There’s a common belief among small business owners that ransomware is a big-company problem. “Why would anyone bother with us? We’re just a 20-person office.”
We hear that often, and we understand why it feels true. The headlines are about hospitals, cities and global brands. But the reality we see every week is different. Many ransomware attacks aren’t aimed at anyone in particular. They’re automated campaigns that scan the internet and flood inboxes looking for whoever is easiest to get into. Small businesses are frequently the easiest targets, because they usually have valuable data and fewer defenses.
The good news is that you don’t need an enterprise budget to be a hard target. You need layers. No single tool stops every attack, but several well-managed layers working together make a successful attack far less likely, and make recovery much faster if something does get through.
Here are the seven layers we put in place for our clients.
How a typical ransomware attack unfolds
It helps to understand what you’re defending against. Most attacks follow a similar path:
- Getting in. Usually through a phishing email, a stolen or reused password, or an unpatched system exposed to the internet.
- Looking around. Once inside, attackers often wait quietly, sometimes for days or weeks, mapping your network and finding your most valuable data.
- Escalating access. They look for administrator accounts that let them reach more systems.
- Disabling defenses. That includes going after your backups, so you can’t simply restore.
- Encrypting and extorting. Files are locked, a ransom note appears, and increasingly the attackers also threaten to publish stolen data.
Every layer below is designed to break one or more links in that chain.
Layer 1: Multi-factor authentication everywhere
If we could only do one thing for a new client, it would be this. Stolen and weak passwords are one of the most common ways attackers get in, and multi-factor authentication (MFA) stops most password-based attacks cold. Even if someone has your password, they can’t sign in without the second factor on your phone.
MFA should be on email, remote access, VPNs, cloud apps and every administrator account. Authenticator apps and phishing-resistant methods are stronger than text messages, but any MFA is far better than none.
Layer 2: Endpoint detection and response (EDR)
Traditional antivirus looks for known bad files. Modern attacks often don’t use files that antivirus recognizes; instead they abuse legitimate tools already on your computers. Endpoint detection and response watches for suspicious behavior, such as a program suddenly encrypting hundreds of files or a user account doing something it has never done before, and can isolate a computer from the network automatically.
EDR works best when its alerts are actually reviewed and acted on. We manage EDR for our clients, so a suspicious alert leads to action instead of sitting unread in a console.
Layer 3: Email security and phishing protection
Email remains one of the main ways ransomware gets in. A good email security layer filters malicious attachments and links, flags look-alike domains, and catches impersonation attempts, such as a message that appears to come from your CEO asking for a wire transfer.
We also make sure the basics are in place for your own domain (SPF, DKIM and DMARC), which makes it much harder for criminals to send email pretending to be you.
Layer 4: Patching and vulnerability management
Attackers love old software. When a vulnerability is announced, automated tools start scanning for unpatched systems within days, sometimes within hours. Keeping Windows, macOS, browsers, firewalls and business applications updated closes those doors.
The challenge for most small businesses isn’t knowing that patching matters. It’s making sure it actually happens, consistently, on every device, including the laptop that’s been sitting in someone’s bag for three weeks. We automate patching, test updates before they roll out widely and report on anything that fails.
Layer 5: Least privilege and admin control
In many small offices, every user is a local administrator “because it’s easier.” That’s convenient for attackers too: if one account is compromised, they get full control of that machine and a head start on the rest of the network.
Least privilege means people have exactly the access they need to do their jobs, and no more. Everyday accounts don’t have admin rights. Administrator accounts are separate, protected with MFA and used only when needed. Former employees are removed promptly. It’s not glamorous, but it dramatically limits how far an attacker can spread.
Layer 6: Backups attackers can’t touch
Backups are your last line of defense, and attackers know it. That’s why modern ransomware deliberately looks for backups and tries to delete or encrypt them before launching the main attack.
Good backups for ransomware protection are:
- Separated from your main network and accounts, so compromising one doesn’t compromise the other.
- Immutable or offline, meaning they can’t be changed or deleted for a set period, even by an administrator.
- Tested regularly, because a backup you’ve never restored from is a hope, not a plan.
- Covering the cloud too, including Microsoft 365 or Google Workspace data, which many businesses mistakenly assume is backed up automatically.
We go deeper on this in our post about building a disaster recovery strategy you can trust.
Layer 7: Trained people and a response plan
Technology can’t catch everything, so your team is part of the defense. Short, regular security awareness training and simulated phishing tests help employees recognize suspicious messages and, just as importantly, feel comfortable reporting them quickly. An employee who says “I think I clicked something bad” within five minutes is a gift.
The other half of this layer is an incident response plan. If something happens at 4:30 on a Friday afternoon, who gets called? Who decides whether to disconnect systems? Who talks to clients, your insurer or law enforcement? Answering those questions in advance turns a panic into a process.
Quick self-check: how many layers do you have?
Answer these honestly:
- Is MFA turned on for every email account and remote access tool?
- Do your computers have EDR, and does someone review its alerts?
- Do you have email filtering beyond what came in the box?
- Are all devices patched automatically, and would you know if one wasn’t?
- Do everyday users have admin rights on their computers?
- Are your backups immutable or offline, and when did you last test a restore?
- Has your team had security training in the last year? Do you have a written response plan?
If you answered “no” or “I’m not sure” to more than one or two, you’re not alone. Most businesses we assess have gaps. The important thing is to close them before someone else finds them.
Security is a process, not a product
It’s tempting to buy a single product that promises to “stop ransomware.” Real protection comes from layers that are configured correctly, monitored daily and adjusted as threats change. That ongoing attention is hard for a small business to maintain on its own, which is why security is built into every one of our plans rather than sold as an afterthought.
Cyber insurance providers increasingly expect many of these controls, too. Having them in place can make coverage easier to get and renew, and helps ensure a claim isn’t denied because a basic safeguard was missing.
Want to know how your business would hold up? Our free assessment includes a security review with plain-English findings.
