Ransomware is often described as a sudden, technical event. For most UK SMEs it is closer to a business interruption: files that will not open, systems that cannot be trusted, and a working day that stops while people try to work out what is still safe to use.
This article is a practical starting point for ransomware risk reduction. It is not a promise that incidents cannot happen, and it does not assume you have a large security team. The aim is to show which ordinary gaps usually matter first, and how to close them in a sensible order.
What ransomware actually does
In plain terms, ransomware is malware that interferes with your ability to use data or systems, then demands payment to restore access. The disruption is the point. Email may still work while shared drives do not. A finance system may lock while a website stays up. Staff often notice the problem as “the files will not open” rather than as a named attack.
Payment is a commercial decision for the organisation that owns the data. It is not a recovery plan. Even when a decryptor is offered, you still have to decide whether restored files can be trusted, how the attacker got in, and what else may have been copied. Reducing risk means making that situation less likely, and making recovery possible if it happens anyway.
Why small and mid-sized businesses are exposed
Growing companies hold useful data: invoices, customer records, contracts, payroll and the software that keeps work moving. They also tend to have fewer people whose job is to watch access, backups and alerts. That combination is enough. You do not need to be famous, or to run a large network, to be worth interrupting.
The usual path is ordinary. A convincing email. A reused password. A laptop that missed updates. Remote desktop left reachable. A backup that exists only on the same device that was encrypted. None of those require specialist drama. They require attention.
If you want the wider picture of how these gaps sit together, start with what cybersecurity means for small and mid-sized businesses and the overlooked issues in business security risks companies overlook. The rest of this guide focuses on ransomware specifically.
1. Backups you can restore
A backup that has never been restored is a hope, not a control. For ransomware risk reduction, the question is not “do we have a backup product?” It is whether you can recover the work that would stop trading.
Useful habits:
- Know which systems and folders would hurt most if they vanished for a day
- Keep at least one copy that malware on a staff laptop cannot immediately reach
- Protect backup consoles with a unique account and multi-factor authentication
- Restore a small, real set of files on a regular schedule and write down how long it took
- Name who can run a restore after hours, not only who bought the software
Backups sit next to careful data handling. If you store customer or staff records, data encryption and privacy practices should be part of the same conversation: what you keep, where it lives, and who can get it back.
2. Access that is hard to reuse
Stolen or leftover credentials remain one of the quietest ways into email, cloud storage and admin panels. Shared passwords, unused contractor accounts and local administrator rights on every laptop all make ransomware easier to start and easier to spread.
Practical response:
- Use named accounts instead of a single shared login where possible
- Turn on multi-factor authentication for email, Microsoft 365 or Google Workspace, banking and backup consoles
- Remove access when people leave or change role, as part of offboarding
- Give staff standard user rights on work devices unless they genuinely need more
- Review admin accounts quarterly, including those created for a one-off project
This is process work more than product work. It often reduces risk more than buying another tool.
3. Email and the first click
Many ransomware incidents still begin with a message that looks like a supplier, a delivery, an invoice query or a shared file. The aim is to get someone to open an attachment, follow a link, or type a password into a page that is not yours.
You will not train every person to be perfect. You can make the first click less dangerous:
- Use the filtering and safe-attachment features already included in your email platform
- Tell staff, in one page, how to report a suspicious message and who will look at it
- Treat unexpected payment-detail changes as a phone-back problem, not an email problem
- Disable macros in office documents from the internet unless you have a defined exception
- Keep a short list of the systems that should never be logged into from a link in an email
A reported false alarm is useful. Silence after a convincing message is not.
4. Endpoints that stay trustworthy
Laptops and desktops are where staff open files, save work and connect to customer systems. If those devices are unpatched, run as administrator, or have no clear owner when they are lost, ransomware has an easier start.
Endpoint security is not only an antivirus brand name. It is a small set of habits working together:
- Automatic updates for the operating system and the browsers people actually use
- A current endpoint protection tool that someone is responsible for reviewing
- Disk encryption and a wipe or lock process for lost devices
- A rule for personal software and unmanaged USB drives on work machines
- A named person who can isolate a device if something looks wrong
If you cannot say which laptops belong to the business and whether they are up to date, start there before you commission a more advanced project.
