Ransomware Protection for SMEs: A Practical Guide for 2025

Ransomware Protection for SMEs: A Practical Guide for 2025

Ransomware now features in 44% of all data breaches, a 32% increase in just one year. In the first quarter of 2025, fourteen Dutch organisations were publicly named on ransomware gangs' leak sites. The real numbers are far higher, because many victims are never published. For small and mid-sized businesses, ransomware is no longer something that happens to other people; it is a real threat that can hit any business.

In this guide we walk through everything you need to know about ransomware protection: from prevention to detection, and from response to recovery.

Key takeaways (TL;DR)

• 44% of data breaches now involve ransomware - a 32% increase in one year
• 73% start with phishing or stolen credentials - train your staff
• 5 pillars of protection: Prevention, Detection, Response, Recovery and Continuous improvement
• Never pay the ransom - it funds criminals and there is no guarantee you will get your data decrypted
• 3-2-1 backup rule: 3 copies, 2 media types, 1 offsite/offline
• Average recovery cost: €1.85 million - prevention is many times cheaper

What exactly is ransomware?

Ransomware is malware that encrypts your files or systems and demands a ransom for the decryption key. Modern variants go further: they steal your data first and threaten to publish it if you don't pay. This is known as "double extortion".

How ransomware has evolved

Today's ransomware bears no comparison to the crude variants of ten years ago:

The attackers have professionalised. They operate like businesses, complete with HR departments, help desks for victims and even customer satisfaction surveys. The ransomware group d0p was the most active in the Netherlands in Q1 2025 and is known for fast attacks and aggressive extortion tactics.

How does ransomware get in?

To protect yourself, you need to understand how attackers get in. The most common attack vectors:

1. Phishing emails (most common)

Around 73% of successful attacks start with phishing or stolen credentials. An employee clicks a link or opens an attachment, and the malware is in. Microsoft is the most abused brand in phishing campaigns, accounting for 36% of all attempts.

2. Software vulnerabilities

Unpatched systems are an open door. Exploit kits automatically scan the internet for known vulnerabilities. An outdated VPN appliance or web server can be the starting point for a major attack.

3. Remote Desktop Protocol (RDP)

Exposed RDP ports are an attacker favourite. They use automated tools to try logging in with stolen or cracked credentials.

4. Supply chain attacks

Attackers increasingly get in through a supplier. A compromised software update or a hacked IT service provider can be the gateway to dozens of organisations at once.

5. Insider threats

Sometimes the threat is internal: a disgruntled employee, or someone who unknowingly installs malware.

The five pillars of ransomware protection

Effective protection rests on five pillars. Each one is essential; a weakness in one pillar undermines the whole.

Pillar 1: Prevention

The best incident is the one that never happens. Preventive measures shrink your attack surface.

Email security

Invest in advanced email filtering that catches phishing attempts before they reach the inbox. Microsoft 365 with Defender offers strong capabilities here. Train staff to recognise and report suspicious emails.

Patch management

Make sure every system is up to date. That covers operating systems, applications and the firmware of network equipment. Automate wherever possible and have a process for critical patches that must be applied immediately.

Access management

Apply the principle of least privilege: give employees only the rights they actually need. Use multi-factor authentication wherever possible, especially for admin access and remote access.

Network segmentation

Divide your network into segments so an attacker who gets in can't immediately reach everything. Separate critical systems from general workstations. A well-designed network limits the damage when an incident occurs.

Endpoint protection

Modern endpoint protection (EDR) goes beyond traditional antivirus. It detects suspicious behaviour, can isolate endpoints and gives security teams visibility into what is happening.

Pillar 2: Detection

Prevention is never watertight. You also need detection capabilities to spot attacks before the ransomware is deployed.

24/7 monitoring

Attackers often strike outside office hours. Continuous monitoring by a Security Operations Center ensures suspicious activity is picked up immediately.

Log analysis

Collect logs from all your systems and analyse them for anomalies. A SIEM (Security Information and Event Management) correlates events from different sources and detects patterns that point to an attack.

Threat intelligence

Keep track of current threats. Are there new ransomware variants? What techniques are attackers using? A good MSSP shares this intelligence with you.

Pillar 3: Response

What do you do when you detect an attack or, worse, when the ransomware has already been deployed? A fast, coordinated response limits the damage.

Incident response plan

Have a plan ready. Who does what? Who decides on containment measures? Who handles external communication? Rehearse the plan regularly with tabletop exercises.

Containment

When you detect an active attack, speed is critical. Isolate infected systems from the network. Block suspicious accounts. Stop the attacker from spreading further.

Forensic investigation

Understand how the attacker got in and what they did. This is essential for full recovery and for preventing them from getting back in.

Pillar 4: Recovery

Once the attack is contained, recovery begins. This is where good backups make all the difference.

The 3-2-1 rule

Keep at least three copies of your data, on two different media, with one stored offsite. Modern variants add another "1": one copy that is immutable (unchangeable) and therefore can't be encrypted by ransomware.

