Ransomware Protection for Small Business: Five Questions That Reveal Your Real Risk

Most small business owners find out how good their ransomware protection is on the worst possible day, which is the day they need it. Up to that point, security tends to be a feeling rather than a fact. The tools are purchased. The invoices are paid. Somebody said it was handled.

There is a better way to find out, and it costs nothing. Ask five specific questions about your own environment. If you can answer all five with a date, a number, or a name, your ransomware protection is real. If the answers come back as "I think so" or "our IT guy handles that," you have found your gap before an attacker did.

This guide walks through those five questions, what a strong answer sounds like, and the Illinois-specific obligations that national security guides leave out.

What Changed About Ransomware in 2026

Three shifts matter more than the rest, and each one breaks an assumption that older security advice was built on.

Unpatched software is now the most common way in. Verizon's 2026 Data Breach Investigations Report put exploitation of vulnerabilities at 31% of breaches, ahead of every other initial access method, up from 20% a year earlier. For small and midsize organizations specifically it accounts for 26%. The same research found that across more than 13,000 organizations studied, only 26% of the vulnerabilities on CISA's Known Exploited Vulnerabilities list had been fully remediated.

Phishing stopped looking like phishing. Microsoft reports that when attackers embed AI in their phishing operations, click-through rates hit 54%, against roughly 12% for conventional campaigns. The tells your team was trained to catch, the typos and the stilted English, have been engineered out. (Microsoft Security, April 2026)

And a growing share of attacks never encrypt a single file. Data gets copied out and the leverage is the threat to publish it. That one matters most, because it breaks the assumption that a good backup means you are covered. Against an extortion-only attack, backups are irrelevant. Only prevention, detection, and access control do anything.

Nothing in that data suggests attackers are hunting you specifically. They are running automated scans for conditions, and a business becomes a target by matching one. That is worse news than being singled out, because it means obscurity is not a strategy.

Question 1: If a Device Was Compromised at 2 a.m., What Would Notice?

A strong answer names a system and a person. Managed detection and response is watching, alerts route to a monitored queue rather than an inbox, and a named analyst or on-call engineer responds within a defined window. A weak answer is "we would see it in the morning."

Attackers work the overnight and weekend windows deliberately, and with the gap between first access and payload now measured in days, an unwatched Friday night is most of the runway they need. This is the layer small businesses skip most often, because it is the one that requires either a security team or a partner. Antivirus does not fill it. Antivirus tells you a file matched a signature. It does not tell you an administrator account just logged in from a country you do not operate in.

Our 24/7 NOC and SOC monitoring exists for exactly this window.

Question 2: When Did Someone Last Restore From Your Backups?

The answer should be a date within the last quarter, plus a number: how many hours a full restore took. Anything vaguer means you have backup software, not a recovery capability. Those are different things, and the difference only becomes visible when you need one.

Two properties matter for 2026. Backups must be immutable, meaning that once written they cannot be altered or deleted for a set retention period, including by an administrator account. And they must be isolated from the production network. Modern ransomware crews look for backups first and destroy them before they trigger anything, because a business with working backups does not negotiate.

Put the drill on the calendar, run it, and write the recovery time down where leadership can see it. That number is the single most useful figure in your entire backup and disaster recovery plan.

Question 3: How Long Does a Critical Patch Take to Reach Every Machine?

Days, ideally under seven for anything internet-facing. If patching at your company happens when somebody has time, the honest answer is weeks, and weeks is far too long. Exploit code for a newly disclosed vulnerability circulates within hours, and automated scanning for unpatched systems begins almost immediately.

The part worth internalizing is that attackers are not guessing. CISA publishes a list of vulnerabilities known to be actively exploited. It is public, it is free, and it functions as a shared target list. Given the finding that only about a quarter of those get fully remediated, patching is less a technical problem than an ownership problem. Somebody has to be accountable for a cadence, with visibility into every endpoint, including the laptop of the salesperson who has not connected to the office network in six weeks.

Question 4: What Happens When One Employee's Password Is Stolen?

