Ransomware protection for small business comes from a few layered controls: multi-factor authentication (MFA) on every remote access path, fast patching of known exploited vulnerabilities, endpoint protection on every computer, control over which remote access tools can run, and offline backups that have been tested. The order matters, and this guide starts with the controls that close the most common entry points.
In 2025, the FBI IC3 received 3,611 ransomware complaints with $32.3 million in reported losses, a figure that leaves out downtime, lost business, and recovery costs. Verizon’s 2026 Data Breach Investigations Report also found ransomware in 48% of breaches, up from 44% the year before.
This guide covers why ransomware groups target small businesses, how attackers get in, which protections to put in place first, and what to do if an attack happens.
Why ransomware groups target small businesses
While large enterprises may seem like the most valuable targets for ransomware attacks, small businesses are typically easier to target.
Small businesses often lack the security and responsiveness of larger organizations, making them tempting targets for cyber criminals. Additionally, ransomware targeting small businesses offers more targets, making it easier to hit multiple victims quickly.
For example, CISA and the FBI report that Akira ransomware primarily targets small and medium-sized businesses (SMBs). In some Akira incidents, attackers stole data just over two hours after initial access, a window in which most small teams have no one actively watching.
Once a small business is afflicted with ransomware, it’s under pressure to restore everything quickly. Every moment the organization is locked out of its own data and network is another moment it's losing business and money, so it needs to act quickly. Even if they can restore lost data through backups, attackers can often pull a “double extortion” and steal the data before encrypting it, so proprietary and sensitive data can still be sold or leaked.
How ransomware gets into a small business network
If you want to avoid ransomware attacks, the first step is to understand how they happen. There are several ways in which ransomware can access a business’ network, including:
1. Stolen passwords and remote access without MFA
Without MFA, a single stolen password can be enough for attackers to get in. CISA reports that Akira actors gain access through VPN accounts that aren’t protected with multi-factor authentication and through Remote Desktop Protocol (RDP). Reused passwords and credentials stolen through phishing make this easier. Strong, unique passwords help, but IT should enforce MFA on every remote access account so a password alone is never enough.
2. Unpatched software and devices
Attackers also exploit known vulnerabilities in operating systems, applications, VPNs, and other internet-facing systems that haven’t been patched yet. Patching that depends on users updating their own devices leaves gaps, so automated, IT-managed patching is essential.
Verizon’s 2026 Data Breach Investigations Report (DBIR) found that exploitation of vulnerabilities was the initial action in 31% of breaches. Only 26% of known exploited vulnerabilities were fully remediated, with a median of 43 days to fix, which gives attackers a long window to target exposed systems.
3. Phishing emails and malicious downloads
Phishing attacks and other social engineering tricks are common first steps to ransomware attacks. All it takes is one employee unwittingly handing over their password data or downloading a malicious file, and their devices or accounts are compromised. As such, knowing how to prevent phishing is vital for cybersecurity.
4. Legitimate remote access tools turned against you
This is one of the hardest entry points to spot, because businesses and IT teams use remote access software every day for remote work and remote support. Once attackers are inside, many install legitimate, commercial remote access tools to keep their foothold. CISA reports that Akira actors do exactly this, which lets their activity blend in with normal IT administration, and they also try to shut down antivirus processes.
That’s why a remote access tool IT never approved, appearing on a company computer, is a warning sign worth investigating. Keep a list of the approved remote access software your teams use so unapproved tools stand out.
Ransomware protection for small business: What to put in place first
Start at the top of this list and work down. The first two controls close the entry points attackers use most, and each step after that limits the damage if something gets through.
1. Require MFA on every remote access path and admin account
MFA requires a second form of verification, such as an authenticator app or security key, so a stolen password alone can’t unlock an account. It’s one of CISA’s top recommendations for defending against Akira, along with closing direct RDP access from the internet. Apply it to VPNs, remote access tools, email, and every admin account.
2. Patch known exploited vulnerabilities first
Keeping devices patched and up to date is vital for maintaining cybersecurity, but so is knowing how to prioritize patches. Start with known, actively exploited vulnerabilities, since attackers will target them first. (You can identify these vulnerabilities using the CISA Known Exploited Vulnerabilities catalog.) Prioritizing endpoints matters too: start with internet-facing systems, VPNs, and backup servers, since they’re the most exposed and the most critical to recovery. Automate patching wherever possible so updates don’t depend on users.
