Ransomware: your backups are the whole game
For a small business, surviving ransomware comes down to one thing — backups an attacker can't reach and that you've actually tested. Everything else is damage control.
Ransomware is the threat most likely to put a small business out of business. Attackers get in, spread quietly, encrypt your files, and demand payment to unlock them — and increasingly they steal a copy first, so even if you recover, they threaten to leak your data. Small firms are favored targets precisely because the defenses are thin and the downtime is unaffordable.
There's good news in that, though: the single thing that decides whether ransomware is a bad week or a business-ending event is almost always the same — your backups.
Why backups are the whole game
If you can restore your systems and data from a clean copy, you don't have to pay, you don't have to negotiate, and your downtime is measured in hours or days instead of weeks. If you can't, you're at the attacker's mercy. That's why the modern ransomware playbook deliberately hunts for and destroys backups before triggering the encryption — they know the backup is what saves you.
A backup you've never restored isn't a backup — it's a hope. The first time you test it shouldn't be during the worst week of your business's life.
What "good" backups actually look like
Offline or immutable
At least one copy must be unreachable from your everyday network — offline, or "immutable" so it can't be altered or deleted even with admin credentials. If ransomware can reach your backup, it will encrypt it too.
Separately credentialed and encrypted
Backups should use different credentials than your main systems, so a single compromised admin account can't wipe them. And they should be encrypted, so a stolen backup isn't a second breach.
Covering everything that matters — including cloud
Many businesses assume Microsoft 365 or Google Workspace is "backed up." It isn't, not the way you need. Email, files, and SaaS data need their own backup, alongside servers and endpoints.
Tested on a schedule
Run a real restore at least quarterly and document it. Testing is the only way to know your backups are complete, current, and actually recoverable — before you're betting the company on them.
The rest of the defense
Backups are the safety net, but a few controls dramatically cut the odds of ever needing it: phishing-resistant MFA on email and remote access (most ransomware starts with a stolen password), prompt patching of internet-facing systems, least-privilege access so one compromised account can't reach everything, and a written incident-response plan so the first hour isn't improvised.
Assume you will be hit, and engineer for recovery. Offline or immutable backups, separately credentialed, covering cloud as well as servers, and a restore you've actually tested — that's the difference between a costly inconvenience and a closed business.
Find out if your backups would actually save you
Securidigm assesses your backup and recovery posture against NIST CSF 2.0, then hands your IT team or MSP a concrete plan to close the gaps.
Request a confidential conversation →Securidigm provides advisory cybersecurity services and prepares draft documents. It does not provide an audit, a certification, or legal advice. This article is general information, not advice for your situation, and no outcome is guaranteed.