Preventing ransomware: 10 measures for SMEs
Ransomware can bring an entire organisation to a standstill overnight. Most attacks can be prevented with a handful of measures. These are the most important ones, in order of impact. Updated on 23 October 2026.
How a ransomware attack unfolds
Attackers usually get in through stolen credentials, a phishing email or an unpatched server. They then explore the network, steal data and only at the very end encrypt everything they can reach, including backups. Each measure below blocks one or more of those steps.
The ten measures
- 01
MFA everywhere
Multi-factor authentication on email, VPN, admin accounts and cloud.
- 02
Patching
Update operating systems and applications within days, critical vulnerabilities faster.
- 03
Containment
Run unknown files isolated, so new ransomware cannot encrypt anything.
- 04
EDR with 24/7 follow-up
Someone has to see the alerts at night too, which is why MDR.
- 05
Offline or immutable backups
A copy the attacker cannot reach or delete, and tested regularly.
- 06
Limit admin accounts
No day-to-day work with admin rights.
- 07
Email and web filter
Stop phishing and malicious links.
- 08
Segment the network
Prevent an infection from spreading through the whole network.
- 09
Train employees
Awareness and phishing simulations.
- 10
Incident plan
Know whom to call and what to do, before it happens.
Where Xcitium helps
Containment
ZeroDwell isolates unknown files (measure 3).
Managed EDR
24/7 SOC that takes action (measure 4).
Patch management
Automatic updates (measure 2).
Network shares
Network Share Protection against encryption of file servers.
Quick check: how are you doing?
- Is MFA active on all accounts with external access?
- Are updates rolled out within two weeks?
- Is there a backup an attacker cannot delete, and has it been tested?
- Does someone see security alerts outside office hours too?
- Do you know whom to call in an incident?
Complete your coverage
ZeroDwell containment
Unknown files run in a virtual environment until it is clear whether they can be trusted.
ViewManaged EDR
24/7 SOC that monitors your endpoints, investigates and acts immediately.
ViewNetwork Share Protection
Protection of file servers and NAS against encryption from any device.
ViewSecurity awareness training
Managed training and quarterly phishing tests for all employees.
ViewFrequently asked questions
Should I pay the ransom?
The advice of the Dutch NCSC and police is not to pay: there is no guarantee you will get your data back and you fund new attacks. Always report it to the police.
Is a backup not enough?
A backup helps with recovery, but not against leaks of stolen data. Prevention remains better than cure.
Preventing ransomware in your environment?
In a short demo we show you how it works, discuss your situation and make a proposal. No obligation, in English or Dutch.
Product information: xcitium.com. Xcitium, ZeroDwell, OpenEDR and related logos are trademarks of Xcitium Inc.