# How to Protect Your Business from Ransomware in 2025

> The UK government's Cyber Security Breaches Survey has found around half of UK businesses reporting a cyber attack or breach in the past 12 months in recent years. Here is what the NCSC's own guidance says actually reduces ransomware risk.

*Section: Technology — By Amelia Hart (Technology Correspondent) — Published September 20, 2025, updated July 7, 2026 — 4 min read*

Canonical URL: https://dailyjunction.co.uk/technology/protect-business-from-ransomware-2025
Tags: ransomware, cybersecurity, backup, phishing, business security

## Key takeaways

- DSIT's annual Cyber Security Breaches Survey has repeatedly found roughly half of UK businesses reporting a breach or attack in the past 12 months
- The NCSC advises against paying ransoms, noting payment does not guarantee decryption and funds further criminal activity
- NCSC guidance identifies multi-factor authentication as blocking the large majority of credential-based attacks, the most common ransomware entry point
- The NCSC's '3-2-1' backup principle — 3 copies, 2 different media, 1 offline — remains the core resilience recommendation
- Medium and large UK businesses are considerably more likely than micro-businesses to identify a breach, partly reflecting better detection capability rather than lower actual risk

## Context: why ransomware guidance needs regular updating, not a one-off checklist

Ransomware advice dates quickly, because attacker tactics evolve continuously and because the UK government's own data on how many businesses are actually affected is updated annually, not fixed. What has not changed is the core set of defensive measures that consistently show up as effective across successive years of NCSC guidance and government survey data — the challenge for most businesses is less "what should we do" and more "why haven't we actually done it yet."

## The data: the scale of the problem, from the government's own survey

DSIT's Cyber Security Breaches Survey, the UK government's official annual tracking study, has repeatedly found that roughly half of UK businesses report identifying a cyber breach or attack in the preceding 12 months. That headline figure masks significant variation by business size: medium and large businesses report breaches at notably higher rates than micro-businesses and sole traders, a gap the survey's own methodology attributes partly to larger organisations simply having better detection and monitoring capability to notice an attack in the first place, rather than necessarily facing proportionally more attempted attacks — smaller businesses may be under-reporting because they are under-detecting, not because they are under-targeted.

Ransomware specifically remains one of the costliest categories of incident, both in direct ransom demands and in business disruption during recovery, which for organisations without tested backups can extend to weeks rather than days.

> "The organisations that recover fastest from a ransomware incident are almost never the ones with the most sophisticated prevention. They are the ones that can restore from a clean backup within hours instead of negotiating with criminals for days." — a conclusion the NCSC's own incident response guidance has repeatedly emphasised across successive versions of its ransomware advice.

## What's changing: the guidance is converging on a smaller set of high-impact controls

Rather than expanding, NCSC guidance across successive years has increasingly concentrated on a small number of controls shown to have outsized impact relative to cost:

- **Multi-factor authentication (MFA).** Most ransomware incidents begin with compromised credentials, typically via phishing or credential-stuffing using passwords leaked in unrelated breaches. MFA on all accounts — email and VPN access especially — blocks the large majority of these attacks and remains, in NCSC's own assessment, one of the highest-return, lowest-cost controls available regardless of business size.
- **The 3-2-1 backup principle.** At least 3 copies of critical data, on 2 different media types, with at least 1 copy offline. The offline requirement matters specifically because ransomware attackers who gain network access typically locate and encrypt or delete connected backups before deploying the main payload — a backup reachable from the compromised network provides little real protection.
- **Prompt patching.** Known, unpatched vulnerabilities remain the most common initial access point cited across incident response case studies; NCSC guidance recommends a 48-hour patch window for critical vulnerabilities.
- **Phishing awareness training.** Regular, realistic simulated phishing exercises measurably improve employee detection rates, according to NCSC-cited research on security awareness training effectiveness.

