Ransomware protection for UK SMEs: what actually works in 2026
Ransomware stopped being a "large enterprise problem" a long time ago. The reality on the ground for UK SMEs in 2026 is that most attacks are opportunistic, automated, and target businesses precisely because smaller organisations are assumed to have weaker controls and thinner incident response.
The good news is that most successful ransomware incidents we see in the West Midlands come down to a small number of missing controls. Fix those, and you move from "easy target" to "not worth the attacker's time" very quickly.
Here's the honest breakdown of what actually works, and what's mostly theatre.
How ransomware actually gets in
Nearly every incident we see traces back to one of four entry points:
- A phished credential, typically for Microsoft 365, reused elsewhere and not protected by MFA.
- An exposed remote access service (old RDP, an unpatched VPN appliance, a forgotten firewall rule).
- An unpatched internet-facing application or a vulnerability in a widely used piece of software.
- A malicious attachment or link that ran on a device without proper endpoint protection.
The point of the list is not to be scary. It's that all four of these have well-understood defences that most SMEs can put in place inside a few weeks with the right partner.
The controls that actually reduce ransomware risk
1. MFA on everything, with no exceptions
The single highest-value control. Multi-factor authentication on Microsoft 365, remote access, admin accounts and any SaaS holding customer or financial data. It stops the vast majority of credential-based intrusions before they start.
We enforce MFA as part of the security baseline on every managed IT support tenant we run.
2. Modern endpoint protection, not just "antivirus"
Traditional signature-based antivirus is no match for modern ransomware families. What you want is EDR (endpoint detection and response) that watches process behaviour, isolates infected devices automatically, and gives a real analyst something to investigate.
3. Aggressive patching, especially internet-facing kit
Firewalls, VPN gateways, remote access tools and any server exposed to the internet need to be patched fast. A monthly patch cycle is fine for internal desktops. Anything facing the internet should be patched inside days when a critical vulnerability drops.
4. Backups that ransomware can't touch
If ransomware can reach your backups, they're not backups, they're a second set of victims. What you want is:
- Backups stored off the production network.
- Immutable copies that can't be deleted or overwritten for a set retention window.
- Separate credentials, ideally with MFA, on the backup platform itself.
- Tested restores, on a schedule, with results written down.
Untested backups are the single most common cause of a ransomware incident becoming a business-ending event. We test restores as part of ongoing cloud support for every customer.
5. A dedicated Microsoft 365 backup
Microsoft replicates your data for service availability. It does not back it up in the way most business owners assume. If a mailbox or SharePoint site is encrypted, deleted or ransomed, native retention windows are limited. A separate third-party M365 backup is a small line item that saves entire businesses.
6. Least-privilege admin, and no shared "IT" account
Every incident we investigate finds either a shared admin credential, a service account with domain admin rights, or a user who was quietly given more privilege than they needed for a one-off task in 2019. Ransomware doesn't need to escalate if you've already done the work for it.
7. Email and web filtering
A good email security gateway catches most of the payload delivery attempts before a user ever sees them. Combined with DNS-layer web filtering on endpoints, you cut off both the initial lure and the callback traffic malware relies on.
8. Staff training that isn't a once-a-year video
Phishing simulations, short refreshers and a clear "how to report" process do more than a two-hour annual e-learning module. The metric that matters is how quickly staff report a suspicious email, not whether they pass a quiz.
What Cyber Essentials gets you (and what it doesn't)
Cyber Essentials covers five core control areas that map almost exactly onto the list above. Certifying is a very good way to force a baseline into place and prove it externally, especially for insurance renewals and larger customer contracts.
What Cyber Essentials doesn't do is cover incident response, threat hunting, monitored EDR or 24/7 detection. Those sit on top, not instead.
What to do in the first hour of an incident
Assume it will happen once. The businesses that come through ransomware relatively unscathed do the same first-hour steps:
- Isolate infected devices from the network. Cable out, Wi-Fi off, VPN kill.
- Rotate credentials for any account that touched the affected systems, starting with admins.
- Preserve evidence. Don't wipe machines before someone has looked at them.
- Contact your IT partner and your insurer before doing anything customer-facing.
- Do not pay anything without proper legal, insurance and technical advice. Payment does not guarantee recovery and can create regulatory issues of its own.
If you don't have a written incident response plan, that's the piece to fix this week, not the exotic tooling.
The uncomfortable truth about cyber insurance
Insurers have quietly tightened underwriting a lot. Renewals now routinely ask for evidence of MFA on all admin accounts, EDR on all endpoints, tested backups and patching cadence. Claims are being declined where controls that were ticked on the application weren't actually in place.
Treat cyber insurance as a genuine safety net, not a substitute for the controls above. And be honest on the application form, because the claims process will find out.
Where to start
If you're not sure where you stand today, the practical first step is a short assessment against the controls in this article. That's exactly what a cyber security consultancy engagement looks like at LeapIT: a scoping call, an assessment, and a findings report with a prioritised action list.
If you'd rather just have all of this run for you as part of a wider IT contract, our managed IT support includes the baseline controls as standard, with the optional advisory work sitting alongside it.
Either way, get in touch and we'll help you work out which bit to fix first.
