Ransomware stopped being a Fortune 500 problem years ago. The targets now are mid-sized businesses with weaker defences and just enough money to pay a ransom. Quiet, profitable, and happening every day.
Why This Isn't Someone Else's Problem
The number of times we've seen businesses assume cybersecurity is for bigger companies is, frankly, embarrassing. The math doesn't work that way. Attackers scan every IPv4 address on the internet, find something exploitable, and automate their way in. Your size doesn't protect you.
What protects you is a baseline of controls that automated attacks can't easily bypass. None of those controls are expensive or exotic. They're just work that doesn't feel urgent until the day it is.
The Anatomy of a Typical Breach
Most breaches we're called in to investigate follow a depressingly predictable pattern. Someone gets a phishing email, clicks a link, enters their credentials. The attacker logs into an account that didn't have MFA, finds a file share or database, exfiltrates data, encrypts or extorts. Six to eight weeks of silent access, on average, before anyone notices.
The controls that would have stopped this at any step are not complicated. MFA on every account. Phishing training twice a year. Monitoring on sensitive systems. A backup that's actually tested. None of these are enterprise-grade investments.
What Actually Works at an SMB Budget
A reasonable baseline for a small to mid-sized business: Cloudflare's free tier in front of web properties, MFA enforced everywhere via a password manager, endpoint protection from Microsoft or CrowdStrike, tested off-site backups, and a written incident response plan. Total annual cost for a 50-person business is usually under Rs 5 lakh, often well under.
That investment dramatically reduces your exposure to automated attacks, which are roughly 90% of what you'll actually face. Targeted nation-state attacks are a separate problem and usually not your problem.
The Human Element
Technical controls solve a big chunk of the problem. The rest is people. Employees click links, reuse passwords, share credentials in Slack, leave laptops in cars, and occasionally try to help attackers who've called pretending to be the CEO. Every one of these has been the root cause of a breach we've seen.
Training helps but it has a ceiling. The most effective controls combine training with architecture: MFA makes stolen passwords less dangerous, EDR catches malicious activity regardless of how it got in, segmentation limits what a single compromised account can reach. Design the system to survive human mistakes, because the mistakes will happen.
Where training does earn its keep, it's the repeated kind. Running simulated phishing campaigns quarterly, walking through real recent incidents with your team, and making it easy to report suspicious messages without punishment — those things are measurably effective.
The training has to be short, relevant, and repeated. A 45-minute annual compliance video doesn't change behaviour. A 10-minute monthly check-in with a real example does.
If You Are Hit: The First Hours Matter
The first hours of a security incident are decisive. Disconnect affected systems from the network but don't power them off (forensics depends on memory). Take a snapshot. Notify your incident response partner if you have one, or engage a security response firm immediately if you don't. Reset all credentials assuming full compromise. Notify regulators within the required window, which in India can be as short as six hours for CERT-In.
Do not pay a ransom without professional advice. Ransoms fund future attacks and, more practically, often don't deliver working decryption. The legal and insurance implications of payment are also getting more complicated each year.
Compliance vs Actual Security
There's a quiet tension in this field between compliance and security. Compliance is what the auditor checks. Security is what actually stops attackers. They overlap meaningfully but they're not the same thing, and treating them as identical leads to the worst of both worlds.
The pattern we see at well-run security programmes: treat compliance as a baseline that gets done competently and without drama, then spend the real attention on actual risk reduction. The compliance paperwork matters because it has to happen. The substance of what's underneath matters because attackers don't care about your audit report.
The Threat Landscape in 2026
The threat landscape has shifted in specific ways worth naming. Ransomware has become more targeted and more patient — attackers dwelling for weeks inside networks before encrypting, specifically to maximise damage and negotiating leverage. AI-assisted phishing has raised the floor of attack quality substantially; the obviously-broken English phishing emails of five years ago are largely gone.
On the defence side, tooling has also improved. Modern EDR products genuinely catch more than they used to. Managed SOC services are accessible at price points SMBs can afford. The gap between what's achievable in security and what most businesses implement has widened, which is frustrating because the tools to close it exist.
The regulatory environment has also tightened meaningfully. DPDP enforcement in India is becoming real. The EU's NIS2 and DORA regulations are producing compliance demands that flow down to vendors. Being serious about security is increasingly a market access requirement, not just a risk reduction investment.
