentication, tested backups, endpoint protection — as a condition of cover. Read those requirements before an incident, because a claim is a poor time to discover you did not meet them.
How long does recovery take?
It depends almost entirely on your backups. Organisations with tested, isolated backups often restore within days. Organisations without them are choosing between rebuilding from nothing and negotiating. The variable is preparation, not the sophistication of the attack.
Where to start
If you do only one thing, make it the backup: one copy the network cannot reach, and a restore you have actually tested. After that, multi-factor authentication on everything exposed to the internet, and removing standing administrator rights from daily accounts. Those three cover the majority of realistic scenarios.
Our web security team reviews these controls and tells you which gaps genuinely matter for your setup, and our IT support team handles the patching and backup verification that tends to slip when everyone is busy. Get in touch for a straight assessment of where you stand.
