Ransomware Protection for Businesses: How Attacks Work and How to Stop Them

Ransomware is now the cyber threat most likely to stop a business cold. One click, one exposed service, or one stolen password can lead to encrypted servers, a ransom demand, and days of downtime. The good news is that ransomware is also one of the most preventable attacks, because it relies on a short list of entry points that solid controls can close.

Defensive Security

Here is a practical guide to how these attacks work, how to stop them, and what to do if one gets through.

What ransomware actually is

Ransomware is malware that encrypts your files and systems, then demands payment for the key. Modern crews rarely stop at encryption. Most now use "double extortion": they steal a copy of your data first, then threaten to leak it publicly if you do not pay, even if you can restore from backups. Some add a third layer, such as denial-of-service or contacting your customers, to increase pressure.

In practice an attack has three stages: get in, spread and steal, then detonate. The time between the first foothold and encryption can be days or just hours.

How ransomware gets in

Almost every case starts with one of these:

• Phishing: a malicious attachment or link that drops a loader. See our breakdown of how a modern phishing attack works.
• Exposed remote access: internet-facing RDP, VPNs, or management ports with weak or reused passwords.
• Stolen or reused credentials: often bought from infostealer logs, then used to log in like a normal user.
• Unpatched vulnerabilities: known flaws in VPNs, firewalls, and public-facing apps that are exploited within days of disclosure.
• Supply chain and third parties: a trusted vendor or software update that carries the attacker in.

How to protect your business

No single tool stops ransomware. Layered controls do. In rough order of impact:

• Backups you have actually tested. Follow 3-2-1: three copies, two media types, one offline or immutable. Verify you can restore, and keep at least one copy out of reach of domain admin.
• Multi-factor authentication everywhere, especially on email, VPN, and any remote access. This alone blocks most credential-based entry.
• Patch fast, starting with anything internet-facing. A ranked patch process matters more than patching everything at once.
• Endpoint detection and response (EDR) on every machine, to catch the spread before encryption.
• Email and web filtering to cut down on the phishing that starts most cases.
• Least privilege and network segmentation, so one compromised machine cannot reach everything. This is the core idea behind a zero trust approach.
• Security awareness training, so staff report the suspicious email instead of clicking it.
• A written, tested incident response plan, covered in our guide to an incident response plan that works.

What to do in the first hour of an attack

1. Isolate, do not power off. Disconnect affected systems from the network to stop spread, but leave them on where possible so responders can preserve evidence.
2. Invoke your incident response plan and assemble the team. Communicate through an out-of-band channel in case email is compromised.
3. Do not pay or negotiate reflexively. Get expert eyes on scope first.
4. Bring in specialists for containment, forensics, and recovery, and preserve logs.
5. Report it. Notify law enforcement and check your legal and regulatory obligations, including any breach-notification deadlines.
6. Restore from clean backups only after the intruder is fully evicted, or you will simply be re-encrypted.

Should you pay the ransom?

Treat paying as a last resort, not a plan. Payment does not guarantee a working key or that your stolen data is deleted, it funds the next attack, and in some cases paying a sanctioned group can itself be unlawful. The better investment is tested backups and the controls above, which make paying unnecessary.

Frequently asked questions

How does ransomware usually get into a company?
Most commonly through phishing, exposed or weakly protected remote access (like RDP or VPN), stolen or reused passwords, and unpatched internet-facing systems. Supply chain compromise is a growing path too.

Will antivirus stop ransomware?
Traditional antivirus helps but is not enough on its own. Modern defense needs layers: MFA, fast patching, EDR, email filtering, least privilege, and above all tested, offline or immutable backups.

If we have backups, are we safe from ransomware?
Backups are the single most important control, but only if they are tested and kept out of the attacker's reach. They also do not solve double extortion, where data is stolen and threatened with release, so prevention still matters.

Should we pay the ransom?
Only as a genuine last resort. Payment does not guarantee recovery or deletion of stolen data, it funds future crime, and paying certain sanctioned groups may be illegal. Focus on backups and prevention so you never have to decide.