3. Run endpoint protection on every computer
Endpoint protection detects and stops threats on each computer. Look for real-time malware detection, automatic quarantine of detected threats, and phishing site blocking. Because ransomware groups try to turn protection off, IT also needs central visibility into which devices are protected. Teams with the capacity to investigate alerts can add endpoint detection and response (EDR) for deeper investigation and response.
4. Control which remote access tools can run
Standardize on one approved remote access tool, protected with MFA, and block or alert on any other remote access software. That way, a tool an attacker installs to keep access stands out instead of blending in.
5. Limit administrator rights
Everyday users shouldn’t have local admin rights. If a ransomware attack involves stolen credentials, then a single compromised account with admin privileges gives attackers far more reach. Use separate admin accounts so the number of potential targets stays minimal.
6. Keep offline, tested backups
Backups are essential for restoring systems after an attack. CISA recommends offline, encrypted backups kept separate from the main network, which makes them much harder for attackers to reach. Keep backup servers patched too, since groups like Akira target backup server vulnerabilities, and run regular restore tests to confirm the backups are current and working.
7. Train employees to spot and report phishing
Employee training and awareness is another key defense. Employees should know how to identify and avoid phishing attacks and have a fast, blame-free way to report suspicious messages, so IT can respond before a phishing attempt spreads.
What to do if ransomware hits your business
If ransomware hits, respond quickly and in order. These steps follow the ransomware response checklist in CISA’s #StopRansomware Guide:
Disconnect affected computers from the network. This helps limit the spread, but avoid shutting them down if possible, since that can destroy evidence.
Call your IT provider or MSP and start your incident response plan. The sooner the plan is in motion, the more damage you can contain.
Preserve evidence by photographing ransom notes and recording which systems are affected. This supports the investigation and recovery process.
Report the attack to proper authorities, including the FBI and CISA. You can report it to the FBI at ic3.gov or a local field office. If you have cyber insurance, make sure to contact your insurer early.
Avoid paying the ransom. While it can be tempting to pay the ransom and cut your losses, there’s no way to guarantee the criminals will follow through (and it rewards them for their crimes). As such, CISA and the FBI discourage payment.
Restore from clean backups only after you close the entry point and reset passwords; otherwise, attackers may still have access. Your offline, tested backups are what make this step possible.
How Splashtop Shield for Business helps protect your computers from ransomware
Endpoint protection is the layer that catches what gets past MFA and patching. Splashtop Shield for Business provides that layer for small businesses, combining modern antivirus, AI-assisted scam and phishing protection, and blocking of unauthorized remote access tools.
Splashtop Shield for Business is available as an add-on to Splashtop business products with unattended access and protects Windows and macOS computers. With Splashtop Shield for Business, you can:
1. Detect and quarantine malware in real time
Splashtop Shield for Business provides real-time anti-malware and on-access scanning, with AI-assisted detection that helps catch threats signature-based scanning misses. It automatically quarantines most threats, and IT teams can run Quick and Full scans directly from the Splashtop console.
2. Block phishing sites and unauthorized remote access tools
Splashtop Shield for Business blocks unsafe and known phishing sites, helping keep employees off pages built to steal passwords. It also detects and blocks attempts to install unauthorized remote access tools and alerts IT immediately, which helps counter the persistence technique CISA describes for Akira. Admins can add approved tools to an allow list, so legitimate remote support keeps working.
3. Deploy and report from the Splashtop console
IT teams can install Splashtop Shield for Business automatically through Endpoint Policies or with a silent, on-demand install. Threat alerts appear in the Splashtop console with a link to the Shield Console for triage, where admins can see protection status and security events for each device and export logs that support IT compliance efforts.
Splashtop Shield for Business can also run alongside security tools such as CrowdStrike and Bitdefender. It focuses on prevention and detection and doesn’t provide backup or recovery, so pair it with an offline backup solution. For a closer look at what to compare across tools, see Ransomware protection software: Features that matter.
Protect your small business computers with Splashtop Shield for Business
Ransomware protection for small business works best as layered controls in priority order: MFA and patching close the most common entry points, and endpoint protection catches what gets past them. Splashtop Shield for Business adds that endpoint layer with real-time antivirus, AI-assisted detection, and blocking of unauthorized remote access tools.
If your organization already uses a Splashtop business product with unattended access, you can add Splashtop Shield for Business to the computers you already manage.
Ready to add Splashtop Shield for Business? Learn more today.
