Ransomware attacks against small businesses have grown substantially, partly because smaller organizations are perceived (often correctly) as having weaker defenses than large enterprises while still holding data valuable enough to make an attack worthwhile. This guide covers practical prevention steps and, just as importantly, what an actual response plan should look like if prevention fails, building on several of our other guides covering the individual defenses involved.
How ransomware typically gets in
Most ransomware incidents trace back to one of a small number of common entry points: a phishing email tricking someone into running malicious code or entering credentials (covered in our phishing guide), an exposed remote access service (like RDP) with weak credentials, or an unpatched software vulnerability being exploited directly. Understanding these common entry points helps prioritize prevention efforts toward the risks that actually account for the large majority of real incidents, rather than spreading limited security resources thinly across every theoretically possible attack vector.
Prevention: the highest-value steps
Comprehensive, tested, and properly isolated backups. As covered in detail in our backup strategy guide, backups that are genuinely isolated from your production environment (not simply another folder on the same accessible network) are your single most important defense against ransomware specifically, since they allow recovery without needing to consider paying a ransom at all.
Two-factor authentication on all remote access. Any remote access point into your systems — VPN, remote desktop, cloud admin consoles — should require two-factor authentication, as covered in our authentication guide, since compromised credentials alone should not be sufficient to gain access.
Prompt patching of internet-facing systems. Vulnerabilities in internet-facing services (VPN appliances, remote access tools, public-facing web applications) are actively scanned for and exploited by automated tools shortly after becoming publicly known, making prompt patching of anything internet-facing a particularly high priority compared to internal-only systems.
Email filtering and phishing awareness. Since phishing remains a leading entry point, both technical email filtering and ongoing team awareness training, covered in our phishing guide, directly reduce the likelihood of the initial compromise that leads to a ransomware incident.
Network segmentation limits how far an infection spreads
Ransomware often attempts to spread laterally across a network once it has an initial foothold, encrypting as many accessible systems as possible to maximize pressure on the victim. A flat network where every device can freely reach every other device maximizes this spread potential. Segmenting your network — separating critical systems from general workstations, for example — limits how far an infection can spread from a single compromised entry point, containing the damage to a smaller portion of your overall environment.
Building an incident response plan before you need one
A ransomware incident is a genuinely stressful, high-pressure situation, and decisions made without a pre-existing plan under that pressure tend to be worse than ones made calmly in advance. A basic incident response plan for a small business should specify: who has authority to make key decisions during an incident (isolating affected systems, deciding whether to involve law enforcement or a specialized incident response firm), how to isolate affected systems from the rest of the network quickly to limit spread, and how your team will communicate if normal channels (email, chat tools) are potentially compromised or unavailable.
This plan does not need to be lengthy or highly formal for a small business, but it should exist as an actual written document that specific people have reviewed and understand, rather than an assumption that everyone will simply figure out what to do in the moment.
Endpoint detection tools as an additional layer
Beyond traditional antivirus software, modern endpoint detection and response (EDR) tools monitor for suspicious behavior patterns — a process rapidly encrypting many files in sequence, for example — rather than relying purely on matching known malware signatures. This behavioral approach can catch novel ransomware variants that signature-based antivirus alone might miss, since ransomware developers frequently modify their code specifically to evade known signature detection.
Several EDR tools now offer pricing accessible to small businesses, not just large enterprises, and represent a reasonable additional layer of defense for a small team’s workstations and servers, particularly for a business handling sensitive client data where the cost of a successful attack would be especially damaging.
Vendor and supply chain risk
Ransomware incidents increasingly originate through a compromised vendor or software supply chain rather than a direct attack on the victim organization itself — a trusted software update channel or a vendor with access to your systems becoming the actual entry point. Review what third-party vendors and tools have access to your systems, and specifically what level of access each one genuinely requires, applying the same least-privilege thinking covered in our IAM guide to vendor access as you would to your own team’s internal access.
Should you ever pay a ransom?
This is a genuinely difficult decision with no universally correct answer, and law enforcement agencies generally advise against payment, both because it funds further criminal activity and because payment does not guarantee data will actually be decrypted or that a copy was not retained by the attacker regardless. That said, some small businesses without adequate backups have faced this decision as the only apparent path to recovering critical data.
This is precisely why prevention, and specifically genuinely isolated and tested backups, matters so much — the goal is to never actually face this decision in the first place, by ensuring a clean recovery path exists independent of whether an attacker’s decryption promise can be trusted.
Cyber insurance considerations
Cyber insurance policies increasingly cover ransomware-related costs, including incident response, potential ransom payments in some policies, and business interruption losses, but policies often have specific security requirements that must be met for coverage to apply — mandatory multi-factor authentication, specific backup practices, and prompt patching among common requirements. Review your policy’s specific requirements (or a prospective policy if evaluating cyber insurance for the first time) against your actual current practices, since a gap between the policy’s requirements and your real practices could result in a denied claim exactly when you need coverage most.
Practical starting checklist
1. Confirm backups are genuinely isolated from production systems and have been tested through an actual restoration.
2. Enforce two-factor authentication on every remote access point into your systems.
3. Establish a prompt patching process specifically for internet-facing systems.
4. Reinforce phishing awareness and technical email filtering as ongoing practices, not one-time training.
5. Review network segmentation to limit how far an infection could spread from a single compromised device.
6. Write a basic incident response plan specifying decision authority and communication procedures during an incident.
7. If you carry or are considering cyber insurance, confirm your practices actually meet the policy’s specific requirements.
Frequently asked questions
How quickly does ransomware typically spread once it gains initial access?
This varies significantly by the specific attack, but some documented incidents have shown encryption spreading across a network within hours of initial compromise, which is part of why network segmentation and rapid isolation capability matter as much as prevention itself.
Are small businesses actually targeted by ransomware, or is this mainly a large-enterprise problem?
Small businesses are targeted frequently, in many cases specifically because attackers perceive them as having weaker defenses than large enterprises while still holding data or business operations valuable enough to justify a ransom demand. This is not primarily a large-enterprise problem.
Should we hire an outside firm to help build our incident response plan?
For a small business without in-house security expertise, bringing in outside help to build an initial incident response plan is a reasonable investment, particularly for a business handling sensitive client data where the stakes of getting this wrong are higher.
What is the single most important prevention step if we can only address one thing right now?
Genuinely isolated, tested backups. Even if every other prevention measure fails and an infection occurs, reliable backups mean the incident becomes a recovery and cleanup exercise rather than an existential decision about whether to pay a ransom to a criminal with no obligation to actually restore your data.
How do we know if our business is required to report a ransomware incident to any regulator or authority?
This depends heavily on your industry, jurisdiction, and the type of data involved — businesses handling healthcare, financial, or personal data often have specific breach notification obligations. Consult with legal counsel familiar with your specific industry and jurisdiction as part of building your incident response plan, rather than trying to determine this for the first time during an actual incident.
For more on the specific defenses covered in this guide, see our backup strategy guide, phishing guide, and full hardening guides section.