How to Prevent Ransomware Attacks at Your Business

Ransomware used to be a virus that arrived in an email attachment and scrambled the files on one computer. In 2026 it is an industry. Criminal groups rent the software to affiliates, buy stolen passwords and access to unpatched firewalls from brokers, spend hours or days inside a network before they act, copy out anything valuable, delete the backups, and only then encrypt everything and leave a note. Small and mid-sized businesses are the main target because they have money, they have data other people care about, and they are less well defended than the enterprises the headlines mention. We have folded three older articles on this subject into one. It covers how attacks actually start, the ten controls that prevent them in order of impact, and what a managed security plan does about each. If you are reading this because it has already happened, go straight to infected with ransomware: what to do now.

How ransomware attacks start

Incident-response firms publish the same findings every year, and for small businesses the list is short. A stolen or guessed password on an account without multi-factor authentication, most often email, a VPN or remote desktop, is the single most common way in. An unpatched or end-of-life firewall, VPN appliance or other internet-facing device is the second; our article on the dangers of an outdated firewall lists the 2024 to 2026 cases. Phishing that installs a remote-access tool, or steals a login session even when MFA is on, is the third. Exposed remote desktop, a compromised vendor with access to your systems, and malicious downloads posing as software updates make up the rest. What follows is usually quick: a few hours to a few days between the first login and the encryption, during which the attacker finds the backups, the admin passwords and the data worth stealing.

The ten controls, in order of impact

1. Multi-factor authentication on every account, with no exceptions for executives, and phishing-resistant methods (passkeys or hardware keys) for administrators. This alone removes the most common way in. Our MFA setup guide covers Microsoft 365; the VPN and remote desktop need it too.
2. Patch fast, starting at the edge. Firewalls, VPNs and anything facing the internet within days of a fix; Windows, macOS and applications on a monthly schedule; and nothing left running past its end of support, which includes Windows 10.
3. Endpoint detection and response on every computer and server, with a 24/7 managed response team behind it. This is what stops the encryption itself, isolates the machine and rolls back the damage. We run SentinelOne with Huntress; firewalls, antivirus and EDR explains why antivirus alone is not this.
4. Backups the attacker cannot reach. Three copies, on two kinds of storage, one off site, with at least one copy immutable or offline and protected by separate credentials, and restores tested on a schedule. Our guide to knowing whether backups are good covers the test. Microsoft 365 data needs its own backup too.
5. Least privilege. Nobody works day to day as an administrator, local admin rights are removed from ordinary accounts, and admin accounts are separate, few and monitored. Most ransomware needs admin rights to do its worst.
6. Email filtering and trained people. A filter that checks links and attachments at click time, and short, regular security awareness training with phishing simulations. Our phishing quiz shows what current attempts look like.
7. Close remote access properly. No remote desktop exposed to the internet; a VPN with MFA or a zero-trust access service instead; vendor access limited, logged and removed when the project ends.
8. Segment the network. Guests, cameras, printers and equipment on their own networks, servers reachable only from where they need to be, and legacy protocols such as SMBv1 disabled. Segmentation turns one infected laptop into an incident instead of a catastrophe.
9. Watch the identity layer. Attackers increasingly never touch a computer; they log into Microsoft 365 and work from there. Alerts on impossible travel, new inbox rules, consent grants and sign-ins from new countries catch this; it is part of what Huntress monitors for our clients.
10. Write down the response plan and rehearse it once a year: who isolates what, who calls the insurer, where the backups are, who speaks to staff and customers. Our incident response plan for small business is the template.

What the controls look like on a cyber-insurance form

Insurers have distilled the same list into application questions: MFA on email and remote access, endpoint detection with monitoring, patching cadence, immutable backups tested within the year, training, and a written response plan. Answering yes truthfully is now the price of coverage, and insurers verify after a claim. The cyber insurance readiness check scores your business against those questions in about a minute.

What a managed security plan does about each

Every control above is part of our managed cybersecurity services: MFA and Conditional Access enforced on Microsoft 365, firewalls and computers patched on schedule, SentinelOne and Huntress on every computer and server, backups run to a separate location and test-restored, admin rights removed, email filtered, staff trained quarterly, and the response plan written and rehearsed with you. The pricing calculator gives the monthly figure for your number of computers and servers. For businesses that already have an internal IT person, the same stack is available as co-managed IT.

If it has already happened

Disconnect the affected machines from the network, do not pay or communicate with the attackers, call your IT provider and your insurer, and read what to do in the first hour, day and week. Our ransomware remediation service handles containment, eradication and restoration for businesses that are not yet clients.

Common questions

What is ransomware, in plain terms?

Malicious software that encrypts your files and systems so you cannot use them, combined with a demand for payment to get them back. Modern groups also copy your data out first and threaten to publish it, so a good backup no longer makes the problem go away on its own.

How do ransomware attacks usually start?

Three ways account for most of them: a stolen or guessed password on an account without multi-factor authentication, especially email, VPN and remote desktop; an unpatched firewall, VPN or other internet-facing device; and a phishing email that installs a remote-access tool. Exposed remote desktop and compromised vendors make up most of the rest.

Does antivirus stop ransomware?

Traditional antivirus stops some of it and misses the rest, because attackers test their tools against it first and much of an attack uses legitimate software. Endpoint detection and response, which watches behaviour such as mass file encryption and can isolate a machine, is the layer that actually stops the encryption, and someone has to be watching it.

Should we pay the ransom?

The FBI advises against it, payment does not guarantee working decryption or the deletion of stolen data, and paying a sanctioned group can itself be illegal. Businesses with tested backups and a response plan rarely need to consider it. If you are facing the decision, involve your insurer and counsel before anyone communicates with the attackers.

Are backups enough?

Only if they are the right kind: a copy the attacker cannot reach, with separate credentials, tested by actually restoring from it. Attackers now look for backups first and delete or encrypt them. And since data is usually stolen before it is encrypted, backups solve the outage but not the exposure.

Does cyber insurance cover ransomware?

Usually, if the application was answered truthfully and the controls it asked about were in place: MFA, endpoint detection, patching, tested backups and training. Insurers check after a claim. Our cyber insurance readiness check shows the questions.

Talk to us

If you are not sure which of the ten controls your business actually has in place, we will check and tell you, with a monthly price for the ones that are missing. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.