Why is my business being targeted by ransomware even though I am small?
Key takeaways
- Indian SMB ransomware detections rose from 3.18% to 4.07% in one year, so small Indian firms are now a measured, growing share of detections.
- The real target is often your largest customer, and you are the route in, which is why being small does not mean being unimportant to the operator.
- Exposed Remote Desktop Protocol ports on internet-facing business networks remain one of the most common initial access routes.
- Offline, immutable backups that the ransomware operator's own credentials cannot reach are the only backup type that reliably survives an attack.
- India is the second most ransomware-hit country in APAC, so Kerala businesses are in the same market as everyone else, with fewer defences.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Why are small businesses specifically targeted?
Three reasons, and none of them is about you. First, economics: the operator's tooling is automated, so the cost of attacking a thousand small firms is close to the cost of attacking one, and the probability of an unpaid ransom is high. Second, supply chain: your IT vendor, your accountant and your logistics partner all hold remote access to you, and the actual objective is frequently your largest customer, which is why your IT provider's incident becomes your customer's incident. Third, defence asymmetry: a small firm usually has no MFA, no immutable backup, no segmentation and no EDR, so the initial access that takes a security team weeks to detect takes a script a few minutes. Kerala's business ecosystem, dense with small manufacturers, exporters and service firms, sits squarely in that profile.
Which four controls actually cut the risk?
Four, in this order of payoff. First, MFA on everything reachable from the internet, including remote access, email, the finance application and the backup console, and prefer an authenticator app or a passkey over SMS. Second, offline immutable backups, on storage the ransomware operator's own credentials cannot reach, with a documented restore test each quarter, because a backup you have not restored from is an assumption. Third, network segmentation, so the workstation in the accounts department cannot reach the file server and the factory network cannot reach the office network. Fourth, brokered remote access with MFA, so a supplier connects through a brokered VPN with per-user credentials and session recording, never through an exposed RDP port with a shared password.
What should I do in the first month?
Six concrete steps, none of which requires a large budget. Close every internet-facing RDP port, and put remote access behind a brokered VPN with MFA for the two or three suppliers who need it. Turn on MFA, starting with email, the bank, remote access and the backup console, because those four unlock everything else. Confirm that backups are offline and immutable, and run one test restore of a folder of business-critical files, timed. Install endpoint protection with a managed console on every machine, including the machines used by staff who work from home. Document your critical business processes on paper, so a payroll run or a customer order can be worked manually for a week. And write the one-page incident card: who to call, in what order, and the CERT-In six-hour obligation.
Should a small business buy cyber insurance?
Consider it once the four controls above are in place, because underwriters assess them, and an application with no MFA, no tested backups and no incident plan will be priced accordingly or declined. For an Indian business, the questions to ask are whether ransomware and business interruption are covered, whether a policy condition requires a third-party notification, and whether the excess is affordable. A mature posture with documented backups and continuity plans can reduce premiums by 20% to 30%. And if you buy it, align the policy notification window with CERT-In's six-hour reporting obligation, because a late insurer notification is a common reason claims are contested.
| Control | Why it matters | Rough effort |
|---|---|---|
| MFA on email, bank, remote access and backup console | Removes the credential-only path most attacks use | Low, 1-2 days |
| Offline immutable backups with a quarterly restore test | Survives deletion of shadow copies and encryption | Medium, one week |
| Network segmentation of office, accounts and production | Limits the blast radius of one infected workstation | Medium, 1-2 weeks |
| Brokered remote access with MFA, no exposed RDP | Closes the most common initial access route | Low to medium |
| Managed endpoint protection on every device | Cuts dwell time, which is what drives the loss | Low, one week |
| Documented incident card and CERT-In 6-hour plan | Turns a panic into a compliant response | Low, half a day |
What are the frequently asked questions?
Get a straight answer on this
Send us your number of users, your internet-facing systems and your supplier access list, and we will return a fixed-price small-business ransomware readiness review.
Send us the details See pricing