In short
You protect a business against ransomware with layered defences: keep systems patched, run managed endpoint protection, filter phishing emails, restrict user privileges, and — critically — maintain immutable, tested, offline backups. If ransomware still gets in, reliable backups let you restore without paying a ransom.
What is ransomware and why it matters
Ransomware is malicious software that encrypts your files and systems, then demands payment for their release. A single infection can halt an entire organisation, and paying the ransom offers no guarantee of recovery. Most attacks start with a phishing email or an unpatched, internet-exposed system — both of which are preventable.
The layered defence approach
No single product stops ransomware. Effective protection stacks multiple layers so that if one fails, others still protect you. Follow the steps below in order — the final one, tested backups, is your guarantee of recovery.
Step by step: How to protect your business against ransomware
Patch everything, promptly
Keep operating systems and applications up to date. Unpatched systems are one of the most common entry points; automated patch management closes these gaps quickly.
Deploy managed endpoint protection (EDR)
Install endpoint detection and response on every device. Modern EDR spots the suspicious behaviour of ransomware early and can isolate a device before it spreads.
Filter email and train staff
Most ransomware arrives by phishing. Use email filtering to block malicious messages, and train staff to recognise and report phishing — the human layer matters as much as the technical one.
Restrict privileges and segment the network
Give users only the access they need, and segment your network so an infection can't spread freely. This limits the blast radius of any single compromise.
Maintain immutable, tested, offline backups
Keep backups that attackers cannot alter or delete (immutable/offline), and test that you can actually restore from them. This is the last line of defence — with good backups you can recover without paying a ransom.
Prepare an incident response plan
Document what to do if an attack happens — who to call, how to isolate systems, how to restore. A rehearsed plan turns a crisis into a controlled recovery.
Key takeaways
- Ransomware usually enters via phishing or unpatched systems — both preventable.
- Use layered defences; no single product is enough.
- Immutable, tested, offline backups are the guarantee of recovery.
- A rehearsed incident-response plan limits damage.
Frequently asked questions
How do businesses protect against ransomware?
By layering defences: patch systems promptly, run managed endpoint detection, filter phishing emails and train staff, restrict user privileges and segment the network, and maintain immutable, tested offline backups. If ransomware still gets in, those backups let you restore without paying the ransom.
Should we pay the ransom if attacked?
Security experts and law enforcement generally advise against paying. Payment funds criminal activity, marks you as a willing target, and offers no guarantee your data will be restored. With tested backups you can recover without paying — which is exactly why backups are the priority.
What is the single most important ransomware protection?
Immutable, tested, offline backups. Every other layer reduces the chance of infection, but reliable backups guarantee you can recover even if an attack succeeds — turning a potential disaster into a manageable event.