What Is Ransomware? A Plain Guide for Small Businesses
Ransomware locks your files and demands payment, and many attackers also steal the data. Here is how it works and what a small business can do first.
Ransomware is malware that encrypts the files on a device and then demands payment for the key to unlock them. CISA's ransomware guide describes it as a form of malware designed to encrypt files on a device, and notes that attackers often steal the data too and threaten to publish it, a tactic it calls double extortion.
How a ransomware attack usually plays out
The details vary, but the shape is consistent. An attacker gets in, often through a phishing email, an exposed remote access service or an unpatched system. They spread, find the data and the backups, encrypt what they can, and leave a note with a payment demand. If they also copied your customer files, the threat moves from "you cannot work" to "your clients' data goes public".
The backup point matters most. CISA notes that many ransomware variants try to find and delete or encrypt backups they can reach. A backup sitting on the same network, always connected, is a backup the attacker can also lock.
Why small businesses are in scope
A small business holds the things an attacker wants: client records, invoices, payment details, email. It rarely has a security team. Nothing about being small makes you invisible. The good news is that the preventive list is short, and most of it is configuration, not purchases.
What to do, in order
CISA's guidance covers a lot. Here is a version sorted by effort for a team of a few people.
**Test a restore.** Keep a backup that is offline or otherwise out of reach of your everyday accounts, then restore one file from it. CISA recommends regularly testing the availability and integrity of backups. A backup you have never restored is a hope.
**Turn on multi-factor authentication** for email, your password manager, your banking and anything with admin rights. CISA recommends phishing-resistant MFA where possible and unique passwords of at least 15 characters. A password manager makes that realistic.
**Patch.** Update operating systems and software, internet-facing systems first.
**Close remote access.** CISA's advice is not to expose services such as remote desktop on the web. If you must, add controls in front of it.
**Limit what each account can reach.** The guide recommends least privilege, so one stolen login cannot open everything.
**Filter email and train people.** Block risky attachment types, disable macros in Office files that arrive by email, and make sure staff know what a bad message looks like. Spotting an AI-generated phishing email is a good place to start.
If you run an app you built with AI, apply the same thinking to its data: back it up and keep the copy somewhere your deployment credentials cannot overwrite.
Should you pay?
CISA's guide does not tell you whether to pay, and it does not address the decision directly. It does say that security researchers sometimes find flaws in a ransomware variant's encryption and release decryption tools, so contact law enforcement before you decide. That is a reason to slow down, not a recommendation either way.
Write the plan before you need it
When it happens, nobody thinks clearly. Decide now who disconnects machines, who calls whom, and where the contact list lives offline. A page on an AI incident response plan gives a template, and an emergency business closure plan covers what to do if you cannot operate for days. For the wider category, see the wider AI risk guide.
FAQ
What does ransomware do?
It encrypts files so you cannot open them, then demands payment for decryption. Many attackers also steal data and threaten to publish it.
How does ransomware get onto a computer?
Common routes include phishing emails, exposed remote access services and unpatched software. CISA's prevention list targets each of these.
Does a cloud backup protect me from ransomware?
Only if the attacker cannot reach it with the credentials they stole. CISA advises offline, encrypted backups and delete protection on cloud storage.
Can ransomware files be decrypted without paying?
Sometimes. Researchers occasionally find encryption flaws and publish decryptors, which is why CISA suggests consulting law enforcement.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
