What is ransomware?

The NCSC and UK law enforcement advise against paying. Payment does not guarantee a working decryption key, decryption tools are frequently slow and incomplete, and it does not prevent stolen data from being published or sold — some organisations have been extorted a second time after paying. Payment also funds further criminal activity and may raise sanctions issues if the group is subject to designations. That said, the decision is usually made under extreme pressure by organisations facing existential downtime. The practical answer is to make payment unnecessary in advance, through immutable backups and tested recovery.

Backups protect against the encryption element but not the extortion element, and only if the attacker cannot reach them. Modern ransomware operators specifically hunt for and destroy backups before deploying encryption, so a backup on a permanently connected network share or a NAS accessible with domain credentials offers limited protection. Effective backups are offline, immutable or held in a separate security domain, retained long enough to predate the intrusion, and verified by periodic test restores. They also do nothing about data already exfiltrated, which is why prevention and detection remain necessary alongside recovery.

Recovery time varies enormously with preparation. Organisations with tested immutable backups, documented rebuild procedures and a rehearsed plan commonly restore core operations within a few days. Those discovering during the incident that backups were encrypted, incomplete or never restore-tested frequently take several weeks, and some never fully recover historical data. Recovery is rarely a simple restore: systems must be rebuilt cleanly to avoid reintroducing persistence, credentials rotated across the estate, and the entry point identified and closed before reconnecting, all while the business operates on manual processes.

Most cyber policies include ransomware cover, typically extending to incident response costs, forensic investigation, legal advice, business interruption and sometimes ransom payment itself, though ransom cover is increasingly restricted. Cover is conditional. Insurers commonly require multi-factor authentication on remote access and email, endpoint detection and response, tested backups and timely patching, and a claim can be reduced or declined where the proposal form misrepresented those controls. Reading the conditions before an incident, rather than during one, is the practical advice — the required controls are usually ones an organisation should have regardless.

Yes, and often specifically because they are small. Ransomware-as-a-service has lowered the skill required to operate an attack, and affiliates work at volume against whatever access they can obtain cheaply — exposed remote access, credentials from a previous breach, an unpatched firewall. Smaller organisations typically have fewer controls, no out-of-hours monitoring and weaker backup arrangements, which makes them faster to compromise and more likely to pay relative to the effort involved. Most SME incidents are opportunistic rather than deliberately selected, which is exactly why basic controls are effective.