How to protect a business from ransomware: what actually works

Most advice on ransomware protection starts with backups. Backups matter, but they are the last line, not the first. By the time you are restoring files, the attacker has already been inside for hours or days, and has usually taken a copy of your data on the way out.

The better question is: how does ransomware actually get in, and where can you stop it before anything is encrypted? The latest data gives a clear answer, and it is not where most small businesses spend their money.

How ransomware gets in today

Sophos surveyed 2,158 IT and security leaders whose organizations were hit by ransomware in the past year. Here is how those attacks started: (Sophos State of Ransomware 2026)

• Malicious email: 26%
• Phishing: 24%
• Compromised credentials: 23%
• Exploited vulnerabilities: 18%, down 14 points from the year before
• Brute force: 6%

Put simply, half of all attacks began with an email, and nearly a quarter with a stolen password. Sophos found that 79% of attacks started with an identity-based approach, meaning the attacker logged in rather than broke in. And in 97% of the attacks that started with stolen credentials, MFA was in place in some form. MFA still helps, but it is not the finish line. (Sophos State of Ransomware 2026)

That changes where protection should go. Ransomware is something that happens on a laptop or server, but it usually starts in an inbox or a sign-in page.

Why it hits small businesses harder

Small organizations stop fewer attacks before the damage is done. In the same Sophos study, only 34% of organizations with 100 to 250 employees stopped the attack before encryption or extortion, compared with 46% of organizations with 3,001 to 5,000 employees. Across all sizes, 56% of attacks succeeded in encrypting data. (Sophos State of Ransomware 2026)

The cost is real even for those who never pay:

• Ransomware was the most costly type of cyber-insurance claim in 2025, at an average loss of $269,000. (Coalition 2026 Cyber Claims Report)
• 86% of businesses hit refused to pay, a record, while initial ransom demands rose 47%. (Coalition 2026 Cyber Claims Report)
• The FBI received more than 3,600 complaints reporting ransomware in 2025, and those are only the victims who chose to report it. (FBI IC3 2025 Internet Crime Report)

Refusing to pay is only possible when you can recover without the attacker. That’s the point of everything below.

A worked example: how one attack unfolds

This is an illustrative example, not a real client. A 30-person accounting firm runs Microsoft 365 and Windows laptops, with Microsoft Defender on every machine.

1. Monday, 9:40 am. A staff accountant gets an email that looks like a shared tax document. The link opens a fake Microsoft sign-in page. She types her password and approves the MFA prompt that follows, because she was expecting to sign in.
2. Monday, 10:05 am. The attacker now has her session. They read her mail, find the remote-access tool the firm’s IT provider uses, and note which accounts are admins.
3. Tuesday, 1:15 am. Using her account, the attacker installs a different remote-access tool on her laptop, one the firm has never used. From there they run PowerShell, look across the network, and switch off Defender’s real-time protection.
4. Tuesday, 2:30 am. They copy client tax files to an outside server.
5. Tuesday, 3:10 am. A program deletes Windows’ file-recovery snapshots and starts encrypting files on the laptop and a shared drive.

There were at least four chances to stop this before step 5: the phishing email, the unusual sign-in, the unknown remote-access tool at 1 am, and Defender being switched off. Each one on its own looks small. Together they are an attack in progress.

The controls that actually stop ransomware

Think of it in three layers: stop the way in, catch it early on the machine, and be able to recover without paying.

1. Close the front door: email and identity

• Catch the phishing that gets past the filter. Half of attacks start with email. Look for tools that check links after delivery, read QR codes and spot payment-fraud style requests, not just known-bad attachments.
• Use phishing-resistant MFA for email, VPN and admin accounts. CISA recommends it for all services, especially email, VPNs and accounts that reach critical systems. Passkeys and security keys are the practical options. (CISA #StopRansomware Guide)
• Watch sign-ins, not just passwords. A stolen session skips MFA entirely. Unusual locations, new devices, new inbox rules and new MFA methods right after a sign-in are the signs.
• Separate admin accounts. No one should read email with an account that can install software on every machine.

