Ransomware Protection for UK Businesses: A Practical Guide

The UK Ransomware Reality

Ransomware is not an abstract threat. In 2024, 39% of UK businesses identified a cyber attack, with ransomware accounting for a significant proportion of the most costly incidents. The average UK data breach cost reached £3.4 million in 2024 — and for ransomware incidents, recovery costs including forensics, remediation, downtime and potential regulatory penalties frequently exceed that figure.

UK SMEs are specifically targeted. Ransomware groups operating on a Ransomware-as-a-Service (RaaS) model use affiliates who target businesses of all sizes — not just large enterprises. The misconception that 'we are too small to be worth attacking' is demonstrably false. Small businesses represent attractive targets precisely because they typically have less defensive capability than large organisations.

How Ransomware Reaches Your Business

Ransomware infections follow predictable patterns. The three most common initial access vectors for UK SME ransomware incidents are:

• Phishing emails: Malicious attachments or links that deliver the initial malware payload or steal credentials used for subsequent access
• Exploitation of unpatched internet-facing systems: VPN appliances, Remote Desktop Protocol (RDP), Microsoft Exchange and network edge devices with unpatched critical vulnerabilities
• Compromised credentials: Credentials stolen from phishing or obtained from breach data used to authenticate to VPN, RDP or cloud services

Understanding this narrows the most important prevention investments: patch management for internet-facing systems, email security and MFA on all remote access methods.

The Five Controls That Reduce Ransomware Risk Most

1. Offline and Immutable Backups

If ransomware encrypts your data, the ability to restore from a clean backup determines whether you face ransom payment pressure or straightforward recovery. Backups must be:

• Offline or air-gapped: Ransomware specifically targets backup systems — it deletes shadow copies and attempts to encrypt connected backup drives. Backups stored offline (tape, object storage with object lock, air-gapped replication) cannot be encrypted.
• Tested: A backup that has never been successfully tested is a backup you cannot rely on. Test restoration at least quarterly.
• Separated credentials: Backup systems should use credentials independent of your Active Directory domain — a compromised domain admin account should not automatically provide access to delete backups.
• Covering Microsoft 365: Exchange, SharePoint and OneDrive data requires separate backup — Microsoft's infrastructure resilience does not protect against account-level data deletion or encryption.

2. Endpoint Detection and Response (EDR)

EDR detects ransomware behaviour — mass file encryption, shadow copy deletion, anomalous process activity — and can terminate processes and isolate devices automatically. Modern EDR responds in seconds, potentially containing a ransomware attack before encryption is complete. Consumer antivirus does not have this capability.

3. Email Security

Anti-phishing email filtering (Safe Attachments, Safe Links, AI-based impersonation detection) reduces the volume of malicious content reaching users. DMARC/DKIM/SPF prevents domain spoofing. Encrypted email reduces the risk of interception of sensitive attachments that could be weaponised.

4. MFA on All Accounts and Remote Access

MFA prevents compromised credentials from being used to authenticate to VPN, RDP or cloud services. It is the single highest-impact control against credential-based initial access, blocking over 99.9% of automated credential attacks according to Microsoft's telemetry.

5. Patch Management

Apply critical and high-severity patches within 14 days — the Cyber Essentials requirement and the NCSC's recommended baseline. Prioritise internet-facing systems: VPN appliances, Exchange, web-facing applications and any remote access infrastructure. Automated patch management reduces the operational burden and eliminates the risk of patches being delayed indefinitely.

Ransomware Response: The First 60 Minutes

If ransomware detonates in your environment, the first hour determines the scope of damage. The priority sequence:

1. Isolate immediately: Disconnect affected machines from the network — unplug Ethernet, disable WiFi, kill VPN connections. Stop the spread before investigating.
2. Do not reimage: Preserve forensic evidence — how the attackers got in needs to be understood before rebuilding so you do not restore the same vulnerability.
3. Notify your IT partner or MDR provider: Engage specialist incident response support — AMVIA's MDR clients have a dedicated 24/7 emergency contact for exactly this scenario.
4. Notify your cyber insurer: Most policies require prompt notification — delayed notification can affect coverage.
5. Assess GDPR obligations: If personal data has been encrypted or exfiltrated (common with double extortion), begin the 72-hour ICO notification assessment.
6. Do not pay immediately: Take time to understand the scope before making any payment decision — and involve law enforcement and legal counsel first.

Cyber Essentials as a Ransomware Baseline

The five Cyber Essentials controls — secure configuration, patch management, access control, malware protection and firewalls — address the most common ransomware delivery and propagation mechanisms. Cyber Essentials certification is an appropriate baseline for UK businesses and a condition of many cyber insurance policies and government supply chain requirements.