The right answer is nothing much. Multifactor authentication blocks the login, conditional access flags the unusual location, and the account has only the permissions that role actually needs. If a single stolen password could reach your file shares, your email, and your backup console, you have one control standing between a phishing click and a full compromise.

Credential abuse dropped to 13% as an initial entry point in the 2026 data, which reads like progress until you follow the whole attack. Credential abuse appears in 39% of breaches across the complete chain. Attackers may get in another way now, but they still need credentials to move laterally, escalate privileges, and find what is worth stealing. Taking that away limits the damage even when something else fails.

Baseline: MFA on every business account, no exceptions for executives, a password manager so people stop reusing credentials across personal and work systems, and ongoing security awareness training built around current techniques rather than the phishing examples of five years ago. We wrote about how far those techniques have come in When the Email Looks Real.

Question 5: Who Makes the First Three Calls After a Breach Is Confirmed?

You should be able to name three people or organizations without looking anything up. Typically your IT provider or internal lead, your cyber insurance carrier, and legal counsel. Most policies require notification within a specific window, and calling counsel before you start communicating externally protects you later.

The first thirty minutes shape most of what follows, and they are the worst possible time to be figuring out a process. A usable incident response plan fits on two pages. Who declares an incident. Who has authority to disconnect systems. Who talks to customers, and who does not. Where the contact list lives, including a copy that survives your network being unavailable.

Then walk through it once a year as a tabletop exercise. An hour in a conference room surfaces gaps that no document review catches, and it is the cheapest security work you will ever do.

Illinois Obligations That National Security Guides Skip

National guides stop at the technical controls, but for an Illinois business a ransomware incident is also a compliance event. Two state laws shape what you owe and when.

Under the Illinois Personal Information Protection Act, 815 ILCS 530, any business that owns or licenses computerized personal information about Illinois residents must notify affected residents after a breach in the most expedient time possible and without unreasonable delay. Illinois does not set a numeric deadline the way some states do. The standard is reasonableness, which offers less comfort than it sounds like, because reasonableness gets judged after the fact. Breaches affecting more than 500 Illinois residents also require notice to the Illinois Attorney General. (Illinois Attorney General)

Illinois also defines personal information more broadly than most states, and biometric data falls inside it. If you use fingerprint or facial recognition for timeclocks or building access, which many Elgin-area manufacturers do, the Biometric Information Privacy Act adds a separate set of obligations on top. That combination makes Illinois a stricter environment than the national averages imply.

The reason this matters operationally is that all of it depends on logs. You cannot report what was accessed without records showing what was accessed. Businesses with real monitoring answer those questions in days. Businesses without it hire a forensics firm and guess. IT compliance support is largely about having the evidence ready before you need it.

How Exposure Differs by Industry

Businesses across Elgin, Schaumburg, Naperville, and Aurora sit in sectors ransomware crews work actively. The attack barely changes between them. The consequence changes completely.

What Protection Costs Against What a Breach Costs

Nobody buys security because a report told them to, so it is worth putting the two numbers side by side honestly.

IBM's 2026 Cost of a Data Breach Report put the global average at $4.99 million, a record and up 12% year over year, with the United States average at $11.5 million. Breaches took an average of 247 days to identify and contain. Those figures span organizations of every size, so do not read them as your invoice. Read what sits inside them: detection and escalation, lost business during downtime, notification and legal costs, and customers who quietly go elsewhere. Ransom payment is usually a minor line. In the 2026 DBIR dataset, 69% of victims chose not to pay at all, up from 65% the year before.

Against that, the five items in this article are mostly configuration, discipline, and coverage rather than capital expense. In most environments we walk into, the licensing is already adequate and the configuration is the problem. Features switched off. Defaults never changed. Alerts routed somewhere nobody looks. IBM also found that organizations using AI and automation extensively in their defenses saved an average of $1.93 million per incident, which is the practical argument for managed IT services over buying another product and hoping somebody watches its dashboard.

For a higher-level walkthrough of how these controls fit together, see our earlier piece on strengthening your cybersecurity.

Frequently Asked Questions