## What it means for you (UK small and medium businesses)

If your business has no dedicated IT security function — the position most micro-businesses and sole traders are in — the practical priority order based on cost-to-impact ratio is MFA first (largely free to enable on most modern business email and cloud platforms), followed by verifying your backup strategy genuinely includes an offline or otherwise network-isolated copy, since this is the single control most likely to determine whether a successful attack is a costly inconvenience or an existential threat to the business. For businesses handling customer payment data or operating in regulated sectors, the NCSC's [Cyber Essentials certification scheme](/technology/cybersecurity-basics-home-workers-2026) provides a structured, relatively low-cost route to formalising these controls, and is increasingly required by larger clients and insurers as a condition of doing business.

Cyber insurance has also become a more demanding, rather than simply available, layer of protection over the past several years. Insurers increasingly require evidence of specific controls — MFA, tested offline backups, endpoint detection tooling — before offering cover at all, and several have introduced coinsurance clauses or reduced payouts where a policyholder is found not to have implemented controls they attested to having in place. This shift means cyber insurance is now better understood as a complement to genuine technical controls rather than a substitute for them, since insurers themselves are increasingly unwilling to underwrite risk for businesses that have not done the basic groundwork described above. Some insurers now conduct their own pre-policy technical audits, effectively outsourcing a meaningful share of small business cybersecurity assessment work that many companies would otherwise never commission independently.

## What to watch next

Watch DSIT's next annual Cyber Security Breaches Survey release for whether the roughly 50% breach-identification rate among UK businesses continues, falls as defensive measures scale, or rises further as detection capability improves industry-wide — a rising figure would not necessarily mean attacks are increasing, given the survey's own acknowledgement that improved detection can itself drive reported numbers up. Also watch whether ransomware-as-a-service — the criminal ecosystem that lets relatively unsophisticated attackers rent ransomware tools and infrastructure from more capable developers — continues lowering the technical barrier to launching attacks, a trend the NCSC has flagged as a key driver of ransomware's persistence despite improving defensive awareness. For the specific entry-point risk that precedes most ransomware incidents, see our guide on [how to spot phishing emails](/technology/how-to-spot-phishing-emails).

## Frequently asked questions

### How common are cyber attacks against UK businesses, really?

DSIT's annual Cyber Security Breaches Survey — the UK government's official tracking survey — has repeatedly found roughly half of UK businesses reporting identifying a breach or attack in the preceding 12 months, though the proportion actually experiencing a costly or disruptive incident is smaller. Medium and large businesses report breaches at notably higher rates than micro-businesses and sole traders, a pattern the survey attributes partly to larger firms having better detection and monitoring capability to actually identify an attack, rather than necessarily facing more attempted attacks.

### Should a business ever pay a ransomware demand?

The UK's National Cyber Security Centre (NCSC) consistently advises against paying. Payment does not guarantee the attacker will actually provide a working decryption key or delete stolen data as promised, and payments directly fund further criminal ransomware development and future attacks against other victims. Organisations that do pay are also more likely to be targeted again, since payment signals a willingness to pay to future attackers who track which victims previously complied.

### What is the NCSC's actual recommended backup strategy?

The NCSC recommends the '3-2-1' principle: at least 3 copies of critical data, stored on 2 different types of media, with at least 1 copy kept offline or otherwise isolated from the main network. The offline element is essential specifically against ransomware, since attackers that gain network access will typically seek out and encrypt or delete connected backups before deploying the main ransomware payload, defeating backups that are reachable from the compromised network.

### Is multi-factor authentication really that effective against ransomware specifically?

Yes — most ransomware incidents begin with compromised credentials, typically obtained through phishing or credential-stuffing attacks using passwords leaked from unrelated data breaches. The NCSC and equivalent bodies including the US CISA consistently cite MFA as blocking the large majority of these credential-based attacks, making it one of the highest-return, lowest-cost controls available to businesses of any size, including sole traders with no dedicated IT security function.

## Sources

- [National Cyber Security Centre — ransomware guidance](https://www.ncsc.gov.uk/collection/ransomware)
- [Department for Science, Innovation and Technology — Cyber Security Breaches Survey](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025)
- [NCSC — 3-2-1 backup strategy guidance](https://www.ncsc.gov.uk/collection/small-business-guide/backing-up-your-data)

---
Daily Junction — https://dailyjunction.co.uk/technology/protect-business-from-ransomware-2025