The SMB ransomware survival guide

Ransomware doesn't care how big you are. In fact, small and mid-sized businesses are attractive targets precisely because they tend to have weaker defenses and less ability to absorb downtime.

Let's walk through how attacks usually unfold — and how to make sure one doesn't end your business.

How SMBs actually get hit

Most ransomware starts in one of three ways:

1. Phishing — an employee opens a malicious attachment or link.
2. Stolen credentials — an attacker logs in through remote access using a reused or leaked password.
3. Unpatched systems — a known vulnerability on an internet-facing service gets exploited.

Once inside, attackers often wait, move laterally, and quietly delete or encrypt your backups before triggering the ransomware. That last part is why backups alone aren't enough.

The recovery-first mindset

Prevention matters, but assume something will eventually get through. Your goal is to make recovery faster and cheaper than paying a ransom.

Build resilient backups

• 3-2-1-1: three copies, two media types, one offsite, one immutable or offline.
• Immutable backups can't be altered or deleted, even by an admin account — which defeats the "delete the backups first" playbook.
• Keep backup credentials separate from everyday admin accounts.

Test your restore — for real

The question isn't "do we have backups?" It's "how long does it take to get the business running again?" Run a restore drill and measure it. That number is your real recovery time.

Have an incident plan

Write down — before anything happens — who to call, how to isolate affected systems, and how you'll communicate with staff and customers. A plan you wrote calmly beats decisions made in a panic.

Should you ever pay?

Paying is risky: there's no guarantee you'll get your data back, it funds future attacks, and it may have legal implications. A tested backup strategy is what lets you say no.

The bottom line

Ransomware readiness is mostly about backups, identity, and a plan. A cybersecurity risk assessment will show you exactly where your recovery story has holes — before an attacker finds them.