Ransomware is no longer a threat reserved for large enterprises. Here's what small businesses need to know — and do — to reduce their exposure.
What Is Ransomware?
Ransomware is a type of malicious software that encrypts your files or entire systems, making them inaccessible until you pay a ransom — typically demanded in cryptocurrency — to the attacker. Even then, there's no guarantee you'll get your data back. Attackers may demand tens of thousands of dollars, and recovery without paying can take weeks if you don't have proper backups in place.
It's one of the most disruptive cyber threats businesses face today. And while news coverage tends to focus on hospital systems and municipal governments, small businesses are increasingly in the crosshairs.
Why Small Businesses Are Targeted
Many small business owners assume they're too small to attract the attention of cybercriminals. The opposite is often true. Attackers know that small businesses typically have weaker security controls, less IT oversight, and limited resources to respond to an incident. They're easier targets — and they still have valuable data, financial accounts, and operational systems worth holding hostage.
Ransomware groups also operate with scale. They don't manually pick targets — automated tools scan the internet for vulnerable systems around the clock. If your business has an exposed remote desktop port, an unpatched VPN appliance, or employees who click on phishing links, you're at risk regardless of your company's size.
The Most Common Entry Points
Understanding how ransomware gets in is the first step toward stopping it. The three most common entry points are:
1. Phishing Emails
Phishing is responsible for the majority of ransomware incidents. An employee receives a convincing email — often impersonating a vendor, a bank, or even a colleague — and clicks a link or opens an attachment that installs malware. Modern phishing attacks are highly targeted and often difficult to distinguish from legitimate messages.
2. Unpatched Systems and Software
Software vulnerabilities are a goldmine for attackers. When vendors release security patches, attackers reverse-engineer them to find the underlying flaw — and then actively scan for businesses that haven't applied the update yet. Running outdated Windows systems, unpatched firewalls, or old versions of remote access tools puts you at significant risk.
3. Weak or Reused Credentials
If an employee's password is weak, reused across multiple sites, or exposed in a prior data breach, attackers can use credential stuffing tools to log into your systems directly. Remote Desktop Protocol (RDP) and VPN portals are common targets. Once inside, attackers can move laterally through your network and deploy ransomware across multiple systems.
5 Practical Steps to Reduce Your Risk
Step 1: Enable Multi-Factor Authentication Everywhere
MFA is the single most impactful control you can put in place. Even if an attacker obtains a password, they can't log in without the second factor. Enable MFA on email (Microsoft 365, Google Workspace), remote access tools, and any cloud-based application your team uses. This one step blocks the majority of credential-based attacks.
Step 2: Maintain Offline, Tested Backups
Backups are your safety net if ransomware does succeed. But there's a critical detail most businesses miss: your backups need to be offline or otherwise isolated from your primary systems. Ransomware frequently targets backup systems before encrypting everything else. Backups connected to your network can be encrypted along with your production data. Test your restore process at least quarterly — a backup you've never tested is not a backup you can rely on.
Step 3: Apply Security Updates Promptly
Establish a patching cadence. Critical security updates for operating systems and software should be applied within 48–72 hours of release. Network equipment — firewalls, switches, VPN appliances — must also be kept up to date. Many businesses patch workstations but neglect network devices, which attackers actively exploit.
Step 4: Train Employees to Recognize Phishing
Security awareness training doesn't have to be a time-consuming compliance exercise. Even brief, regular training on how to recognize suspicious emails — unexpected requests, mismatched sender addresses, urgency tactics — can meaningfully reduce click rates. Simulated phishing exercises help identify employees who need additional guidance before a real attack occurs.
Step 5: Limit Who Can Access What
The principle of least privilege means employees only have access to the systems and data they need to do their jobs. If ransomware executes under a standard user account with limited permissions, the blast radius is contained. If it runs under an administrator account, it can encrypt everything on the network. Review access rights regularly and remove permissions that are no longer necessary.
What to Do If You're Hit
If ransomware executes on your systems, disconnect affected machines from the network immediately to prevent spread. Do not pay the ransom without consulting a cybersecurity professional — payment doesn't guarantee recovery and may invite further attacks. Contact your managed IT or cybersecurity provider immediately and file a report with the FBI's Internet Crime Complaint Center (IC3). Having an incident response plan in place before an attack occurs dramatically improves your chances of recovery.
Ransomware is a serious threat, but it's one that well-prepared businesses can defend against. The steps above aren't exotic or expensive — they're practical controls that every small business should have in place.