What a ransomware solution actually is
No single product solves ransomware. A solution is a stack of four things: backups the attacker can't touch, locked front doors, something watching for trouble, and a written plan for the day those fail.
Buy them in that order. Most companies do the reverse.
Start with backups the attacker can't delete
Modern ransomware crews don't just encrypt your files. They hunt for your backups first, and they delete or encrypt those before announcing themselves. A backup sitting on a network share with the same admin password as everything else is a backup in name only.
The old 3-2-1 rule still holds: three copies of your data, on two different types of storage, with one copy offsite. Add a fourth requirement for today: at least one copy must be immutable or offline. Immutable means that nobody, including your own domain admin, can change or delete it until a retention timer expires.
Cloud object storage with an object-lock feature does this well. As a rule of thumb, expect to pay roughly $5 to $25 per terabyte per month depending on the provider and region. Prices move, so check current rates. For a small business with 2 TB of critical data, that's a few dollars to a few tens of dollars a month. It pays for itself the first time you don't need to negotiate.
How often should you back up? Ask how much work you can afford to redo. That's your recovery point.
- Databases and finance systems: every 1 to 4 hours
- File servers: nightly, or every 4 to 12 hours if people work in them all day
- Laptops and workstations: daily, or skip them entirely if everything lives in managed cloud storage
Then test the restore. Not the backup job, the restore. Once a quarter, pull back a real server or a real folder and time it. A restore that takes 11 days when you assumed 2 is the number you want to learn about now.
Close the doors attackers use most
Ransomware gets in through a short list of routes: stolen or guessed passwords on remote access, unpatched internet-facing systems, and phishing emails. Fix those three and you've removed most of the easy paths.
Multi-factor authentication everywhere that matters. Start with email, VPN, remote desktop gateways, and every admin account. If you use Microsoft 365, the built-in security defaults turn this on at no extra licensing cost. Prefer app-based or hardware-key authentication over text messages. SMS codes are better than nothing, but they're the weakest option.
Never expose Remote Desktop Protocol directly to the internet. Not on a nonstandard port, not "just for the accountant." Put it behind a VPN or a zero-trust access gateway. This one change closes a door attackers have used for years.
Patch on a schedule with a fast lane. A workable rule of thumb: critical fixes for anything internet-facing within 7 days, ideally sooner if the vulnerability is being actively exploited. Everything else can follow a monthly cycle. CISA publishes a Known Exploited Vulnerabilities catalog that you can use as a priority list. If a flaw is in it, treat it as urgent.
Boring work. It's also where most of the protection comes from.
Detection: pick managed EDR
Endpoint detection and response (EDR) software watches what programs do on a computer, not just what they look like. It can spot behavior such as a process rapidly renaming thousands of files, and it can isolate the machine automatically.
Here's where I'll take a side. If you have fewer than about 200 employees and no round-the-clock security staff, buy managed detection and response (MDR), meaning EDR with a vendor's analysts watching the alerts, rather than running EDR yourself. Ransomware operators often launch at 2 a.m. on a Saturday. A dashboard that nobody reads until Monday morning is decoration.
Typical pricing is a rule of thumb, not a quote. Basic EDR often runs a few dollars to around $10 per endpoint per month, and managed services commonly land somewhere around $10 to $25 per endpoint per month. For 100 endpoints, call it $1,000 to $2,500 a month. Compare that to a week of lost operations and the math is not close.
Skip the standalone "AI-powered" product that promises to stop everything without a human involved. Ask any vendor three questions instead: who responds at 3 a.m., how fast can they isolate a host, and what do they do when they're wrong?
Limit how far an intruder can travel
Assume someone gets in. What can they reach?
Three habits shrink the damage:
- Separate admin accounts. Nobody should read email or browse the web with a domain admin account. Give admins a regular account for daily work and a distinct one for administration.
- Segment the network. Put servers, backups, and guest Wi-Fi on separate segments. Your backup system shouldn't be reachable from every workstation.
- Remove standing access. If a contractor needed access in March, it should be gone by April.
Segmentation sounds expensive, but a basic version, with a few VLANs and sensible firewall rules, is often a weekend of work for a small network.
Write the plan before the bad day
During an attack, people make poor decisions because nobody knows who decides anything. A one-to-two page plan fixes most of that.
It should name:
- Who has authority to shut systems down (a person, with a backup person)
- Who calls your insurer, lawyer, and incident response firm, with phone numbers
- Where the plan itself is stored, because it can't live only on the servers that just got encrypted. Print a copy.
- How you'll communicate if email is down
Run a tabletop exercise once a year. Gather the key people for 90 minutes, read a realistic scenario aloud, and ask what happens next. You'll find gaps within the first 20 minutes.
What to skip
Don't plan on paying.
Payment doesn't guarantee a working decryptor, and it doesn't guarantee the stolen data gets deleted. Recovery after payment can still take weeks. Payments may also carry legal risk. The U.S. Treasury's OFAC has warned that paying certain sanctioned groups can lead to penalties. Talk to counsel before any such decision.
I also wouldn't lean on cyber insurance as your main control. It's worth having, and many insurers now require MFA and tested backups before they'll write a policy, but it reimburses costs. It doesn't restore your customer trust or your uptime. Think of it as the last layer, not the first.
Finally, don't spend heavily on threat intelligence feeds or advanced tooling until the basics above are done. Fancy tools on top of a flat network with no MFA is like installing a vault door on a tent.
A sensible first 90 days
If you're starting from little, here's the order I'd follow.
Days 1 to 30: Turn on MFA for email, remote access, and admins. Remove any direct RDP exposure. Set up one immutable backup copy of your most important data.
Days 31 to 60: Deploy EDR or MDR to every server and workstation. Set the patching cadence. Split admin accounts from daily accounts.
Days 61 to 90: Test a full restore and record the time. Write the incident plan. Run a tabletop exercise.
Budget, as a rough guide for a 100-person company: perhaps $1,500 to $3,500 a month in tooling, plus some one-time labor. That's a rule of thumb, and your numbers will shift with your size and existing licenses.
Ransomware is a business problem that shows up as a technical one. You don't need to be perfect. You need to be a harder, less rewarding target than the next company on the list, and to be able to recover without the attacker's help.