Offline backups

Backups connected to the network can be encrypted too. Make sure at least one backup is offline or air-gapped.

Restore tests

A backup you can't restore isn't a backup. Test regularly that you can actually recover. Measure how long recovery takes (RTO) and the maximum amount of data you could lose (RPO).

Recovery priorities

Not everything needs to be restored at once. Decide in advance which systems are critical and must come back first.

Pillar 5: Improvement

Every incident, near misses included, should be followed by an evaluation. What went well? What could be better? Make the improvements and update your plans.

The human factor: security awareness

Technology alone isn't enough. Employees are often the first line of defence and the weakest link. Invest in security awareness:

• Phishing simulations: Regularly test whether staff can recognise phishing
• Training: Short, frequent training works better than long annual sessions
• Reporting culture: Make it easy and safe to report suspicious activity
• Management commitment: When leadership takes security seriously, the rest follows

To pay or not to pay?

If you are hit, the question comes up: do we pay the ransom? The short answer: preferably not.

Reasons not to pay

• No guarantee: Paying doesn't guarantee you will get your data back, or that it won't be published anyway
• Funding crime: Your money funds the next attack
• A target for repeat attacks: Organisations that pay are seen as an "easy target" and are attacked again more often
• Legal risks: In some cases, paying sanctioned groups is illegal

The reality

64% of victim organisations no longer pay the ransom, up from 50% two years ago. This points to a cultural shift towards resilience and a refusal to give in to extortion.

Good preparation, above all reliable backups, makes paying unnecessary. Better to invest in protection up front than in a ransom afterwards.

The role of insurance

Cyber insurance can cover part of the damage, but it is no substitute for good security. Bear in mind:

• Insurers are setting ever stricter requirements for your security
• Premiums rise as claims increase
• Not all damage is covered (reputational damage, long-term effects)
• Some policies exclude ransom payments

Insurance is a last resort, not a first line of defence.

A practical action plan for SMEs

Here is a concrete action plan to improve your ransomware resilience:

Weeks 1-2: Take stock

• Map your critical systems and data
• Review your current backup situation
• Check that MFA is enabled everywhere
• Run a security quick scan

Weeks 3-4: Quick wins

• Enable MFA wherever it isn't yet active
• Implement or improve email filtering
• Review and harden admin accounts
• Make sure patches are up to date

Month 2: Improve backups

• Implement the 3-2-1-1 rule
• Configure immutable backups
• Test a full restore
• Document your recovery procedures

Month 3: Detection and response

• Evaluate your detection capabilities
• Consider Managed Detection & Response
• Draw up an incident response plan
• Run a tabletop exercise

Ongoing: People and culture

• Start security awareness training
• Run periodic phishing simulations
• Share security news with staff
• Keep evaluating and improving

The business case for ransomware protection

Some business owners see security as a cost centre. The reality is different:

Compare that with the cost of good security. Managed security for an SME typically costs €1,000-5,000 a month. The ROI of security lies in preventing losses that are many times the size of the investment.

When should you bring in help?

Not every business has the in-house expertise to organise ransomware protection itself. Consider outside help if:

• You don't have a dedicated IT security person
• You can't guarantee 24/7 monitoring
• You aren't sure your backups are reliable
• You need to comply with NIS2 or other regulations
• You have been hit before and want to prevent it happening again

An IT partner with security expertise can help you raise your resilience without you having to figure everything out yourself.

Conclusion: prevention is better than cure

Ransomware has become a business, and your company is a potential target. The question isn't whether you will be attacked, but when. And whether you will be ready.

The core of protection isn't complicated:

• Make it hard for attackers to get in (prevention)
• Notice when they do get in (detection)
• Respond quickly and effectively (response)
• Recover without paying a ransom (backups)
• Learn from every incident (improvement)

Start today. Every measure you take reduces your risk. And if you are hit anyway, preparation makes the difference between an unpleasant incident and a business-ending crisis.

Want to know where you stand? Request a free security scan or call +31 85 303 5869 for a no-obligation conversation about ransomware protection for your organisation.

Frequently asked questions about ransomware

How do I know if I've been hit by ransomware?

Typical signs: files that no longer open, strange file extensions, a ransom note on your screen and unusual system activity. With modern attacks there may also be a threat to publish your data.

Should I report a ransomware attack?

Yes, always report it to the police. In addition, if there is a data breach you are legally required to notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and possibly the people affected.

How long does it take to recover from a ransomware attack?

Anything from days to weeks, depending on the scale, how well prepared you are and the state of your backups. Well-prepared organisations recover significantly faster.

Is ransomware protection expensive?

Effective protection costs money, but it is a fraction of the potential damage. Start with basic hygiene (patching, MFA, backups): it costs little and delivers a lot.

Can I prevent ransomware completely?

There is no such thing as a 100% guarantee. But you can drastically reduce the likelihood and limit the impact if it does happen. That is what this whole guide is about.