5. Remote access and the office network
Ransomware spreads more easily on a flat network, where one infected laptop can see every file share and every server. It also spreads when remote access is left open to the public internet with only a password in front of it.
A proportionate review asks:
- Which remote methods do you actually use (VPN, cloud desktop, exposed remote desktop)?
- Are management interfaces reachable from the public internet?
- Is guest Wi-Fi separated from business systems?
- Do staff working from home use personal routers with default passwords?
- Would one compromised home laptop reach the same shares as the office?
Our network defence and firewalls work is about clear, maintainable rules, not complexity for its own sake. If nobody has reviewed the router or firewall since it was installed, that review is part of ransomware risk reduction.
6. Noticing trouble earlier
If the first sign of trouble is encrypted files or a customer who cannot be served, you are already in recovery. Earlier signs are often quieter: unusual sign-ins, a burst of failed passwords, unexpected outbound traffic, or a device that starts encrypting shares.
You do not need an enterprise operations centre to improve this. You do need:
- Logging turned on for email, identity and the systems that hold customer work
- Someone responsible for looking at important alerts, even if that is only part of their role
- A short playbook: isolate the device, reset the account, call the person who can restore
Threat detection and prevention sits at this layer. It pairs with the wider cybersecurity programme when software, networks and monitoring need to improve together. Detection does not replace backups or access control. It shortens the time an incident can run.
How the pieces connect
Ransomware is usually a chain. A phishing email steals a password. That account reaches a poorly segmented network. Malware lands on an unpatched laptop. The backup sits on the same share. Nobody sees the unusual login until files are already unusable.
Improving one layer helps. Improving several layers in a calm order helps more. That is why a single “anti-ransomware product” is rarely the whole answer. Tools matter when they are owned, configured and watched. They do not replace a restore test or an offboarding checklist.
A 30-day starting order
When everything feels urgent, use this sequence. It is a starting order, not a certification programme.
- List the systems that would stop trading for a day, and who can access them.
- Turn on multi-factor authentication for email, cloud office suites and backup consoles.
- Confirm a backup copy that a single infected laptop cannot overwrite, then restore one folder.
- Check that work devices update automatically and are not all local administrators.
- Review remote access: close unused public remote desktop, and require MFA on what remains.
- Write a one-page note: how to report a suspicious email, and who isolates a device.
After the basics are stable, a structured review such as penetration testing and security audits can show whether the remaining paths are real. Testing is more useful once access, backups and remote entry points are already in better shape.
If software delivery is part of the same conversation, treat authentication, admin interfaces and data handling as part of the brief. Web Vantage Solutions’ services cover software and security together when the work spans both. Further reading lives in the Insights library.
Soft next step
If you recognise two or three of these gaps, that is normal. Get in touch with a short description of how you take backups, how people reach systems from home, and which application you could least afford to lose for a day. We can help you choose a proportionate first improvement.
FAQ
What is ransomware risk reduction for a small business?
It is the set of backups, access controls, email habits, device hygiene and network choices that make encryption events less likely and recovery more realistic. It is operational work, not a slogan.
If we pay the ransom, is the problem solved?
Payment does not guarantee usable files, and it does not close the path the attacker used. Recovery still needs clean systems, trusted backups and a decision about what data may have been copied.
Do we need a dedicated security team?
No. You do need a named owner, even if security is only part of their role, and specialists for work you cannot cover in-house.
Is antivirus enough?
It helps on the device. It does not replace multi-factor authentication, a restore test, or a review of remote access. Ransomware often succeeds where several ordinary controls are missing at once.
How often should we test backups?
Often enough that the restore steps are familiar. A small, real restore each month is more useful than an annual document that nobody has followed.
Does this replace cyber insurance?
No. Insurance, if you have it, is a financial tool. It does not back up your files or remove unused admin accounts. Insurers also tend to ask whether those basics exist.
When should we bring in external help?
When you cannot name your critical systems, cannot restore a backup, or cannot tell who has admin rights. A short assessment is usually more useful than buying tools first.