Cybersecurity · Ransomware
How ransomware actually gets into small businesses in 2026, and the specific controls that block each route, in the order to put them in place.
How attackers really get in
Six controls, in priority order
Backups ransomware cannot delete
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
To protect against ransomware, block the ways it gets in and make sure you can recover without paying. For a small business that means six controls: multi-factor authentication (MFA) on every account, fast patching of internet-facing systems, endpoint detection and response (EDR) on every device, backups that cannot be altered or deleted, limited admin rights and locked-down remote access.
These match the FBI’s own ransomware recommendations in its 2025 Internet Crime Report and CISA’s #StopRansomware Guide. Antivirus alone, a firewall alone or staff training alone will not do it. The sections below explain why each control matters and what good looks like.
Knowing the entry points tells you where to spend. The 2026 Verizon Data Breach Investigations Report, as summarized by the Cyber Readiness Institute, found that small organizations make up 96 percent of ransomware victims, and that many attacks were opportunistic: victims had compromised credentials (38 percent) or unpatched vulnerabilities in edge devices such as firewalls and VPNs (29 percent).
Sophos’s State of Ransomware 2026 survey tells a similar story from the victim side: malicious email (26 percent), phishing (24 percent), compromised credentials (23 percent) and exploited vulnerabilities (18 percent) were the most common root causes. In plain terms, attackers log in with stolen passwords or walk through an unpatched door.
Stolen passwords are the most common way in, and MFA makes a stolen password far less useful.
Exploited vulnerabilities overtook stolen credentials as the top initial access route in the 2026 Verizon report, according to the same summary. The FBI calls timely patching one of the most efficient and cost-effective steps an organization can take.
Traditional antivirus looks for known bad files. Ransomware crews often use legitimate admin tools and new variants, so you need software that watches behavior. The FBI notes that EDR tools are particularly useful for detecting the lateral movement that comes before encryption.
Not sure which of these six you have in place? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report on your cybersecurity and business continuity, including backups, with each area rated and a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Attackers go after backups first, because a business that can restore does not pay. The FBI recommends off-site or offline backups that are encrypted and immutable, meaning they cannot be altered or deleted, covering all of your data. Sophos found that 66 percent of organizations whose data was encrypted recovered it from backups in 2026.
Our backup and disaster recovery guide covers retention and testing in more detail.
Ransomware needs admin access to spread and to disable defenses. Take that away and attacks stall.
You do not need to do everything at once. This order front-loads the controls that close the most common entry points.
Enforce MFA everywhere, remove stale accounts, check firewall and VPN firmware, and confirm at least one backup copy is offline or immutable.
Deploy EDR with tamper protection on every device, remove local admin rights, close exposed remote desktop and uninstall unused remote tools.
Run a full test restore and time it, write a one-page response plan, segment guest and device networks, and schedule monthly patch and alert reviews.
After 90 days, the job becomes upkeep: patches every month, access reviews every quarter, and a restore test you actually run. Most small businesses that get hit had one of these controls on paper but not in practice, such as an MFA exception or a backup that shared credentials with the main network.
JLB USA’s cybersecurity services put these controls in place for businesses with roughly 25 to 100 employees, including monitored backups with tested restores and a written recovery plan.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
There is no single fix. The combination that stops most attacks is MFA on every account, fast patching, EDR on every device, immutable or offline backups, limited admin rights and locked-down remote access.
Only partly. Traditional antivirus catches known malware but often misses attacks that use stolen logins and legitimate admin tools. EDR watches behavior and can isolate a machine, which is why insurers increasingly expect it.
Not automatically. Synced folders can replicate encrypted files to the cloud. Use a separate backup of Microsoft 365 or Google Workspace data with its own retention and credentials.
Test a restore at least quarterly, and run a full recovery test at least once a year so you know how long getting back to work really takes.