Misconceptions That Keep Businesses Vulnerable
One: 'we're too small to be a target'. Demonstrably false. Automated attackers don't care about your size — they scan everyone. Ignoring security because you're small is exactly the reasoning attackers count on.
Two: 'we haven't been hacked, so our current security must be working'. Possibly. Or you've been hacked and just don't know yet. The average time between breach and detection is months. Absence of evidence isn't evidence of absence in this domain.
Three: 'security is too expensive'. Compared to what it costs to recover from a serious incident, it's cheap. Basic security controls for a 50-person business cost less than a single ransomware recovery effort.
A Close Call We Witnessed
A mid-sized client in the manufacturing sector almost got hit by a ransomware incident in late 2025. The initial access was a targeted phishing email to their finance head that mimicked a genuine vendor. Credentials got harvested. The attackers spent about three weeks mapping internal systems quietly before anyone noticed.
What saved them was a thing they'd grumbled about installing six months earlier: a proper EDR solution on every endpoint, with a managed SOC watching alerts. The anomalous behaviour — unusual PowerShell execution from the finance head's machine at 2am — triggered a response within an hour. Containment happened before encryption started.
The investment that "seemed expensive" six months before paid for itself a hundred times over that one night. We talk about this story in every security audit discussion now. The controls that feel optional in peacetime are the only thing standing between you and a very bad quarter.
The Short Checklist
If you take nothing else from this post, take this checklist. It's what we'd hand to someone just starting out in this area. None of it is revolutionary. All of it is worth doing. The compound effect of consistently doing these things, even without any other clever moves, is meaningful over a year or two. We'd rather see a team do the checklist competently than chase the latest trend while skipping the fundamentals.
- Turn on MFA for every account, no exceptions. Including the CEO.
- Run phishing simulations quarterly. Don't punish failures. Coach them.
- Test your backups by actually restoring something at least twice a year.
- Keep a written incident response plan. Review it annually.
- Monitor privileged accounts more closely than regular ones.
- Know your legal notification obligations (CERT-In, DPDP, sector regulators) before you need them.
- Run tabletop exercises for incident response annually. The plan you've never rehearsed probably won't work.
- Keep an asset inventory up to date. Assets you don't know about are assets you can't protect.
- Rotate high-privilege credentials quarterly. Long-lived admin credentials are a risk.
- Audit user access quarterly. People change roles; old access rarely gets revoked automatically.
If you've read this far, you probably care about getting this right. That's more than most people do, and it matters. Our offer stands: if you're stuck or want a sanity check on something you're planning, drop us a line. We've been through most versions of this particular problem and we're happy to share what worked. The best conversations we have are usually with people who've already done the reading and want to sharpen their thinking rather than start from zero. Either way, good luck with whatever you're building. The fact that you're thinking about this carefully gives you a meaningful head start on the people who aren't.
A final note from our side. The best clients we've worked with weren't the ones who came to us with everything figured out. They were the ones who knew their business, had clear questions, and were open about what they didn't know yet. If that sounds like you, we'd love to talk.
Frequently Asked Questions
Will cyber insurance pay the ransom if we're hit?
Increasingly, no. Many insurers have stopped covering ransom payments due to regulatory pressure and moral hazard concerns. What insurance does cover is investigation, recovery, business interruption, and sometimes legal response. Don't buy insurance expecting it to pay a ransom — buy it for recovery support.
Are cloud-backed files safe from ransomware?
Only if they're properly versioned and the attacker can't access the cloud backups. Synced files in OneDrive or Dropbox can be encrypted and replicated to cloud if your endpoint is compromised. Proper ransomware-resistant backups require versioning, immutability, and separate access credentials from your primary environment.
Should I pay a ransom if we're actually hit?
Don't decide without professional advice. Payment has serious downsides: it funds future attacks, may not deliver working decryption, creates potential sanctions exposure (if the attacker is on sanctions lists), and signals to other attackers that you pay. Sometimes payment is genuinely the least-bad option, but that judgment should come from incident response experts, not you under pressure.
Is there anything worse than paying a ransom?
Yes — paying a ransom and still not recovering. About 20% of ransom payments don't result in usable decryption keys or result in partial recovery only. Sometimes the attacker's infrastructure breaks between payment and decryption. Sometimes they just don't follow through. Recovery from backups is always preferable when possible.
Need help with your project?
Orange Essence Technologies builds e-commerce, software, mobile apps and AI solutions for clients across India and around the world. If any of this is relevant to what you're working on, we'd love to chat.
Get in touch →
