Ransomware isn’t a jump scare. It’s a slow build.
Most ransomware incidents don’t start with files suddenly locking.
They start quietly, often days or weeks earlier, with something ordinary. A login that shouldn’t have worked.
That’s why a sensible ransomware defence plan goes well beyond anti-virus. The real aim is stopping unauthorised access from gaining a foothold in the first place.
Below is a practical five-step approach that small organisations can adopt without turning everyday work into a security obstacle course.
Why Ransomware is harder to stop once it starts
Ransomware is rarely a single moment. It’s a sequence.
Attackers gain access, raise their privileges, explore the network, locate valuable systems and data and only then trigger encryption once they’re confident the damage will be severe.
Late-stage defences struggle here. Once someone has valid credentials and elevated permissions, they can move quickly.
Microsoft summarised the trend neatly: attackers are no longer breaking in – they’re logging in.
By the time encryption begins, the options narrow considerably. Guidance from law enforcement and cyber security agencies is consistent: paying the ransom offers no guarantee of recovery and can encourage further attacks.
There’s no single control that prevents ransomware. What works is breaking the attack chain early.
And if the worst does happen, recovery needs to be planned well before the incident begins.
The 5-step ransomware defence plan
This approach focuses on stopping attackers early, limiting damage if access is gained and making recovery predictable.
Each step is practical and repeatable for small organisations.
Step 1: Phishing-resistant sign-ins
A large proportion of ransomware attacks begin with stolen credentials.
The quickest win is making it far harder for criminals to reuse those credentials.
Phishing-resistant authentication means sign-ins that can’t easily be captured through fake login pages or intercepted codes. It’s the difference between simply enabling MFA and using authentication that still stands up when someone is targeted.
Start with:
• Enforce strong MFA across all accounts, prioritising administrators and remote access
• Remove legacy authentication protocols that weaken the baseline
• Use conditional access policies to require extra verification for risky sign-ins, new devices, or unusual locations
Identity monitoring also helps here. Huntress ITDR (Identity Threat Detection and Response) watches for suspicious Microsoft 365 and identity-based activity, such as impossible travel, unusual sign-ins, or privilege abuse, allowing rapid response before attackers expand their access.
Step 2: Least privilege and separation
If an attacker compromises a standard user account, the damage should stop there.
Least privilege means every account has only the access required to perform its role and nothing more.
Separation means administrative privileges are kept away from everyday activity. One compromised inbox shouldn’t provide control of the entire organisation.
NIST guidance recommends regularly verifying that each account has only the permissions required for its function.
Practical improvements include:
• Separate administrative and standard user accounts
• Remove shared credentials wherever possible
• Limit administrative tools to specific people and trusted devices
Identity monitoring tools such as Huntress ITDR can also alert when accounts suddenly gain privileges or behave in ways that don’t match their usual role.
Step 3: Close known holes
Many ransomware attacks exploit vulnerabilities that already have patches available.
Unpatched systems, exposed services and outdated software provide easy entry points.
This step focuses on removing those obvious opportunities.
Make patching measurable:
• Define clear patch timelines – critical vulnerabilities immediately, high-risk issues next, everything else on a structured schedule
• Prioritise internet-facing services and remote access infrastructure
• Include third-party applications, not just the operating system
Tools such as Heimdal Patch & Asset Management help automate patching across operating systems and third-party software while maintaining a clear inventory of what’s actually running in the environment.
Attackers can’t exploit a vulnerability that no longer exists.
Step 4: Early detection
Even strong preventative controls can’t stop everything.
Early detection focuses on spotting suspicious activity before encryption spreads.
Think unusual behaviour alerts – not the help desk discovering files suddenly won’t open.
A modern baseline typically includes:
• Endpoint monitoring capable of detecting suspicious behaviour
• Rapid investigation of alerts rather than delayed review
• The ability to isolate compromised systems quickly
Huntress Managed EDR is designed specifically for this stage. It monitors endpoints continuously, identifies attacker techniques such as persistence mechanisms or lateral movement and provides 24/7 human-led response when something suspicious appears.
Stopping the intrusion early is often what prevents ransomware from ever launching.
Step 5: Secure, tested backups
Backups remain the safety net.
But they only help if attackers can’t reach them and if restoration actually works.
Both the UK NCSC and NIST stress that backups must be protected from the primary environment and tested regularly. NIST guidance specifically highlights the need to isolate backup copies.
Practical backup discipline includes:
• Keeping at least one backup copy isolated from the main network
• Running restoration tests on a scheduled basis
• Defining recovery priorities in advance – which systems come back first
Additional protection such as Heimdal Ransomware Encryption Protection can also help detect and stop unauthorised encryption activity on endpoints before files are lost.
Stay out of crisis mode
Ransomware succeeds when organisations are forced to react in the dark – when everything becomes urgent and decisions are made under pressure.
A solid defence plan removes that chaos. It replaces guesswork with clear defaults.
You don’t need to rebuild your entire security programme overnight. Start by strengthening the weakest area in your environment and make it consistent across the business.
When identity security, patching, monitoring and backups are all working together, ransomware stops being a headline-level crisis and becomes a contained incident you’re prepared to manage.
If you’d like help reviewing your current defences or building a practical ransomware protection plan, Black Swan Cyber Security Solutions can help. We work with small organisations, schools and local businesses to identify real exposure points and turn them into controlled, measurable safeguards.
