What endpoint protection does against ransomware
Ransomware has to run on a machine to do damage. That machine is an endpoint: a laptop, a desktop, a server, sometimes a phone. Endpoint protection is the software and settings that try to stop the malware from running, or stop it partway through encrypting your files.
It isn't one product. It's a stack: detection software, restricted permissions, patching, and backups you can restore from. If any one layer is missing, the others carry more weight than they can handle.
Why old-style antivirus falls short
Traditional antivirus compares files against a list of known bad ones. Attackers know this, so they repackage their code until the list doesn't match. They also lean on tools already on your machines, like PowerShell and remote admin utilities, which no signature list would flag.
Modern endpoint detection and response (EDR) watches behavior instead. It notices that a Word document launched a script, that the script reached out to an unknown server, and that a process is now renaming thousands of files in a minute. Then it kills the process and can isolate the machine from the network.
If you're still running signature-only antivirus, that's the first thing to replace.
Which product to pick
My view: for a business under about 200 people with no dedicated security staff, buy EDR with a managed service attached, meaning humans watching the alerts. Microsoft Defender for Business is a sound base if you already pay for Microsoft 365. CrowdStrike Falcon and SentinelOne are the usual names in the paid tier. The brand matters less than whether anyone responds when it fires.
An alert at 2 a.m. that nobody reads is a log entry. Ransomware crews often launch on nights and weekends for that reason.
I wouldn't bother with standalone "anti-ransomware" add-ons that watch only for file encryption. They catch one stage of the attack, late, and add another agent to maintain. Good EDR already does that and more.
Settings to turn on this week
Most of the cheap wins are configuration, not purchases.
- Remove local admin rights from everyday user accounts. Plenty of ransomware needs elevated permissions to spread or to delete backups. This is the single most useful change you can make, and it costs nothing but some grumbling.
- Block Office macros in files that came from the internet. Windows and Microsoft 365 can enforce this by policy.
- Turn on tamper protection in your security software so malware can't switch it off.
- Enable controlled folder access (in Windows) or the equivalent in your EDR for documents and shared drives. It's noisy at first. Run it in audit mode for two weeks, then enforce.
- Use unique local admin passwords per machine. Microsoft's LAPS tool handles this for Windows. Identical admin passwords let an attacker hop from one PC to all of them.
- Never expose Remote Desktop (RDP) directly to the internet. Put it behind a VPN or a gateway with multi-factor authentication.
Multi-factor authentication belongs on email, VPN, remote access, and every admin account. Stolen passwords are a common way in, and MFA blunts that.
Patching: set a clock
Attackers go after known flaws in browsers, VPN appliances, and file-transfer tools. A patch you haven't applied is an open door with a public map.
Here's a sensible schedule. Treat these as rules of thumb, not measured standards:
- Internet-facing systems with a critical flaw: patch within 72 hours.
- Everything else rated critical or high: within 14 days.
- Routine updates: monthly.
Track the patch rate. If 95% of your machines are current and 5% haven't checked in for 90 days, those 5% are where the trouble starts.
Backups decide how bad the day is
Detection will fail sometimes. Backups determine whether that failure is a bad afternoon or a company-ending event.
The old 3-2-1 rule still holds: three copies of your data, on two kinds of storage, with one copy off-site. I'd add a fourth word: immutable. Attackers hunt for backup servers and delete them before they encrypt anything. A copy that can't be altered or deleted for a set period, even by an admin account, survives that.
Practical targets:
- Frequency: daily at a minimum for file servers. Hourly or continuous for databases that change fast.
- Retention: keep at least 30 days of versions. Ransomware can sit quietly for days, and you don't want every copy to be an encrypted one.
- Restore tests: quarterly, and time them. Restore one full server and one set of user files, then write down how long it took.
That last number matters. Many businesses discover their "four-hour recovery" is actually nine days because the data is large and the connection is slow.
Untested backups are a hope, not a plan.
What it costs, and what it saves
Prices vary by vendor and contract, but as a rough guide, EDR runs about $3 to $10 per endpoint per month. A managed detection and response service on top typically lands around $10 to $25 per endpoint per month. Get quotes; don't take my range as a price list.
Here's the arithmetic for a 50-person company. Say loaded labor costs average $40 an hour. A three-day outage of eight working hours each is 24 hours, or about $48,000 in wages for people who can't work. That excludes lost sales, recovery help, and any ransom.
Managed EDR for 50 endpoints at $20 a month is $12,000 a year. At the low end, EDR alone at $5 a month is $3,000. One avoided outage pays for several years of it. If you only prevent a half-day disruption, it's close to break-even.
A rollout that fits in 90 days
You don't need to do everything at once. Here's an order that works.
Days 1–14: Inventory every device. You can't protect machines you don't know about. Turn on MFA for email and remote access. Close exposed RDP.
Days 15–45: Deploy EDR to a pilot group of about 10% of devices, then the rest. Remove local admin rights in stages, department by department, so you can fix what breaks.
Days 46–75: Set up immutable backups. Run your first restore test and record the time.
Days 76–90: Write a one-page response plan: who to call, which machines to unplug first, where the backup credentials are stored on paper or in a separate vault. Rehearse it for an hour.
When something fires
If EDR flags active encryption, isolate the machine from the network first. Pull the cable or use the isolate button in the console. Don't shut it down right away, because memory can hold useful evidence.
Then check what else that machine could reach. Reset credentials it touched. Only after that do you start restoring.
Don't decide on a ransom payment in the first hour. Call your insurer, if you have cyber coverage, and your lawyer. Policies often require you to notify them before you take recovery steps, so read yours before you need it.
The short version
Replace signature-only antivirus with EDR, and pay for someone to watch it if you can't. Strip admin rights. Patch on a schedule. Keep immutable backups and prove you can restore them.
None of this is exotic. It's mostly discipline, and discipline is cheaper than an outage.