You click a link. Nothing obvious happens. A few minutes later, files stop opening. Shared folders disappear. Staff start asking why documents have strange names. Then the message appears: your files have been encrypted. Pay in cryptocurrency or lose access. That is the moment most businesses first take ransomware seriously. The problem is that by then, the attacker may already have been inside for days or weeks.
What ransomware actually is
Ransomware is malicious software that blocks access to your systems or encrypts your files so you cannot use them. Older ransomware was usually simple: encrypt the files, show a ransom note, demand payment.
Modern ransomware is often worse. Attackers may steal data before encryption, threaten to publish sensitive files, delete backups, disable security tools, target administrator accounts, and move across the network before the business even sees the ransom note.
How ransomware gets in
Ransomware usually starts with one small failure. Not always a dramatic one. Not always a technical one. Often it is just a normal working day, a normal inbox, and one convincing message.
Phishing emails
The message looks like an invoice, password reset, shared document, delivery issue, or urgent request. The goal is to get someone to open a file, click a link, approve a login, or hand over credentials.
Control: email filtering, attachment scanning, staff reporting, MFA, and a process for checking urgent requests.
Malicious attachments
ZIP files, fake PDFs, scripts, and macro-enabled documents can be used to start the chain. Password-protected archives can be used to bypass basic scanning.
Fake login pages
The attacker may not need malware at first. A stolen Microsoft 365 or Google password can be enough to open the next door.
Exposed remote access
Unprotected RDP, VPN portals, and remote admin tools are attractive targets, especially without MFA and monitoring.
Known vulnerabilities
If the fix exists but has not been applied, attackers will not wait politely. Internet-facing systems should be patched first.
What happens after it activates
Once ransomware starts, things can move quickly. The visible encryption is only one part of the incident.
Discovery
The attacker or malware looks for useful files, mapped drives, cloud sync folders, databases, servers, and backup locations.
Data theft
In many modern attacks, data is stolen first. That gives the attacker leverage even if the business can restore systems.
Backup targeting
Attackers know backups are the escape route. If backups use the same credentials or sit on the same network, they may not survive.
Encryption
Files are encrypted across laptops, file servers, shared drives, databases, virtual machines, and cloud-synced locations.
Pressure
The ransom note applies pressure: pay quickly, pay more later, or face data leakage and public exposure.
Should you pay?
The simple answer is that payment should not be treated as the plan. It does not guarantee a clean recovery and it does not remove the need to investigate, rebuild, reset access, and understand whether data was stolen.
Even if a key is provided, it may not work properly. Decryption may be slow. Some files may remain corrupted. The attacker may still leak stolen data. You may also create legal, sanctions, insurance, and regulatory questions.
How to protect the business
There is no single magic product that solves ransomware. Good protection is layered. Each layer either reduces the chance of an attack succeeding or limits the damage if it does.
Backups
Use regular, automatic, encrypted, isolated, and tested backups. A backup that has never been restored is more like a hope than a plan.
MFA and identity
Protect email, cloud storage, admin accounts, VPN, finance systems, HR systems, password managers, and backup platforms.
Patching
Prioritise operating systems, browsers, firewalls, VPNs, servers, backup platforms, remote access tools, and anything exposed to the internet.
Email protection
Combine SPF, DKIM, DMARC, malware scanning, link protection, impersonation protection, and a clear phishing reporting route.
Endpoint monitoring
Look for mass file changes, suspicious encryption, credential dumping, attacker tooling, attempts to disable security tools, and lateral movement.
Admin control
Keep admin access limited, separate from daily accounts, protected with MFA, logged, reviewed, and removed when no longer needed.
Network separation
Separate staff devices, servers, guest Wi-Fi, printers, IoT, backup systems, payment systems, and sensitive departments where practical.
Response plan
Decide who acts, who calls whom, how you communicate if email is down, and which systems must be restored first.
What to do in the first 15 minutes
If ransomware is active, the first few decisions matter. The goal is to contain the damage, preserve evidence, and avoid making recovery harder.
Incident response console
Tick each action as complete. This is not a replacement for incident response support, but it shows the order of thinking.
Ransomware readiness check
This quick check helps highlight whether your business has enough recovery confidence. It is deliberately simple. The answers should be known, tested, and documented.
Recovery confidence score
Tick the controls you can honestly prove, not the ones you assume are in place.
Ransomware myths
Click each card to reveal the reality.
Large companies make the news, but smaller organisations are often easier to attack and less prepared. Many attacks are opportunistic.
Cloud files can still be encrypted, deleted, or accessed through a compromised account. Versioning, retention, MFA, logging, and backup planning matter.
Endpoint protection helps, but it does not replace patching, backups, MFA, monitoring, email controls, and a response plan.
Payment does not prove data was not stolen, remove the attacker, fix the route in, satisfy legal duties, or guarantee every file returns cleanly.
The practical bottom line
Ransomware is not just about encrypted files. It is about whether your business can keep operating when something goes wrong.
The strongest defence is not one tool. It is a combination of secure backups, strong MFA, patch management, email protection, endpoint monitoring, restricted admin access, secure remote access, network separation, staff reporting, and a tested recovery plan.
If the answer to any of those is unclear, that is the place to begin.
Official resources
NCSC: What you need to know about ransomware NCSC: Mitigating malware and ransomware attacks NCSC: Report a cyber incident No More Ransom: Decryption tools and ransomware help FBI: Ransomware guidanceWant to know where you stand?
313SEC can review your external exposure, backup assumptions, Microsoft 365 security posture, email protection, endpoint visibility, and recovery readiness. The point is not fear. The point is knowing what would actually happen if ransomware hit tomorrow.
Request a ransomware readiness review