Why small businesses are in the frame
Ransomware crews are not choosing victims by name. They scan for exposed systems, buy stolen passwords and send phishing messages at scale, then see who bites. A company with fewer than a hundred employees can be just as attractive as a large one because it often has valuable data, real urgency to get back to work and fewer defenses. The business impact can include halted operations, locked customer records, stolen data and a long recovery.
How attacks typically begin
The details evolve, but common entry points have stayed consistent: phishing emails that capture a login or deliver malware, stolen or reused passwords on accounts without multi-factor authentication, remote access services such as VPNs and remote desktop exposed to the internet, unpatched edge devices and software, and a trusted vendor or contractor whose own account was compromised. After getting in, attackers often spend time exploring, disabling security tools and deleting backups before they ever lock a file. That window is where good monitoring earns its keep.
A layered defense that fits a small budget
No single product stops ransomware. The goal is to make each stage harder and more visible. Layers we focus on include:
- Strong sign-in. Multi-factor authentication on email, remote access and administrator accounts, with fewer people holding administrator rights.
- Email filtering and training. Stop what can be stopped, and teach people to report the rest. See our phishing training.
- Endpoint detection and response. Behavior-based protection that can isolate a suspicious device quickly.
- Prompt patching. Especially for firewalls, VPN appliances and servers that face the internet.
- Network separation. Limit how far an intruder can move from one compromised computer.
- Automated 24/7 monitoring. Suspicious activity at 2 a.m. is still suspicious activity, and detection should not wait for morning.
Backups are your last line, so make them count
Attackers know about backups and target them. A resilient approach keeps several copies, on different kinds of storage, with at least one copy that cannot be changed or deleted from your regular network, such as an offline or immutable copy. Protect the backup system with its own credentials and multi-factor authentication. Most importantly, test restores on a schedule, and write down how long it takes to bring back your critical systems, in order. Many owners discover the gap in their backups only when they need them. We would rather you find it in a drill.
Your first hour: a short checklist
A written plan removes guesswork when everyone is stressed. A basic first-hour sequence looks like this:
- Disconnect affected devices from the network, but do not power them off unless advised, since memory can hold evidence.
- Contact the people named in your plan: your security provider, IT, leadership and your cyber insurer's reporting line if you have a policy.
- Preserve evidence, including ransom notes, screenshots and logs, and stop anyone from wiping machines too early.
- Involve legal counsel early, particularly where customer or patient data may be affected, since notification rules may apply.
- Consider reporting to law enforcement, such as the FBI through its Internet Crime Complaint Center.
- Decide on communication to staff, customers and partners, using prepared language.
Whether to pay a ransom is a serious business and legal decision. We do not advise paying and cannot promise that paying restores data. Your counsel, insurer and law enforcement should be involved in that choice.
Where SommerTech fits
Plans can bundle managed detection and response, vulnerability management, email and endpoint security and incident response planning on a flat monthly price. No provider can promise that an attack will never succeed, but layered controls and rehearsed response shrink both the odds and the damage. Insurers care about these same controls; our cyber insurance readiness page explains how. Leaders who want ownership of the whole program can look at a fractional vCISO, and manufacturers and distributors can read how we think about downtime on our Fort Worth page.
We serve businesses across Dallas-Fort Worth, remotely by default and on-site when useful. Start with a free assessment.