2. Catch it early on the machine

• Use endpoint detection and response (EDR), not just antivirus. Antivirus matches known files. EDR watches behaviour: a Word document starting PowerShell, a remote-access tool nobody approved, hundreds of files renamed in seconds.
• Treat “security switched off” as an attack. Attackers disable protection before they encrypt. That change should raise an alarm on its own.
• Know your own remote-access tools. Attackers love them because they look normal. Keep a list of the ones you use, and flag anything new.
• Patch what faces the internet first. Exploited vulnerabilities dropped to 18% of root causes, but firewalls, VPNs and remote-access gateways remain the usual targets. (Sophos State of Ransomware 2026)

3. Be able to recover without paying

• Keep offline, encrypted backups of critical data, and test the restore. Many ransomware variants hunt for backups they can reach and delete or encrypt them. (CISA #StopRansomware Guide)
• Write down who decides what if it happens at 2 am: who can cut a machine off the network, who calls the insurer, who talks to clients.
• Know your insurer’s rules. Most policies expect you to call their incident line before you hire anyone.

Ransomware protection checklist

Run through this with your IT team or provider this week:

• Phishing protection checks links and QR codes after the email arrives, not just at the gateway.
• Phishing-resistant MFA is on for email, VPN and every admin account.
• Sign-ins are watched for unusual locations, new devices and new MFA methods.
• Admins use separate accounts for admin work.
• Every laptop and server runs EDR, not just antivirus.
• Someone is alerted when security software is switched off.
• You have a list of approved remote-access tools, and anything else is flagged.
• Internet-facing devices (firewall, VPN) are patched within days, not months.
• Offline or immutable backups exist, and a restore was tested in the last 90 days.
• There is a one-page plan for the first hour, with names and phone numbers.

What to do in the first hour

1. Cut the affected machines off the network. Leave them powered on if you can, so evidence isn’t lost.
2. End the attacker’s access. Reset the passwords of affected accounts, end all their active sessions, and remove any MFA methods or remote-access tools they added.
3. Call your insurer’s incident line before you hire outside help or contact the attacker.
4. Find the start. The email, the sign-in or the tool that let them in. If you don’t close it, they come back.
5. Restore from a clean backup once you’re sure the way in is closed.
6. Report it to the FBI at ic3.gov. (FBI IC3)

How Centeye helps

Centeye Ironwatch is a lightweight EDR agent for Windows and Mac that works beside Microsoft Defender. It follows every program back to what started it, flags remote-access tools nobody approved, notices when Defender is switched off, and stops a ransomware process the moment it sees hundreds of files changing in seconds or file-recovery snapshots being deleted. With your approval it cuts the laptop off the network and switches file recovery back on.

Because ransomware usually starts somewhere else, Ironwatch doesn’t work alone. Lighthouse finds the email that delivered it and every inbox it reached, and Gatewatch catches the stolen sign-in behind it. Praxis joins all three into one case, so the phishing email, the odd sign-in and the 1 am remote-access tool in the example above show up as one attack, not four small alerts.

New to the terms? Read EDR vs MDR for small business, see why SMBs are now the main ransomware target, or browse the security glossary. Want to see it on your own machines? Start a free trial.

Frequently asked questions

What is the best protection against ransomware?

There is no single tool. The combination that works is phishing protection and phishing-resistant MFA to stop the way in, EDR to catch the attack on the machine before encryption, and tested offline backups so you can recover without paying.

Is antivirus enough to stop ransomware?

No. Antivirus catches files it already knows. Most ransomware attacks use stolen logins and ordinary admin tools first, which antivirus doesn’t flag. EDR watches behaviour, such as security being switched off or a remote-access tool appearing at 1 am, which is where attacks can be stopped early.

Do backups protect against ransomware?

They protect your ability to recover, not your data. Many attacks now steal a copy of the data before encrypting it, so a backup won’t stop the threat to leak it. Backups also need to be offline or unchangeable, because attackers look for backups they can delete. (CISA #StopRansomware Guide)

Should a small business pay the ransom?

That’s a decision for you, your insurer and legal counsel, and it depends on the situation. Most businesses hit in 2025 chose not to: 86% refused to pay. (Coalition 2026 Cyber Claims Report) Paying doesn’t guarantee your files come back or that the data is deleted.

How do most ransomware attacks start?

With email and stolen logins. Malicious email and phishing together started half of the attacks in Sophos’s 2026 study, and compromised credentials another 23%. (Sophos State of Ransomware 2026)

Figures cited from the Sophos State of Ransomware 2026 report, the Coalition 2026 Cyber Claims Report, the FBI IC3 2025 Internet Crime Report, and CISA’s #StopRansomware Guide. The worked example is illustrative. Centeye describes only capabilities that ship in the product today.