Ransomware protection for business

What ransomware protection means for a business

Ransomware is malware that encrypts your files, and often steals a copy of them first, so that criminals can demand payment to unlock the data or to keep it private. For a business the damage is rarely one laptop: attackers usually get in through one device or account, move across the network, switch off security tools, delete recovery points and only then start encrypting servers and shared drives.

That is why ransomware protection is most usefully thought of as a chain of defences, each one designed to catch what the previous one missed:

1. Stop it running: next-generation antivirus with behaviour monitoring and anti-ransomware engines on every laptop, desktop and server.
2. Stop it spreading and tampering: protection for the security tools themselves, lateral movement detection and, for larger estates, a dedicated anti-ransomware layer.
3. Undo the damage on the device: file rollback or key capture so encrypted files can be put back.
4. Recover the business: backups that ransomware cannot reach, and a tested way to restore from them.
5. Keep the defences in place: tools that notice when a security agent has been removed or has stopped, and repair it.
6. Reduce the chances in the first place: staff who recognise phishing, multi-factor authentication and patched systems.

You do not need every layer from a different vendor. Most businesses start with good endpoint protection and reliable backup, then add layers where the risk or the cost of downtime justifies it. Talking it through with us is the quickest way to see which gaps matter for you.

Layer 1: endpoint protection with anti-ransomware built in

The first and most important layer is the endpoint protection agent on every device. Modern business products do far more than match known malware: they watch for the behaviour of ransomware, such as a process rapidly rewriting large numbers of files, and stop it. Several also keep copies of changed files so they can roll back the damage.

Rollback and file restoration depend on the operating system and on local disk space for file copies, so we confirm what applies to your devices at quote. For product detail see our pages on Sophos antivirus, SentinelOne, ThreatDown, Check Point antivirus, CrowdStrike and Acronis antivirus, or compare them all on our vendors page.

Is plain antivirus enough? For a very small business with good backups it can be a reasonable start, but signature-only antivirus is the layer attackers plan around. Look for behaviour-based protection and rollback at minimum. Where you also want someone to investigate what got in, EDR and MDR come next; our EPP vs EDR page explains the difference and endpointsecurity.uk covers EDR, XDR and MDR guidance in depth.

Layer 2: a dedicated anti-ransomware agent

Attackers know which endpoint products are popular, and a common step before encryption is to disable or blind them, for example by loading a legitimate but vulnerable driver to switch security software off. A dedicated anti-ransomware agent is built to run beside your existing protection and to concentrate on that one threat.

The product we supply for this layer is the Halcyon Anti-Ransomware Platform. Halcyon describes it as a supplement to your EDR rather than a replacement, and its main defences are:

• Before execution: engines built to detect and block ransomware files, applications and processes.
• Against tampering: Kernel Guard blocks the abuse of trusted but vulnerable drivers, and Tamper Guard and EDR Last Gasp detect attempts to disable security products.
• Against spread: detection of living-off-the-land attacks through tools such as PowerShell and WMIC, and of lateral movement.
• Protecting recovery: Windows volume shadow copies (VSS) are protected from being corrupted.
• If encryption starts: Halcyon captures the encryption keys and data the attackers use, to support recovery.

Halcyon's own Ransomware Operations Center is included with the platform. The two editions, Halcyon Pro Platform and Halcyon Pro Platform Plus DXP, are compared on our Halcyon editions page, and you can read a wider overview of Halcyon anti-ransomware on our Cloud Security site.

A dedicated layer is most worth considering when downtime would be very costly, when you hold data an extortionist would value, or when you want a second line of defence that does not depend on your main endpoint product staying switched on.

Layer 3: backup and recovery

Every ransomware plan ends with the question: if everything else fails, can we get our data and systems back without paying? The NCSC's guidance on mitigating malware and ransomware attacks starts with backups: make them regularly, keep at least one copy offline or otherwise separated from your network, keep several copies in different places, and test that you can restore from them. Attackers look for backups and delete them, so a backup that is permanently connected with the same administrator account as everything else is not much of a safety net.

Endpoint products and backup can also work together. Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) puts anti-malware, anti-ransomware and backup on one agent, so after an attack is contained you can roll back attack-specific changes or restore a clean backup from the same console. See our Acronis antivirus page for what that agent covers and how Acronis EDR and MDR are licensed separately.

Whatever you use, write down which systems you would restore first and how long that would take, and rehearse it. A backup you have not test-restored is a hope rather than a plan.

Layer 4: keeping security agents running

Endpoint protection only works on devices where it is installed, up to date and running. On a large or spread-out estate, agents go missing more often than people expect: a laptop is rebuilt without the agent, a user with local admin rights removes it, an update fails, or an attacker turns it off.

Two kinds of tool help here. Tamper protection inside the endpoint product itself, which most of the products above include, makes it harder to switch the agent off. And Absolute Secure Endpoint, through its Resilience editions, watches critical applications such as antivirus, EDR, encryption and device management agents and repairs or reinstalls them when they fail, backed by Absolute Persistence in the device firmware. Absolute is not antivirus; it keeps your antivirus working. Our Absolute Persistence page explains how it works and which editions include self-healing and Rehydrate recovery.

Good device management, such as Microsoft Intune, also helps by reporting devices that are missing their security software. A regular check that every device in your asset list is reporting into the endpoint console is one of the simplest ransomware controls you can put in place.

Layer 5: people, accounts and patching

Ransomware often starts with something ordinary: a phishing email, a reused password, an exposed remote desktop service or an unpatched firewall. The NCSC recommends multi-factor authentication, careful control of remote access, limiting administrator rights, restricting scripts and macros, and keeping systems patched. These sit alongside endpoint protection rather than inside it, and endpointsecurity.uk covers the policy and patching side.

Staff are part of the defence too. Short, regular ransomware awareness training helps people spot the emails and messages that start most attacks and report them quickly. If you are working towards Cyber Essentials, its malware protection requirement is a sensible baseline for the endpoint layer.

What ransomware protection costs

There is no single price for ransomware protection because it depends on which layers you need. The main cost drivers are:

• Number of devices, users and servers: most products are licensed per device, Sophos Endpoint per user, and servers are often licensed separately.
• Edition: rollback, EDR and tamper features often sit in higher editions or add-ons.
• Extra layers: a dedicated anti-ransomware agent, backup storage and retention, and agent resilience are separate subscriptions.
• Who watches the alerts: a vendor-run MDR service is an extra subscription on top of protection you manage yourself.
• Term: many of the products we supply can be billed monthly on what you protect, and some on a fixed term; we confirm the terms at quote.

Our business antivirus cost guide explains these pricing models in more detail. For the products on this page, ask us for a quote and we will price the layers you actually need rather than a bundle you do not.

How Forever Systems helps

We supply products for each layer and can help you decide where to start:

1. Review: we look at what you already run on your endpoints, how your backups work and which systems matter most.
2. Recommend: we suggest the smallest set of changes that closes the biggest gaps, which may simply be a better edition of what you have.
3. Deploy: we can roll agents out in stages, starting with a pilot group, and agree exclusions so security tools work together.
4. Run: licence changes, renewals and edition upgrades are handled on one Forever Systems account. If you would like help with day-to-day management, see our managed antivirus page; the scope is agreed at quote.

If you are comparing anti-ransomware software as a category, our licensing site lists the options side by side. To talk about your own estate, Contact us.