Webbit

Ransomware Protection for Small Business: A Practical 2027 Guide

How ransomware reaches small businesses, the five defences that matter most and a first-hour plan for the day it happens.

Ransomware is software that locks your files or systems and demands payment to release them. Many attackers also steal a copy first and threaten to publish it. For a small business the pain is rarely the ransom itself. It's the days of lost orders, idle staff and awkward calls to customers.

Why it still works in 2027

Verizon's 2026 Data Breach Investigations Report says exploiting software vulnerabilities is now the most common way into a network, with stolen credentials in second place, as summarised by Help Net Security. The same coverage says most ransomware victims, about 69%, didn't pay. Verizon's small-business summary also found that for firms with under USD 25 million in revenue, the median loss was far smaller than the headline cases, though the worst cases were severe. Treat those figures as a guide and read the report itself before quoting them.

The Jaguar Land Rover incident in 2025 shows the other side. A shutdown of roughly six weeks affected more than 5,000 organisations in its supply chain, with the Cyber Monitoring Centre estimating about £1.9 billion in losses, according to Cybersecurity Dive. Most businesses will never face that scale, but the lesson applies at any size: downtime is the real cost.

How ransomware gets in

Route	What it looks like	What closes it
Unpatched system	A VPN, firewall or remote tool with a known flaw is exploited	Patch internet-facing systems within days, and remove what you don't use
Stolen login	A reused or phished password logs in as a real user	Multi-factor sign-in and a password manager
Phishing email	A link or attachment installs software	Email filtering, staff training and a reporting habit
Supplier or tool	A trusted provider's account is used to reach you	Limit supplier access and review it regularly

The five defences that matter most

Patch quickly. Start with anything reachable from the internet, then work inwards.
Turn on multi-factor sign-in for email, remote access and every admin account.
Keep backups that ransomware can't reach. At least one copy should be offline or immutable, and you should test restoring from it.
Limit admin rights. If an attacker takes over an ordinary account, they shouldn't be able to reach everything.
Watch for warning signs, such as unusual sign-ins, large file changes and security tools being switched off.

The backup test most businesses skip. A backup you haven't restored from is a hope, not a plan. Pick one important system, restore it to a clean machine, and time how long it takes. That number tells you how long you could be down.

Your first hour if it happens

Disconnect affected machines from the network. Unplug cables and turn off Wi-Fi, but don't power down, because memory can hold useful evidence.
Call the person who owns the response, and your IT or security provider.
Don't delete anything and don't reply to the attacker yet.
Check whether your backups are intact before anyone starts restoring.
Note the time, what you saw, and who did what. You'll need it for insurers, regulators and lawyers.
Decide who speaks to staff and customers, and what they'll say.

Should you pay?

Law enforcement agencies generally advise against paying, because payment funds more attacks and gives no guarantee that you'll get your data back or that stolen files won't be leaked anyway. Some businesses still conclude that paying is their only route. Sanctions rules can also make payment illegal in some cases. Make your position, and the name of the adviser you'd call, part of your plan before anything happens.

Tell the right people

If personal data was affected, you may have legal duties to notify regulators and the people concerned. In India, the DPDP Rules set breach reporting duties, and our DPDP checklist explains the basics. Insurers also expect prompt notice, so check your policy now, not during an incident.

Keep it going

Ransomware defence is a habit, not a purchase. Work through our small business cybersecurity checklist, then see the 2027 trends guide to understand where attackers are heading. If your business relies on suppliers, read about supply chain attacks too.

Warning signs before the lock-out

Many attacks spend days or weeks inside a network before the files are encrypted. Catching the early signs gives you a chance to stop it.

Sign-ins at odd hours, or from countries where you have no staff.
Security software switched off or uninstalled.
New administrator accounts nobody created.
Unusually large amounts of data leaving the network.
Scheduled tasks or remote-access tools nobody recognises.
Staff reporting slow machines, strange pop-ups or files that won't open.

A one-page response plan

Write this when things are calm. Keep a printed copy and one on a personal device, because the network may be unavailable.

Names and numbers: the decision-maker, your IT or security provider, your insurer, a lawyer, your bank and the police or cybercrime reporting line.
What to switch off first, and who is allowed to do it.
Where the backups are, how to reach them and the order in which systems come back.
Who speaks to staff, customers, suppliers and regulators, and the first message each will hear.
Where the evidence log lives, and who keeps it.
The conditions under which you'd involve law enforcement.

Mistakes that make recovery slower

Keeping backups on the same network as the originals, so the attacker encrypts them too.
Restoring systems before removing the attacker, which lets them straight back in.
No list of which systems matter most, so everyone argues about priority during the crisis.
A contact list that exists only on the affected systems.
Paying, or negotiating, without advice from someone who has done it before.

Questions for your insurer and adviser before an incident

What does the policy cover: restoration, lost income, legal costs, extortion payments?
What must we do, and by when, to keep the cover valid?
Which incident-response firms are approved, and how do we call them?
Which security controls does the insurer expect us to have in place?
What are our legal duties to report, and to whom?

Be ready before it happens

Webbit helps businesses close the gaps ransomware uses: unpatched systems, weak access, untested backups and no plan. We start with a scoped review, give you a ranked fix list and help you write the response plan your team will actually follow. Book a free consultation to get started, or read about our cybersecurity services.

Frequently asked questions

What is ransomware in simple terms?

Malicious software that locks your files or systems and demands payment to release them. Many attackers also steal a copy of your data and threaten to publish it.

Can small businesses really be targeted?

Yes. Attackers often choose targets by how easy they are to get into, not by size. Smaller firms tend to have fewer controls and less time to recover.

Will antivirus alone protect us?

No. Antivirus helps, but patching, multi-factor sign-in, tested backups and limited admin rights do more to reduce the damage from a ransomware attack.

How long does recovery take?

It varies widely. Businesses with tested offline backups and a written plan recover far faster. The only reliable way to know your number is to run a restore test.

Home · Blog · Book a Free Consultation