How to protect your business from ransomware
Every item on this list but the sixth works without buying anything from anyone. The sixth is where software earns its keep.
By Jean Luc Poitier, SEO and growth marketing strategist · CrowdStrike Reviews · Updated August 7, 2026
Affiliate disclosure: we earn a commission if you sign up for CrowdStrike through links on this page, at no extra cost to you. Competitor facts come from their own published pages and are date-stamped; the commission does not change the numbers. How we review →
The 7-step ransomware defense, in priority order
1. Back up on the 3-2-1 rule, and test the restore
Three copies of important data, on two different media, one offline or immutable (attackers hunt and encrypt online backups first). You don’t know a backup works until you have restored from it: test-restore one system quarterly and time it.
2. Turn on MFA everywhere that matters
Email, VPN, remote desktop, admin accounts, and your backup console. Most ransomware intrusions open with stolen credentials, and remote access without MFA is the single most common way in.
3. Patch the internet-facing things within days, not months
VPN appliances, firewalls, remote-access servers, and anything with a public IP get exploited within days of a vulnerability disclosure. Enable automatic OS updates on endpoints; put a calendar owner on firmware and appliance patches.
4. Kill what you don’t use
Disable exposed RDP or put it behind the VPN. Remove local admin rights from daily-driver accounts. Delete stale accounts of departed employees the day they leave. Every service you turn off is attack surface nobody has to defend.
5. Filter email and train the reflex
Most intrusions still start with a message. Modern email filtering plus a workforce that reports suspicious mail beats an annual training video; make reporting one click and praise the people who use it, even on false alarms.
6. Run modern endpoint protection on every device
Signature antivirus cannot see never-before-seen ransomware or fileless techniques; behavior-based next-gen antivirus and EDR can. Cover servers and laptops alike, including the forgotten machine in the corner, because attackers specifically look for the unprotected one.
7. Write the one-page incident plan before you need it
Who isolates machines, who calls the insurer, who talks to customers, where the contact list lives when email is down. Print it.
Where a product like CrowdStrike fits
Steps 1 through 5 and 7 are process and configuration: they cost time, not licenses, and no security product substitutes for them. Step 6 is the one you buy. A platform like CrowdStrike Falcon compresses steps 6 and part of 7 into one agent, with behavior-based ransomware prevention that scored 100% in SE Labs' independent testing, a process-tree view that makes the “what happened” question answerable, and, at higher tiers, an around-the-clock human team so after-hours attacks (three-quarters of them, by the research CrowdStrike cites) do not wait for Monday. Falcon Go starts at $59.99 per device per year with a 15-day card-free trial; alternatives worth comparing are in our ranked roundup. Whatever you pick, pick something modern: the checklist above assumes step 6 is not a 2009-era antivirus.
Ransomware protection FAQ
Can a small business really be a ransomware target?+
Yes, and disproportionately so. CrowdStrike’s own small-business research cites 73% of small and mid-sized businesses experiencing a breach or cyberattack in 2023, and most ransomware attacks land outside business hours when nobody is watching. Attackers automate targeting, so being small does not keep a business off their lists.
Is backup alone enough protection against ransomware?+
No. Backups get you your files back; they do not stop data theft, and modern ransomware crews steal data before encrypting so they can extort you even if you restore. Backups are the minimum; prevention (patching, MFA, modern endpoint protection) and detection are what stop the extortion.
Do I need EDR or is antivirus enough?+
Antivirus stops known malware; EDR watches behavior so it can catch the hands-on-keyboard stage of a ransomware intrusion, the lateral movement and credential abuse that precede encryption. Small businesses without a security team get most of the benefit from next-gen antivirus plus a managed or easy-to-run EDR tier; products like Falcon Go and Falcon Enterprise are priced for that gap.
What should I do first if I find ransomware?+
Isolate affected machines from the network immediately (pull the cable or disable Wi-Fi; do not power off, memory holds evidence), preserve one encrypted machine for forensics, activate your incident plan, and call your insurer and an incident-response firm before negotiating anything. Reporting to law enforcement (IC3/CISA in the US) is strongly encouraged.
Can CrowdStrike stop ransomware?+
It covers step 6 of this checklist. Falcon’s behavior-based ransomware prevention scored 100% in SE Labs’ independent testing, and Falcon Enterprise adds a 24/7 human threat hunting team that looks at what the sensor flags. No product covers the other six steps for you. Tested offline backups, MFA, fast patching, shutting off what you don’t use, email filtering, and an incident plan still decide how bad an attack gets.