Preventing Malware and Ransomware Attacks in Your Business

*Nathan Hill-Haimes, Technical Director · 10 min read · Updated June 2026*

How do malware and ransomware get into a business network?

Most incidents trace back to a handful of entry points, not exotic zero-days. Phishing email, unpatched internet-facing systems and stolen credentials account for the overwhelming majority of malware and ransomware affecting UK SMEs. Knowing the pathways tells you where to spend your defensive effort first.

Phishing remains the single most common breach type identified by UK businesses, according to the government's Cyber Security Breaches Survey 2025. The routes attackers actually use:

• Phishing emails — malicious links or attachments that socially engineer a user into clicking, downloading, or entering credentials on a fake login page. Still the most common delivery mechanism.
• Unpatched vulnerabilities — VPN appliances, remote desktop (RDP), Exchange and other internet-facing systems with known flaws are scanned and exploited within days of public disclosure.
• Compromised credentials — stolen logins (from phishing, breach dumps or brute-forcing weak passwords) used against VPN, RDP or Microsoft 365 give direct access with no malware needed.
• Drive-by downloads — visiting a compromised or malicious website installs malware, especially on unpatched browsers or legacy systems running Java or Flash.
• USB and removable media — less common in offices, but still relevant in manufacturing and industrial settings.

The NCSC's guidance on mitigating malware and ransomware maps controls to each of these pathways. The sections below follow the same logic.

How do you reduce the attack surface attackers can reach?

The first layer shrinks what an attacker can even touch before exploitation is possible. You patch fast, take remote access off the public internet, filter email, and block malicious domains at the DNS level. Each control removes a category of opportunity rather than waiting to catch an attack in progress.

• Patch management — apply critical and high-severity patches within 14 days, prioritising internet-facing systems, VPN appliances and remote access. Automated tooling (Windows Update for Business, RMM agents) keeps the workload manageable.
• Disable unnecessary services — RDP should never face the internet directly. If remote desktop is needed, expose it only through VPN or Zero Trust network access, never a public port. Audit internet-facing services regularly.
• Email filtering — anti-spam, sandboxed attachment detonation and time-of-click URL scanning cut the volume of malicious content reaching inboxes. This is core to AMVIA's phishing protection approach.
• DNS filtering — block connections to known-bad domains so malware that lands on a device cannot call home or pull down a second-stage payload.

Why is endpoint detection and response the core control?

When something bypasses email and network filters, the endpoint is where you catch it. Endpoint detection and response (EDR) watches behaviour rather than signatures — flagging ransomware-style file encryption, process injection and living-off-the-land techniques even when the specific malware is brand new and unknown to any antivirus database.

EDR technology on its own is not enough. Alerts that sit unreviewed never turn into containment, and ransomware commonly detonates overnight and at weekends. That is why AMVIA delivers endpoint detection and response as a monitored service — Microsoft Defender for Endpoint watched by an in-house 24/7 SOC, so detections are acted on around the clock.

How do identity and access controls stop the spread?

Many infections spread by credential, not by malware file. An attacker who lands on one machine steals credentials and reuses them to move laterally. Tightening identity controls — MFA, least privilege and protected admin accounts — denies that lateral movement and contains the blast radius of any single compromise.

• MFA on every account — stops compromised credentials from authenticating to cloud services or VPN. Non-negotiable for Microsoft 365.
• Least privilege — users should not hold local administrator rights unless their role genuinely requires it. Local admin is what most malware needs to install and persist.
• Privileged access workstations — IT admins should run privileged tasks from a dedicated, hardened device, not a general-purpose laptop that also reads email.
• Credential Guard — Windows Defender Credential Guard protects credential material in memory, blunting the harvesting tools used for lateral movement.

These controls layer directly onto a hardened Microsoft tenant. See AMVIA's wider managed detection and response service for how identity signals feed the same monitoring pipeline.

How do backups decide whether ransomware costs you everything?

Backups do not prevent infection — they decide whether an infection becomes a catastrophe. If you can restore clean data quickly, ransom pressure evaporates. The 3-2-1 rule is the floor: three copies, on two media types, with one copy offline or immutable so ransomware cannot reach it.

What makes a backup genuinely ransomware-resilient:

• Immutable or offline copies — cloud backup with object lock, or offline media, cannot be encrypted by an attacker who reaches your live environment.
• Separate credentials — backup systems must not share admin accounts with production. A compromised domain admin should not also be able to delete your backups.
• Tested restores — most failed backups are discovered during a live incident. Test restoration on a schedule, not in a crisis.
• Microsoft 365 is not backed up by Microsoft — Microsoft provides data-centre resilience, not a backup service. A third-party Microsoft 365 backup for Exchange, SharePoint and OneDrive is necessary, as Microsoft's own shared responsibility documentation makes clear.

What should you do when prevention fails?

No stack is 100% effective, so rehearse the response. When malware is confirmed, the priority order is isolate, contain, preserve, communicate, recover — in that sequence. Acting in the wrong order, especially reimaging a machine before evidence is captured, destroys the information you need to understand the breach.

1. Isolate — disconnect the affected device immediately: WiFi, Ethernet and any VPN. This limits lateral spread. 2. Contain — identify other affected devices through EDR telemetry or network traffic analysis. 3. Preserve — do not reimage before forensic evidence is collected; it determines how the attacker got in. 4. Communicate — notify your IT or MDR provider, your cyber insurer, and — if personal data may be affected — begin the GDPR breach assessment with the ICO. 5. Recover — restore from clean backups once the initial vector and scope are understood.

Reduce your ransomware exposure before an attacker finds the gap

Most breaches exploit a control you already meant to fix. AMVIA reviews your current malware and ransomware defences — email filtering, patching, EDR, identity and backups — and returns a prioritised remediation plan that closes the gaps most likely to be exploited.

One provider. Security-first. Microsoft-certified. Start with a free, no-obligation review: book your free security audit.

Related Reading

• What Is Ransomware? Plain English Guide for Business
• Ransomware Protection for UK Businesses