Cybersecurity1 min readMay 31, 2026

Why ransomware hits small businesses – and what to fix first

The common weak points attackers exploit and the first protections SMBs should prioritize.

#Ransomware#Cybersecurity#Backups#SMB

Small businesses are targeted by ransomware not because they are high-profile, but because they are accessible. Attackers use automated tools to scan for known vulnerabilities and weak credentials – small businesses are statistically less likely to have patched them. The average ransomware attack on an Israeli SMB results in days of downtime and significant recovery costs, even when no ransom is paid.

The Three Most Common Entry Points

Phishing emails that trick employees into entering credentials or opening malicious attachments account for the majority of initial access. Remote Desktop Protocol (RDP) exposed to the internet with weak passwords is the second most common vector – attackers scan for open RDP ports and brute-force them within hours. The third is unpatched software: outdated Windows, VPNs, and remote access tools with known vulnerabilities that were never updated.

What to Fix First

Enable MFA on all accounts – especially email and any remote access tool. Disable direct internet-facing RDP; use a VPN with MFA instead. Ensure automated updates are enabled for Windows and business software. Run regular, tested backups to an isolated location that ransomware cannot reach. These four steps address the majority of ransomware entry paths for SMBs and can be implemented without specialized equipment.

Beyond the Quick Wins

After securing the basics, the next layer involves endpoint detection (EDR), network segmentation, and security awareness training for employees. These controls reduce dwell time – how long attackers operate undetected inside a network before deploying ransomware – and limit blast radius if an endpoint is compromised. NetFortress designs layered protection specifically for Israeli SMBs that need enterprise-level standards without enterprise budgets.

Frequently asked questions

Why would ransomware target a small business?

Not because you are high-profile, but because you are accessible. Attackers run automated tools that scan the internet for weak passwords and unpatched systems, and smaller businesses are statistically less likely to have closed those gaps. You are a target of opportunity, not a specific choice.

How does ransomware usually get in?

Three routes dominate: phishing emails that harvest credentials or carry malicious attachments, Remote Desktop (RDP) exposed to the internet with weak passwords, and unpatched software with known vulnerabilities. Most SMB ransomware incidents trace back to one of these.

What should we fix first to reduce ransomware risk?

Enable MFA everywhere, take RDP off the public internet and use a VPN with MFA instead, turn on automatic updates, and keep tested backups in a location ransomware cannot reach. Those four steps block the majority of entry paths and need no specialised equipment.

Will backups alone protect us from ransomware?

Only if they are isolated and tested. Modern ransomware actively seeks out and encrypts connected backups before triggering, so a permanently attached backup drive often gets encrypted too. Keep at least one offline or immutable copy and confirm you can actually restore from it.

Should we pay the ransom if we are hit?

Paying is a last resort and never guaranteed – you may not get a working key, and it marks you as willing to pay. The stronger position is preparation: tested backups, an incident response plan, and a provider who knows your environment so recovery does not depend on the attacker.

Cybersecurity6 min read

A practical cybersecurity checklist for Israeli SMBs with no in-house IT team

Plenty of small businesses run without anyone whose job is IT. This is a plain checklist you can work through yourself, grouped by how much difference each item makes, so an owner or office manager can see where they stand.

Read article

IT Operations6 min read

The updates you skip are the door attackers use: patch management for SMBs

Most breaches exploit a known flaw that a patch already exists for. Here is why Israeli SMBs fall behind on updates, and how to build a simple, reliable patching routine that closes the gaps before attackers find them.

Read article

Endpoint Security6 min read

Why antivirus is no longer enough: endpoint protection (EDR) for SMBs

Traditional antivirus catches yesterday's known threats; modern attacks are built to slip past it. Here is what EDR adds, why it matters for Israeli SMBs, and how to adopt it without an in-house security team.

Read article