How to Prevent Ransomware Attacks

Ransomware is the threat that turns a routine Tuesday into a board-level crisis. It encrypts your files, halts trading, and often steals data before the lock screen even appears. The good news for UK SMEs is that the controls that stop it are well understood, affordable, and mostly things you should be doing anyway. This guide walks through what actually works, in priority order, and where the common gaps sit. It sits under our managed cybersecurity pillar, where we cover the wider security programme these controls plug into.

If you only take one idea away: ransomware prevention is not a product you buy, it is a set of layers you maintain. Attackers look for the weakest one. Your job is to make sure none of them is missing.

What is the single most important step to prevent ransomware?

The single most important step is removing the easy ways in: enforce multi-factor authentication on every account, and filter email aggressively. The overwhelming majority of attacks start with a stolen password or a malicious email, so closing those two doors blocks most opportunistic ransomware before it ever runs.

Phishing is the dominant entry route. 85% of businesses that experienced a breach identified phishing as the attack vector (Cyber Security Breaches Survey 2025, DSIT) — see the official UK survey. MFA neutralises the second route: even when a password leaks, the attacker cannot log in without the second factor. These two controls cost little and stop a disproportionate share of attacks, which is why we treat them as non-negotiable on every account, not just admin ones.

How does layered ransomware protection actually work?

Layered protection means stacking controls so that if one fails, the next catches the attack. A malicious email gets filtered; if it slips through, MFA stops the credential theft; if access still happens, EDR spots the encryption behaviour; and if everything fails, immutable backups let you recover without paying. Each layer covers the others' blind spots.

Here are the core layers we recommend for UK SMEs, in order of priority:

• Advanced email filtering — scans attachments and links in real time and blocks the malicious payloads ransomware crews rely on. Pair it with DMARC and DKIM to cut spoofed email reaching staff. This is the heart of our email security service.
• Multi-factor authentication — the single most effective control against credential-based access. Compromised passwords become useless without the second factor.
• Patch management — high and critical patches applied within 14 days close the known vulnerabilities attackers exploit. Fourteen days is the Cyber Essentials standard, and unsupported software should be removed or isolated.
• Endpoint detection and response (EDR) — detects ransomware behaviour such as mass file encryption and unusual process activity, then terminates the process before damage spreads. This underpins our endpoint security and 24/7 detection work.
• Immutable offsite backups — stored where ransomware cannot reach or modify them, these are your guaranteed recovery path. Test them regularly.
• Security awareness training — staff who recognise phishing trigger fewer infections. Simulated phishing campaigns find and train the most vulnerable users.

The order matters. Email filtering and MFA stop the most attacks for the least money. Backups are the safety net that decides whether an incident is an inconvenience or an existential threat.

Why is signature-based antivirus not enough?

Signature-based antivirus only blocks malware it already recognises. Modern ransomware mutates constantly and is increasingly built to disable or bypass traditional antivirus altogether. Behavioural detection through EDR is the more robust layer because it watches what software does — mass encryption, privilege escalation — rather than matching a known fingerprint.

The table below shows why basic antivirus leaves dangerous gaps, and what a full ransomware defence stack adds.

If your defence stops at antivirus, you are protected against yesterday's threats and exposed to today's. The NCSC's ransomware guidance makes the same point: prevention depends on a combination of controls, not a single product.

What should you do if you are hit despite prevention?

If ransomware gets through, do not pay and do not improvise. Isolate affected devices from the network immediately, preserve evidence, identify the entry point, and recover from clean immutable backups. A rehearsed incident response plan turns a panicked scramble into a controlled process — which is exactly why the plan must exist before the attack, not after.

Prevention and response are two halves of the same job. The fastest, cheapest recoveries we see are at organisations that had isolated backups and a tested plan ready to go. Our incident response team handles containment and recovery, and for the backups themselves, Microsoft 365 backup protects the data most SMEs forget is not backed up by default. If you want to understand the threat itself in more depth, start with what is ransomware.

How much does ransomware actually cost a UK business?

The direct ransom is often the smaller number. The average cost of the most disruptive breach is £3,550 (Cyber Security Breaches Survey 2025, DSIT), but that headline figure hides downtime, lost orders, recovery labour, and reputational damage that can run far higher for a business that cannot trade for days.

Approximately 19,000 UK businesses were hit by ransomware in 2025 (Sophos). Whatever the precise count, ransomware is no longer a problem only large enterprises face — SMEs are targeted precisely because their defences are assumed to be thinner. The economics favour prevention overwhelmingly: the layered controls above cost a fraction of a single serious incident, and they reduce dozens of other risks at the same time.