Ransomware is the threat that keeps small business owners up at night, and for good reason. The stories are everywhere: a clinic locked out of its records, a contractor who lost a week of revenue, a nonprofit that paid and never got its data back. The natural reaction is to assume that real protection requires a full IT department you can’t afford to hire.
It doesn’t. Most ransomware that hits businesses your size isn’t a hand-crafted attack. It’s opportunistic, and it gets in through the same handful of gaps over and over. Close those gaps with a few layers, and you’ve moved yourself out of the easy-target category without building a security team. Here’s how to do that when it’s just you, an office manager, and maybe a partner who handles IT.
Understand how ransomware actually gets in
You can defend more effectively once you know the usual path. The large majority of ransomware incidents start one of three ways: someone clicks a phishing email and enters their password or opens a malicious attachment, an attacker logs in with a password that leaked in someone else’s breach, or a flaw on an internet-facing system gets exploited by automated scanning. The federal #StopRansomware guidance from CISA confirms these as the dominant entry points.
That’s good news, because it means a small number of well-placed defenses cover most of the risk. You’re not defending against everything. You’re blocking the common doors.
The layers that stop most ransomware
Think of this as a stack, where each layer catches what the one before it missed. An attacker needs only one way through; you want several barriers in the way.
Turn on multi-factor authentication everywhere. A stolen password is the single most common starting point for ransomware, and MFA makes a stolen password nearly useless on its own. Start with email and remote access. This is the cheapest, highest-impact thing you can do, and it is usually already included in software you pay for.
Run modern endpoint protection on every device. Behavior-based endpoint detection watches for the signature moves of ransomware, like a process trying to encrypt files in bulk, and isolates the machine before it spreads. This is a big step up from the basic antivirus most small businesses are still running.
Remove everyday administrator rights. When ransomware lands on an account with admin powers, it can disable your defenses and reach across the network. When it lands on a standard account, it is largely stuck. Letting your team work as standard users, with approved elevation only when a task needs it, is one of the most underrated protections there is.
Keep systems patched. The automated scanners attackers use look for known, fixable flaws. Consistent updates close those before they can be used.
Train your people to pause. A short, regular awareness habit means your team recognizes a suspicious email instead of clicking it. People are a layer, and a person who slows down stops the attack at the front door.
The backup that decides everything
Even with strong prevention, you plan as if something could still get through, because the businesses that recover well are the ones whose backups were ready.
Two truths here. First, cloud does not mean backed up. Microsoft and Google keep their platforms running, but recovering your encrypted or deleted data is your responsibility, not theirs. You need a backup of your Microsoft 365 or Google Workspace data, your servers, and your endpoints. Second, a backup you have never tested is a hope. We have walked into recovery situations where backups had been quietly failing for months. Your backups should be immutable, so an attacker who breaks in cannot delete or encrypt them, and they should be test-restored on a schedule. We dig into what trustworthy backups look like in our piece on how to know your backups actually work.
Have a plan for the worst hour
The first hour of an incident is chaos if nobody knows the plan. Write a short, plain incident response plan and make sure your people have read it, so the first hour is spent acting, not figuring out who to call. As part of that, keep a one-page response sheet handy for the most common trigger, an employee clicking a phishing link. We made a printable version, Employee Clicked a Phishing Link: Do This Now, that you can post by the desk so the right first moves happen fast.
You don’t have to do this alone
Here’s the part that matters most when you don’t have an IT team. None of this requires you to become a security expert. It requires the controls to be set up correctly and then maintained, which is exactly what a managed provider does for businesses your size. The point of partnering with someone local is that the monitoring, patching, backup testing, and the 2 a.m. response all happen without you hiring for them.
That layered approach, real tools backed by real, accountable people, is the whole idea behind our People+ Framework and our work in cybersecurity for small business. We believe technology should enhance the people protecting your business, not replace them with an offshore call center that has never met you.
Where to start
Pick the top of the list, MFA, and get it done this week. Then work down. If you’d like an honest read on where your biggest ransomware gaps are right now, that’s exactly what a discovery call is for. We’ll sit down, look at what you have, and give you a clear picture of what to fix first. No pressure, no jargon.