Ransomware is one of the fastest ways for a business to lose time, money, and trust. The good news is most ransomware incidents follow the same path, and the same protections stop them again and again.
This guide is a practical ransomware prevention checklist you can use to reduce risk, improve readiness, and keep your business running, even if someone clicks the wrong link.
How ransomware typically gets in
Most ransomware incidents start with one of these:
-
A stolen password, often from phishing or reused credentials
-
Unpatched devices or servers
-
Unsafe remote access, especially weak VPN or exposed RDP
-
A malicious attachment or link delivered by email
-
A compromised vendor account or shared credentials
Your goal is not perfect security, it is closing the most common doors and building recovery you can trust.
The ransomware prevention checklist
1) Turn on MFA everywhere that matters
If you use Microsoft 365 or cloud apps, MFA is one of the biggest risk reducers.
Prioritise MFA for:
-
Microsoft 365 email and Entra ID accounts
-
Admin accounts and privileged users
-
VPN and remote access
-
Password managers and financial platforms
Tip: Do not stop at “optional MFA”. Enforce it.
2) Patch consistently, with reporting
Attackers move fast after vulnerabilities become public. Patching needs a routine, not reminders.
Include updates for:
-
Windows on laptops and desktops
-
Windows Server and critical services
-
Microsoft 365 apps and browsers
-
VPN appliances, firewalls, remote tools
What good looks like: you can prove patch status with a report, not a guess.
3) Replace antivirus only thinking with EDR
Traditional antivirus often misses modern ransomware behaviors. EDR watches for suspicious actions, not just known signatures.
Look for:
-
Behaviour based detection
-
Isolation of infected devices
-
Alerting with clear next steps
-
24/7 monitoring if possible
4) Lock down email and phishing entry points
Email is still the top entry path for many businesses.
Reduce risk with:
-
Strong spam and malware filtering
-
Safer attachment handling
-
Link scanning
-
SPF, DKIM, and DMARC to reduce spoofing
-
Phishing simulations and training
5) Remove local admin rights for daily work
Ransomware spreads faster when users have too much access.
Best practice:
-
Users should not be local admins by default
-
Use separate admin accounts for IT tasks
-
Apply least privilege across apps and file access
6) Segment networks where it matters
If one device is compromised, segmentation can stop it spreading to everything else.
Examples:
-
Separate guest Wi-Fi from business systems
-
Limit access between departments
-
Protect servers and critical systems behind stricter rules
7) Backups that are truly recoverable
Backups are not protection unless they restore. Many businesses discover too late that backups failed, were incomplete, or were encrypted along with everything else.
Stronger backup practices:
-
Follow a 3 2 1 approach
-
Use immutable backups or offline copies
-
Test restores regularly
-
Document recovery time and responsibilities
8) Monitor for early warning signs
You want to detect strange behaviour before encryption starts.
Red flags to alert on:
-
Unusual sign ins and impossible travel
-
Mass file changes or deletions
-
New admin accounts or privilege changes
-
Suspicious mailbox forwarding rules
-
Multiple failed logins across users
9) Create a simple incident response plan
When ransomware hits, confusion is costly. A short plan beats no plan.
Your plan should include:
-
Who makes decisions
-
Who contacts vendors, bank, insurance
-
How to isolate devices fast
-
Where backups are and how to restore
-
Communication steps for staff and clients
10) Practice your recovery, at least once
Even a basic tabletop exercise helps you spot weak points.
Ask:
-
Can we restore critical data quickly
-
Do we know what to shut down first
-
Can we keep phone, email, and core ops running
The fastest wins if you are starting today
If you need a practical starting point, focus on these first:
-
Enforce MFA for all users, especially email
-
Patch management with reporting
-
EDR on every endpoint
-
Tested backups with an immutable copy
-
Email security plus phishing training
This combination reduces most ransomware risk quickly.
