How can I protect my business from ransomware and phishing?

Stop the phishing that starts most attacks

The majority of ransomware infections begin with a phishing email or stolen credentials. Reducing phishing success is therefore the highest-leverage defence you have.

• Run regular, practical security awareness training and simulated phishing so staff learn to spot and report suspicious messages.
• Deploy email filtering and anti-spoofing (SPF, DKIM, DMARC) to cut down on malicious mail reaching inboxes.
• Require multi-factor authentication everywhere so a phished password alone cannot grant access — prefer phishing-resistant MFA (authenticator apps or hardware security keys) over SMS.

Make ransomware survivable with backups

If an attacker does get in, good backups are the difference between a bad day and an existential crisis. Follow a 3-2-1 strategy and ensure at least one copy is offline or immutable, so ransomware cannot reach and encrypt it.

Critically, test your restores regularly. A backup you have never restored from is a hope, not a plan.

Limit how far an attack can spread

• Patch operating systems and software promptly — many ransomware campaigns exploit known, already-patched vulnerabilities.
• Apply least privilege and remove standing admin rights so a compromised account cannot reach everything.
• Segment your network so an infection in one area cannot move freely across the whole organization.
• Deploy endpoint detection and response (EDR) to catch and isolate malicious activity early.

Be ready to respond

Have an incident response plan that specifically covers ransomware: how you isolate systems, who you call, how you communicate, and your notification obligations. Practising it once a year means your team acts decisively under pressure instead of improvising.