Ransomware prevention gets most of the attention, and it should. But prevention is never perfect, and the businesses that survive an attack well are not the ones that were never targeted — they are the ones that limited how far the attack could spread and how long recovery took.
This is about damage limitation: the decisions made months in advance that determine whether an incident costs you a day or costs you the business.
Backups are the whole ballgame — if they survive
Modern ransomware groups target backups first. They know that a business with working backups does not pay, so they spend their dwell time locating and destroying backup repositories before triggering encryption. A backup that your domain administrator account can delete is a backup the attacker can delete.
What actually holds up: immutable backups that cannot be modified or deleted for a defined retention window, even with valid credentials. Offline or logically air-gapped copies. Backup systems using credentials entirely separate from your production directory. And multiple restore points going back far enough to predate the intrusion, since attackers often sit in a network for weeks.
Then test the restore. Not the backup job status — the actual restore, of a real system, timed. Many businesses discover during an incident that their backups were running fine and restoring at a rate that would take eleven days.
Segment the network so one machine is not all machines
Ransomware spreads laterally. A flat network where every device can reach every other device means one infected workstation becomes an infected building.
Separate your networks: workstations, servers, guest Wi-Fi, payment terminals, and IoT devices such as cameras and smart thermostats should not all share one broadcast domain. Restrict which machines can reach the server over administrative protocols. Turn off SMBv1 everywhere. These are configuration changes, not purchases.
Limit what a compromised account can do
Most ransomware detonates with the privileges of whatever account it landed on. If your staff run as local administrators, it has administrative rights immediately.
Remove local admin rights from daily-use accounts. Give administrators a separate privileged account used only for administrative work, never for email or browsing. Enforce MFA on every administrative account without exception. And audit the permissions on your shared drives — most businesses find that everyone can write to everything, which means the encryption reaches everything.
Detect it early enough to matter
The window between initial compromise and encryption is where the incident is either contained or lost. Endpoint detection and response tools watch for the behaviors that precede detonation — mass file modification, shadow copy deletion, credential dumping — and can isolate a machine from the network automatically.
Detection is only useful if someone acts on it. An alert that fires at two in the morning into an unmonitored inbox has done nothing. This is the argument for monitored detection rather than installed detection.
Write the response plan before you need it
During an incident, nobody thinks clearly. The plan needs to exist on paper — and on paper specifically, because your systems may be encrypted.
It should answer: who is called first, and at what number. Who has authority to disconnect systems from the network. Where the insurance policy number and the insurer’s incident hotline are. Which legal counsel handles breach notification. What you tell customers and staff, and who says it. What the manual workarounds are for your critical processes.
Call the insurer early. Most policies require notification within a specific window and require you to use their approved forensic vendors — calling your own consultant first can jeopardize the claim.
The first hour
If it happens: isolate affected machines from the network but do not power them off, since memory contains evidence and sometimes encryption keys. Do not delete anything. Preserve logs. Then work the plan.
On paying the ransom — that is a business and legal decision, not a technical one, and it should be made with counsel and your insurer. What is worth knowing in advance is that decryption tools supplied by attackers are frequently slow and incomplete, and payment does not prevent the data that was exfiltrated before encryption from being published.
The honest summary
Everything that limits ransomware damage has to be in place before the attack. There is no action available during the incident that substitutes for immutable backups, a segmented network, and constrained privileges.
If you are not certain your backups would survive an attacker with your administrator password, that is the conversation to have this week. It is the one question that most reliably separates a bad week from a closed business.