How do small Indian businesses prevent ransomware?
Key takeaways
- MFA on email, banking, cloud and remote access is the single highest-value prevention control for a small Indian business.
- Exposed remote access, such as RDP on the public internet, remains one of the most common ransomware entry points in Indian SMEs.
- Backups must be offline or immutable and restore-tested; a backup stored on the same network with the same credentials is not a backup.
- A formal 180-day log retention policy, as CERT-In directs, shortens both breach discovery and the later forensic timeline.
- Email remains the most common entry vector in Indian business ransomware, with malicious attachments and fake invoice or GST notices recurring.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Which entry points actually matter for small businesses?
Four, and they are consistent across Indian SME incidents. First, exposed remote access: RDP or similar protocols published to the internet, often with a reused password, which is how many small factories, clinics and trading firms are entered. Second, credential reuse and stolen passwords, usually delivered by phishing, which is why MFA on email matters more than anything else, because email is the reset point for every other account. Third, unpatched internet-facing services, where an unpatched VPN appliance, file transfer tool or web application is exploited within days of a public exploit. Fourth, third-party access, a vendor or an outsourced accountant with remote access to the file server, which is rarely reviewed. Close the first two and you remove the majority of realistic paths.
How do I set up backups that survive ransomware?
Three properties, and you need all three. Offline or immutable: the copy must not be writable by the same credentials that the attacker would steal, so a separate cloud account with versioning locked, a write-once storage bucket, or a physical disk stored away from the site. Tested: restore a sample every quarter and check it, because a backup that has never been restored is an assumption. Offsite: ransomware on a compromised host can reach network shares and synced folders, so a copy on the same LAN is not a backup. One practical Indian SME pattern is a nightly snapshot to a separate cloud account, weekly copy to a locked-down storage bucket, and a monthly offline disk in a different building. Record the restore date and the result in a log, because that log is what you will need after an incident.
What about patching, endpoint protection and segmentation?
Patching is a schedule, not an event. Agree a weekly window for internet-facing systems and a monthly one for everything else, with a named owner and a rule that anything with a public exploit is patched within 72 hours. Endpoint protection matters, but on a ten-person business a managed endpoint service with centralised alerts is usually cheaper and more effective than individually bought antivirus. Segmentation is the one that pays off most in a small office: put the file server, the accounting system and the backup server on a separate network or VLAN, require the backup server to accept connections only from the admin account, and make sure the point-of-sale or guest devices cannot reach the finance machine. An infected workstation should be an annoyance, not the end of the business.
What is the cheapest prevention plan for a 5 to 20 person Indian business?
A weekly checklist with four items and a monthly one with two. Weekly: confirm MFA is on for email, banking and cloud; check that no remote access service is exposed beyond what is needed; verify the backup job succeeded and the copy landed offsite; and read the finance folder for invoice or GST-themed lures. Monthly: restore a sample from backup, and review who holds administrator rights. Then add the two things that cost money but change the odds: a managed endpoint service at roughly Rs 200 to Rs 500 per endpoint per month, and a monthly incident-response retainer at Rs 10,000 to Rs 25,000, so that when something does happen you have a number to call instead of a search to run.
| Control | Practical action | Cost profile |
|---|---|---|
| Multi-factor authentication | Enforce on email, banking, cloud, remote access | Free to Rs 500 per user per month |
| Patching | Weekly window for internet-facing, 72 hours for public exploits | Engineer or vendor time |
| Offline, tested backups | Separate account, locked versioning, quarterly restore test | Rs 500 - Rs 5,000 per month |
| Network segmentation | File server and finance on a separate VLAN | Rs 5,000 - Rs 40,000 one-off for a small office |
| Email hygiene and training | Attachment filtering, invoice-request verification rule | Rs 100 - Rs 300 per user per month |
| Incident retainer | Monthly access to a named responder | Rs 10,000 - Rs 25,000 per month |
What are the frequently asked questions?
Get a straight answer on this
Book a ransomware readiness check for your office network and backups, and we will give you a ranked list of what to fix first.
Send us the details See pricing