The short answer: how a small business protects itself from ransomware
- Ransomware gets in through a few known doors: remote-access devices and software that have not been updated, stolen or weak passwords, and deceptive emails.
- Many attackers scan the internet for open doors. They find the weakness first and the company second, so being small does not keep you off the list.
- Three low-cost steps close the most common doors: keep internet-facing devices updated, turn off remote access you do not need, and add a second login step (multi-factor authentication).
- Keep at least one backup disconnected from your network and test that you can restore from it. Attackers look for backups and encrypt them too.
- If you are hit, disconnect the affected machines, leave them powered on, and report it before you think about paying.
What is ransomware, and why are small businesses hit?
Ransomware is malicious software that locks (encrypts) the files on your computers and servers so you cannot use them, then demands payment to unlock them. Many attackers now copy your data first and threaten to publish it if you do not pay.
Many attacks are not aimed at a chosen company. Criminal groups run automated scans across the internet, looking for a remote-access device that missed an update or a login page that accepts a leaked password. A five-person office with an old VPN box looks the same to that scan as a large company with one.
Small businesses also tend to have what attackers need: remote access set up in a hurry, nobody whose job is to install updates, and backups that sit on the same network as everything else.
How does ransomware get in? What the data says
The US Cybersecurity and Infrastructure Security Agency (CISA) organises its #StopRansomware Guide around the ways attackers first get in: internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, earlier malware infections, social engineering, and third parties such as IT service providers.
Survey data shows the same picture. Sophos's State of Ransomware 2026 asked 2,158 IT and security leaders in 17 countries, at organisations of 100 to 5,000 employees, how the attack on them started:
| Root cause reported by victims | Share (Sophos, 2026 report) |
|---|---|
| Malicious email | 26% |
| Phishing | 24% |
| Compromised credentials (stolen passwords) | 23% |
| Exploited vulnerability (unpatched software or device) | 18% |
The order shifts from year to year. Exploited vulnerabilities were the top cause in the three previous editions of the same survey, at 32% in the 2025 report. The list itself barely changes, which is good news: you know which doors to check.
The Sophos survey covers organisations with 100 employees or more, so it is not a measurement of very small businesses. Treat it as a guide to how attacks start, not as your exact odds.
Ransomware entry points, and how to close each one
| Entry point | How attackers use it | How to close it |
|---|---|---|
| VPN or remote-access device with old firmware | Use a publicly known weakness to get in without logging in | Install the latest firmware. Replace models the maker no longer supports |
| Remote Desktop open to the internet | Try passwords automatically until one works, or log in with a stolen one | Do not expose it directly. Put it behind a VPN with a second login step |
| Phishing email | Get someone to open an attachment or type a password into a fake login page | Second login step on email. Confirm invoices and urgent requests by phone |
| Unpatched server software | Break in through an old website platform, plugin or mail server | Turn on automatic updates. Remove software you no longer use |
| Weak or reused passwords | Try passwords leaked from other services | A long, different password for each service, kept in a password manager |
| Forgotten test servers | Use a machine nobody updates as a way in | Shut down what you do not use. Review your list of subdomains |
A related problem is criminals sending email that pretends to come from your domain. That is a domain setting you can fix; see our guide to SPF and DMARC.
A ransomware prevention checklist, ordered by effect and cost
- 1
Update everything that faces the internet
Log in to your router, firewall or VPN device and note the firmware version and date. Compare it with the latest version on the maker's support page, and check that the model is still supported. If an IT provider installed it, ask when it was last updated.
- 2
Close remote access you do not need
Open the port forwarding page on your router and look for rules you cannot explain, especially port 3389 (Remote Desktop). CISA's advice is not to expose services such as Remote Desktop to the web. Remove what nobody uses.
- 3
Add a second login step
Multi-factor authentication asks for a code or approval from a phone as well as a password. Start with the VPN, then email (Microsoft 365 or Google Workspace), then any administrator account. A stolen password alone no longer opens the door.
- 4
Keep an offline backup and test it
Follow the 3-2-1 idea below, and restore one real file every few months to prove it works.
- 5
Give each account only the access it needs
Take administrator rights off the accounts people use every day. Stop sharing folders that everyone can change. If one computer is infected, less of the business goes down with it.
