Small businesses can suffer ransomware too: an attack blocks or encrypts files and may involve data theft and ransom demands. Protection needs to account for the systems the company uses, their access and how work can be recovered.
According to the most recent Data Breach Investigations Report (DBIR) from Verizon, ransomware showed up in 88% of breaches suffered by small and mid-size businesses — versus 39% among larger organizations. Sophos reports separate samples for 2024: ransomware was 70% of its Incident Response cases for small businesses and over 90% for midsized organizations with 500 to 5,000 employees. These are cases handled by that service, not the proportion of all businesses attacked.
For whoever signs off on the IT budget at a small company, that number changes the question worth asking. It's no longer "could this happen to us?" — it's "where would it get in, if it happened tomorrow?"
Why the small door gets found
Criminals may combine automated scanning, stolen credentials and human actions to reach a company. The Sophos report also describes Teams calls impersonating support staff. Protection therefore involves technical controls and a way to confirm who is requesting access.
In Sophos's research covering small and mid-size businesses, about a quarter of confirmed initial compromises tracked through telemetry started with an exposed network device — the kind of access point teams use to reach the company network from outside. Known, unpatched security flaws showed up in 14.53% of the intrusion cases the team investigated. Neither entry point requires a skilled attacker; both only require an outdated system nobody remembered to close, and that's exactly what tends to pile up at a company with no one dedicated to watching it every day.
In a separate sample, data theft and ransomware attempts made up nearly 30% of incidents tracked by Sophos Managed Detection and Response. That set covers different kinds of detected malicious activity and should not be directly compared with Incident Response cases.
In Brazil, the national picture doesn't look better. Kaspersky recorded 105 organizations hit by ransomware in 2024, up 69% from 62 the year before — the study doesn't break the figure down by company size, but it shows the country is still squarely on attackers' radar. Healthcare, financial services and retail accounted for most of the cases.
Sophos groups organizations with up to 500 employees as small businesses. These samples show the presence of ransomware in the cases analyzed; they cannot estimate a company’s chance of being attacked or directly compare businesses of different sizes.
Why the usual approach doesn't work
The usual approach at a small company is reactive: call someone only when something breaks, trust a backup copy that's never been tested, leave the subject to whoever "knows more about computers" on the team — with no dedicated time, no formal responsibility, and no defined routine for handling it every day.
The trouble is that an automated attack doesn't announce itself first. It doesn't send a test run. The first sign is usually the ransom message on the screen, on a Monday morning, with the files already scrambled. By then, the question "who's in charge of this at our company?" should have had an answer months earlier.
Buying a protection tool also requires deciding who configures it, follows its updates and handles alerts. Without that work, the company may get less from the available features and leave warnings uninvestigated.
CERT.br, Brazil's national center that gathers and handles security incident reports, published a guide on this exact topic in 2025 precisely because the pattern keeps repeating. Most of its recommendations don't call for buying anything new — they call for routine: fixing a known flaw, limiting who can access what, and keeping a copy isolated from the main network. It's a guide written for whoever doesn't have a dedicated security team, not for a large company with one.
What has to be in place
Closing that door doesn't depend on a single product. It depends on a small set of routines, kept up by someone responsible for them every day — not only once something has already gone wrong.
Every remote-access door exposed to the internet, either closed or protected by a second confirmation step beyond the password. It's the most common entry point in automated attacks: if it isn't open, the program scanning the internet moves on to the next target.
A unique, strong password on every system, never reused between them. A password leaked from some unrelated service can't be the same one that unlocks the company's server.
Updates prioritized by risk. The team assesses severity, compatibility and testing needs, agrees a maintenance window and follows the update through.
A copy of the files kept out of reach of anyone who already got into the network — disconnected from the main network or impossible to alter from outside. Ransomware also targets the connected copy; if it sits alongside everything else, it gets scrambled too.
Someone watching how the network behaves, not just the antivirus on each computer. Ransomware often gives itself away before scrambling everything: unusual traffic, access at odd hours, files being copied in bulk. Catching that in time is the difference between a warning and a crisis.
A written agreement on who decides what on the day of an attack — who disconnects the network, who tells leadership, who calls insurance or legal counsel. Deciding that in the middle of the fire costs time the company doesn't have.
Skills IT assesses access, configures the contracted protection, reviews alerts and manages updates according to risk and agreed maintenance windows. For contracted backup services, we agree on copies, retention and restore tests. The proposal records coverage, responsibilities and service hours; continuous monitoring does not mean human support is available 24 hours a day.
The payoff for the business
Closing these doors isn't a promise of never being attacked — nobody can guarantee that. It's about reducing the odds an attack finds a clear path and, if it does find one, having an intact copy to restart from without having to negotiate with whoever hijacked the data.
There's a cost few businesses account for until they need to: negotiating with whoever hijacked the data isn't fast, isn't cheap, and doesn't guarantee the files come back complete. Having an intact copy changes that whole conversation — the company decides to recover on its own, instead of depending on the attacker's goodwill.
On the financial side, the math is easy to explain to whoever approves the budget: the cost of keeping these routines running is predictable and monthly. The cost of having none of them only shows up after the attack, and it arrives bigger, with no warning and no installments.
The aim is to reduce interruptions and prepare recovery. Systems, data and dependencies need assessment to define the plan; continuous operation throughout every incident cannot be guaranteed.
A starting checklist
Before the next meeting about the IT budget, it's worth bringing these questions ready to go:
- Which of the company's remote-access doors are open to the internet today, and why? If nobody can answer, that's the first gap to close.
- Is there a backup copy kept out of reach of anyone who breaks into the main network? If the answer is "it's all in the same place," the risk is bigger than it looks.
- Who in the company decides what to do in the first minute of an attack? Without that person defined, the decision stalls exactly when speed matters most.
- Are security updates on critical systems current, or "in the queue"? A known, unpatched flaw is the easiest door of all.
- Is anyone watching how the network behaves, or just the antivirus on each computer? That difference separates catching an attack starting from only finding out once it's over.
