Ransomware is no longer a big-enterprise problem — in 2025, small and mid-size businesses accounted for 88% of all ransomware breach incidents, and attacks are projected to climb another 40% by the end of 2026. Attackers have industrialized the process: cheaper malware kits, AI-assisted phishing and automated targeting mean the business with five employees is statistically as likely to be hit as the business with five thousand — and far less likely to survive. The good news: most ransomware attacks follow predictable entry paths, and blocking those paths is cheap, fast and well within reach of any small business. This guide lists the eleven defenses that actually matter, in order of impact.
How small businesses actually get hit
Ransomware in 2026 is faster to deploy and harder to recover from than two years ago, but the entry methods have barely changed:
- Phishing email and smishing — someone clicks a link, an attacker gets a foothold. This is still the number-one door.
- Remote-access tools left exposed — RDP and VPNs with weak or reused passwords.
- Unpatched software — known vulnerabilities in routers, VPNs and plugins.
- Credential reuse — one leaked password opening everything.
Because the entry paths are known, the defenses are known too. Here they are, in the order we’d spend money on them.
The 11 defenses that stop ransomware
1. Backup with the 3-2-1 rule — and test restores
The single most important defense: three copies, two media types, one off-site — and a restore test every quarter. A backup you have never restored is a hope, not a plan. And make sure backups are disconnected or immutable: modern ransomware encrypts backup drives too. Our backup guide lays out the same logic for your business data.
2. Turn on multi-factor authentication everywhere
MFA blocks the majority of credential-based attacks outright. Every email account, VPN, admin panel and financial portal you use gets MFA — and never accept SMS-only for the most sensitive accounts.
3. Train the team with real-world phishing tests
People are the first line and the weakest link. Run quarterly internal phishing simulations and 20-minute training sessions. Our phishing red-flags guide is short enough to share with every employee.
4. Lock down remote access
Expose no RDP directly to the internet — use a business VPN with MFA instead. Change default passwords on routers and firewalls, and check the seventeen settings in our router security guide.
5. Patch ruthlessly
Set automatic updates for the OS, browsers, plugins and every piece of software that touches the internet. Ransomware crews weaponize known vulnerabilities within days of disclosure — the race is lost if you patch monthly.
6. Use a password manager and kill credential reuse
One breached password shouldn’t open everything. A password manager generates unique, strong passwords per account and makes the habit painless — see how to choose the right one for your team size.
7. Restrict admin rights
Employees should do everyday work as standard users, not administrators. Ransomware that runs under an admin account gets full system control; under a standard user, it is far more contained.
8. Segment the network
Keep the finance computers, the cameras and the guest Wi-Fi on separate networks from the rest. Segmentation is the difference between “one machine encrypted” and “everything encrypted”.
9. Guard your email gateway
Turn on advanced spam filtering, link scanning and attachment sandboxing if your provider offers them. Expect the occasional phishing email to get through — that is what the training and MFA are for.
10. Write the incident-response plan before you need it
A one-page plan beats panic: who unplugs what, who calls the IT provider, who talks to the insurer, and where the offline backups live. Decide now whether you would ever pay — in most cases the answer should be no, since paying funds the criminals and often doesn’t restore the data.
11. Look at cyber insurance — with the fine print
Cyber insurance won’t prevent attacks but can cover recovery costs and ransom negotiation services. Policies now require proof of MFA and backups (the insurers know the stats), so treat a policy as a reward for doing items 1–10, not a replacement for them.
The full checklist, in one line
Offline backups, MFA everywhere, phishing training, locked-down remote access, patching, a password manager, limited admin rights, network segmentation, email filtering, an incident plan, and insurance. Do those eleven and you are in the top tier of prepared small businesses — most of your competitors won’t even have backups.
For the broader picture on locking down every device in the building, our complete cybersecurity check covers the same ground at home, where the weakest laptop often becomes the office’s door in.
Frequently Asked Questions
How likely is a small business to be hit by ransomware?
Very likely. SMBs accounted for 88% of ransomware breach incidents in 2025, and attacks are projected to rise another 40% by the end of 2026. Attackers see small businesses as softer, equally profitable targets.
Should a small business pay the ransom?
In most cases, no. Paying funds criminal networks, and a significant share of victims never get fully working data back even after payment. Decryption tools exist for some strains, offline backups are the real recovery path, and law enforcement consistently advises against paying.
Is cyber insurance worth it for small businesses?
Yes, if you already have the basics (MFA, backups, patching) — insurers now require them and policies cover recovery costs and expert help. But insurance is a safety net, not a defense: it doesn’t prevent the attack.
Every defense in this guide lives in the free Security Hub with checklists and a beginner course.
Update note (Aug 2026): Update note (Aug 2026): confirmed current ransomware statistics and insurer requirements.