- 6
Tell your staff what to do
Agree on one rule: if something looks wrong, unplug the network cable and tell someone straight away, with no blame. Keep key phone numbers on paper, because your screens may not work.
The 3-2-1 idea in plain words: keep 3 copies of your data, on 2 different kinds of storage, with 1 copy kept off your network or in another place. The last part matters most. CISA notes that many ransomware variants try to find and delete or encrypt backups they can reach, so a copy on an always-connected drive is not enough. An external disk you unplug after each backup, or cloud storage set so that files cannot be altered, both qualify.
What to do in the first hour of a ransomware attack
- 1
Disconnect the affected machines
Unplug the network cable and switch off Wi-Fi on anything that shows the ransom note or renamed files. If several machines are affected, unplug the network switch or router.
- 2
Do not power off blindly
CISA's guide says to power devices down only if you cannot disconnect them from the network, because shutting down can destroy evidence held in memory. Do not restart either.
- 3
Take photos
Photograph the ransom note and a few of the changed file names with your phone. They help identify which ransomware it is.
- 4
Talk on a separate channel
Use phone calls or personal messaging, not company email. The attacker may be reading it.
- 5
Report it and get help
In the United States, report to CISA at cisa.gov/report or to the FBI's Internet Crime Complaint Center at ic3.gov. Elsewhere, contact your national cybercrime reporting body or the police. If you have cyber insurance, call the insurer early; many policies include help with incident response.
- 6
Do not pay as a first resort
The FBI states that it does not support paying a ransom, and that paying does not guarantee you get any data back. Check No More Ransom for free unlocking tools, and check your backups, before anything else.
If personal data about customers or staff may have been taken, you may have a legal duty to notify a regulator or the people affected. Ask a lawyer or your insurer early. For other kinds of break-in, see what to do if your website is hacked.
How to check which doors are open from the outside
The useful question is the one the attacker's scanner asks: what can be reached from the internet, and is any of it out of date? You can answer part of it yourself.
- Write down the model and firmware version of your router, firewall and VPN device
- List every port forwarding rule on the router and ask your IT provider about any you cannot explain
- List the servers and subdomains you pay for, and shut down the ones nobody uses
- Run an automated outside-in scan (a vulnerability assessment) to catch what the lists miss
Security Ready does that last step. It checks from the internet for open ports (including Remote Desktop and VPN entry points), outdated software with known weaknesses, and files exposed by mistake, and sends the results with instructions for fixing them. On the Standard plan, an internal scan also reports missing updates inside Windows and Linux machines. The first full scan is free, with no payment details.
Know the limits. Security Ready does not stop phishing emails, it is not antivirus, it does not make backups, and it does not respond to incidents or clean up after one. A scan that finds nothing is not a guarantee of safety. It is one tool for reducing the number of open doors.
Frequently asked questions
Are small businesses really targeted by ransomware?
Yes, though targeted is not quite the word. Many attackers scan the internet for weaknesses and attack whoever has them. A small company with an outdated remote-access device is found the same way as a large one.
How does ransomware get in most often?
In the Sophos State of Ransomware 2026 survey, victims named malicious email (26%), phishing (24%), compromised credentials (23%) and exploited vulnerabilities (18%) as the root cause. CISA's guidance lists the same routes, along with remote services exposed to the internet.
Is antivirus enough to stop ransomware?
No. It helps, but an attacker who logs in through a VPN with a stolen password looks like a normal user, and may switch security software off before encrypting anything. Combine it with updates, a second login step and offline backups.
Should I pay the ransom?
Treat payment as a last resort, not a first one. The FBI does not support paying and warns that it does not guarantee you get your data back. Report the attack, check for a free decryption tool and try your backups first.
Is a cloud backup safe from ransomware?
It depends on how it is set up. A folder that simply syncs with your computer can be overwritten with encrypted files. Look for version history or a setting that prevents changes, and test a restore before you need one.
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different kinds of storage, with one copy off your network or in another location. The copy attackers cannot reach is the one you can restore from.
We have no IT staff. Where do we start?
Ask whoever installed your router or VPN two questions: when was it last updated, and what is open to the internet. Then turn on a second login step for email and make one backup to a disk you unplug. That covers the most common doors.
See where your own site stands — free
The free in-depth scan checks your site from the outside against thousands of known weaknesses and tells you how to fix each one. No payment details needed. For businesses; scans only with the owner's authorization.