Small and mid-size companies are frequent ransomware targets precisely because attackers assume weak baselines: shared passwords, unpatched laptops, and backups that have never been restored.
You do not need a twenty-person security operations center to raise the cost of attacking you. You need consistent coverage and a rehearsed response.
A realistic baseline
- MFA on email, VPN, and admin accounts — no exceptions for executives
- Endpoint protection with visibility (not only signature antivirus)
- Patch cadence for OS and browsers, measured not hoped for
- Offline or immutable backups tested with an actual restore drill
- A one-page incident plan: who to call, what to disconnect, how to communicate
“Our first restore test failed. That failure was cheaper than learning during a real outage.”
People and process beat logo sheets
Buying five overlapping security products creates alert fatigue. Prefer a short stack you can operate: identity, endpoint, email filtering, backup.
Phishing simulations and clear reporting channels matter as much as any agent on the laptop.
Baseline targets
100%
MFA on critical accounts
30d
max critical patch lag
Quarterly
backup restore test
1 page
incident response sheet
