Ransomware encrypts your files and demands payment to unlock them — and small businesses are squarely in the crosshairs, precisely because attackers assume the defences are thin. The reassuring part is that ransomware almost always gets in through a small number of predictable doors. Close those doors and you dramatically cut your risk. Here's a practical checklist you can actually work through.
1. Get your backups right (the 3-2-1 rule)
Backups are your single most important defence, because a good one turns a ransomware attack from a catastrophe into an inconvenience. Follow the 3-2-1 rule: keep three copies of your data, on two different types of media, with one copy stored off-site or in the cloud. Crucially, at least one copy should be offline or immutable — modern ransomware actively hunts for and encrypts connected backups. And an untested backup isn't a backup: restore from it periodically to prove your data actually comes back.
2. Turn on multi-factor authentication everywhere
A huge share of attacks start with a stolen or guessed password. Multi-factor authentication (MFA) adds a second step — usually a code or app approval — so a password alone isn't enough to log in. Enable it on email, remote access, VPNs, banking and any cloud application that supports it. Of everything on this list, MFA delivers some of the biggest protection for the least effort and cost.
3. Keep everything patched and updated
Attackers love unpatched software because the holes are already public knowledge. Make sure Windows, macOS, web browsers, and business applications all receive updates promptly — especially anything exposed to the internet like firewalls and remote-access tools. Automating patch management takes this off your team's plate and closes known vulnerabilities before they can be exploited.
4. Filter email before it reaches inboxes
Email is the number-one delivery method for ransomware, usually as a malicious attachment or a link to a fake login page. Good email security filters out phishing, spoofing and dangerous attachments before staff ever see them. Pair that with a clearly labelled external-sender warning so people apply a little extra caution to messages from outside the organization.
5. Train your team to spot the bait
Your staff are the most-targeted part of your business, and a moment's hesitation on a suspicious email can stop an entire attack. Regular, short security-awareness training and occasional simulated phishing tests help people recognise the warning signs — unexpected invoices, urgent payment requests, mismatched sender addresses — and know exactly who to report them to. The goal is a confident, calm team, not a fearful one.
6. Put modern endpoint protection (EDR) on every device
Traditional antivirus recognises known threats; endpoint detection and response (EDR) goes further by watching for suspicious behaviour, such as a program suddenly encrypting large numbers of files. That lets it catch brand-new ransomware that no signature would recognise, and in many cases isolate the affected device automatically before the damage spreads across your network.
7. Have a simple incident response plan
Even strong defences can be beaten, so decide in advance what you'll do. A one-page plan is enough for most small businesses: who to call first, how to disconnect an affected machine, where your backups are and who can restore them, and which staff, customers or regulators may need to be notified. The middle of an attack is the worst time to be figuring this out — a little planning now saves hours of panic later.
Where to start
If this feels like a lot, start with the highest-impact items: solid, tested, offline backups and MFA everywhere. Those two alone put you ahead of most small businesses. Then layer on patching, email filtering, training, EDR and a simple plan over time. Security isn't a single purchase; it's a set of habits and layers that reinforce each other.
You don't have to build all of this yourself. A managed IT provider can put every item on this checklist in place and keep it current — monitoring, patching, backups and training handled for you — so ransomware protection becomes something that just runs in the background instead of another job on your plate.