What Is Ransomware? A Guide for UK Businesses

How does ransomware actually work?

Ransomware works in stages: it gains access, spreads quietly, then encrypts. Once inside a network it locates valuable files — documents, databases, backups — encrypts them with a key only the attacker holds, and drops a ransom note. Double-extortion strains exfiltrate that data first, so paying never guarantees it stays private.

The mechanics matter because they tell you where to break the chain. The earlier you detect the intrusion, the cheaper it is to stop. By the time files are being encrypted, you are already in incident-response territory rather than prevention. That is the entire argument for continuous monitoring through endpoint detection and response rather than relying on antivirus alone.

How does ransomware get into a UK business network?

The most common entry points are phishing emails with malicious attachments or links, exposed Remote Desktop Protocol (RDP) services, and unpatched software vulnerabilities. Phishing dominates: 85% of businesses that experienced a breach identified phishing as the attack vector (Cyber Security Breaches Survey 2025), which is why email is the single most important control to harden.

That makes email security your first line of defence. AMVIA combines Microsoft Defender with the Barracuda email suite to filter malicious attachments and links before they reach an inbox, backed by DMARC, SPF and DKIM authentication to block spoofing. According to the NCSC, keeping software patched and disabling unused remote-access services closes the other two main routes attackers use.

• Phishing emails — malicious links and attachments delivered to staff inboxes.
• Exposed RDP — internet-facing remote desktop with weak or reused passwords.
• Unpatched software — known vulnerabilities attackers scan for and exploit.
• Stolen credentials — reused passwords bought on criminal marketplaces.

How bad is the ransomware threat to UK businesses?

Ransomware is rising sharply. Among UK businesses it more than doubled from less than 0.5% to 1% — approximately 19,000 businesses affected. Encryption outcomes are getting worse too: 70% of UK ransomware attacks resulted in data being encrypted, up from 46% in 2024 (2025 UK market data). The trend line is the point — this is no longer a large-enterprise problem.

The financial impact lands hardest on smaller organisations without tested recovery. The average cost of the most disruptive breach is £3,550 (DSIT 2025), but a full ransomware event — downtime, recovery, lost revenue, regulatory exposure — runs far higher. The Cyber Security Breaches Survey 2025 shows phishing and ransomware remain the dominant threats facing UK businesses of every size.

How do you protect your business from ransomware?

Effective ransomware protection is layered — no single control is enough. The goal is defence in depth: stop most attacks at the email gateway, detect the rest at the endpoint, and guarantee recovery with backups you have actually tested. AMVIA delivers all of this from one accountable provider.

• Email security — advanced filtering plus DMARC/SPF/DKIM authentication cuts the most common delivery route. See email security.
• Endpoint detection (EDR) — Microsoft Defender for Endpoint watches device behaviour in real time, catching ransomware before it encrypts, even when the malware is brand new.
• Tested, immutable backups — air-gapped backups, tested regularly, are your last line of defence. Microsoft 365 backup protects cloud data that native retention does not.
• Staff awareness — training people to spot phishing reduces the chance of initial access.
• Patch management — updating software and operating systems closes the vulnerabilities ransomware uses to spread.
• 24/7 monitoring — AMVIA's in-house SOC detects ransomware activity in its early stages, before encryption begins, enabling rapid managed detection and response.

Should you pay a ransomware demand? Pay vs recover vs prevent

You should not pay. UK law enforcement and the NCSC advise against paying ransoms — payment does not guarantee recovery, funds criminal groups, and marks you as a willing payer for future attacks. The economics are stark once you compare paying, recovering without backups, and preventing the attack outright.

Note: ransom amounts and recovery costs vary significantly with business size and attack severity. The managed-prevention figure is the only one you control in advance — and it is a fraction of the alternatives.

What should you do if you are hit by ransomware?

Isolate first, then escalate. Disconnect affected devices from the network to stop the spread, but do not power them off — volatile memory can hold evidence. Engage incident response specialists immediately, preserve logs, and begin recovery from your most recent tested backup rather than negotiating with attackers.

Reporting matters too. UK businesses should report ransomware to Action Fraud and the NCSC, and notify the ICO within 72 hours if personal data is affected. A rehearsed plan turns a crisis into a procedure — which is exactly what AMVIA's 24/7 SOC and incident-response process exist to provide.