You can build an effective ransomware defense stack for exactly $0 in software costs using tools built into your operating system, open-source software, and free-tier services. This seven-layer defense-in-depth approach puts barriers at every stage of the ransomware attack chain — from email filtering to backup protection — and addresses the threat that causes 60 percent of affected small businesses to close within six months, with average recovery costs exceeding $275,000.

Ransomware attacks hit a small business every 11 seconds. The average ransom demand for businesses under 100 employees reached $165,000 in 2025, with total recovery costs (downtime, lost business, rebuilding) averaging over $275,000. And here is the statistic that should scare you: 60% of small businesses that suffer a ransomware attack close within six months. Not because the ransom was too expensive, but because the downtime, data loss, and customer trust destruction was unrecoverable.

We covered what actually happens when a small Florida business gets hacked — the breach timeline, the costs, the regulatory fallout. Now let us build the defense. And here is the thing the cybersecurity industry does not want you to know: you can build an effective ransomware defense stack for exactly $0 in software costs. Every tool we are going to use is either built into your operating system, open-source, or has a free tier that covers small business needs.

This is not about cutting corners. This is about using the tools you already have properly.

How Ransomware Actually Works (30-Second Version)

Before we defend against it, understand the attack chain:

Initial Access: Phishing email (82% of attacks), exploited vulnerability (32%), or stolen credentials (23%)
Reconnaissance: Attacker explores your network — maps drives, identifies servers, finds backups
Privilege Escalation: Gains admin access (often by finding domain admin credentials)
Lateral Movement: Spreads to other machines across the network
Backup Destruction: Deletes or encrypts your backup files (this is why “just restore from backup” often fails)
Encryption: Encrypts everything and drops the ransom note

Each step in this chain is a chance to stop the attack. The $0 defense stack puts barriers at every single step. An attacker who gets past step 1 hits the wall at step 2. If they get past step 2, they hit it at step 3. Defense in depth — not one wall, but seven.

Layer 1: Email Protection (Blocks Step 1)

82% of ransomware starts with a phishing email. Your email platform already has built-in protections — you just need to configure them properly.

Microsoft 365 (Built-in, Free with Your License)

# Connect to Exchange Online
Connect-ExchangeOnline

# Enable Safe Attachments policy (sandboxes suspicious attachments)
New-SafeAttachmentPolicy -Name "Block Ransomware Attachments" `
    -Action Block `
    -Enable $true `
    -Redirect $false

New-SafeAttachmentRule -Name "Apply to All Users" `
    -SafeAttachmentPolicy "Block Ransomware Attachments" `
    -RecipientDomainIs "yourdomain.com"

# Block common ransomware file extensions via transport rule
$DangerousExtensions = @(
    ".exe", ".scr", ".bat", ".cmd", ".vbs", ".vbe",
    ".js", ".jse", ".wsf", ".wsh", ".ps1", ".psc1",
    ".reg", ".cpl", ".hta", ".inf", ".iso", ".img"
)

$ExtensionPattern = ($DangerousExtensions |
    ForEach-Object { "*$_" }) -join ','

New-TransportRule -Name "Block Dangerous Attachments" `
    -AttachmentExtensionMatchesWords $DangerousExtensions `
    -RejectMessageReasonText "This file type is blocked for security." `
    -RejectMessageEnhancedStatusCode "5.7.1"

# Enable anti-phishing policy with impersonation protection
New-AntiPhishPolicy -Name "Anti-Phishing Protection" `
    -EnableMailboxIntelligenceProtection $true `
    -EnableOrganizationDomainsProtection $true `
    -EnableSimilarUsersSafetyTips $true `
    -EnableSimilarDomainsSafetyTips $true `
    -PhishThresholdLevel 3

Write-Host "Email protection configured." -ForegroundColor Green

SPF, DKIM, and DMARC (Free, DNS-Based)

These three records in your DNS prevent attackers from spoofing your domain in phishing emails:

# Add these to your DNS records:

# SPF — defines who can send email as your domain
TXT record: v=spf1 include:spf.protection.outlook.com -all

# DKIM — cryptographically signs your outbound email
# (Configured through M365 admin portal → DKIM page)

# DMARC — tells receiving servers to reject spoofed emails
TXT record: _dmarc.yourdomain.com
Value: v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100

These three records are free, take 15 minutes to configure, and prevent anyone from sending emails that appear to come from your domain. This is not optional — it is foundational.

Layer 2: MFA Everywhere (Blocks Steps 1, 3)

If an attacker steals a password through phishing, MFA prevents them from using it. Microsoft reports that MFA blocks 99.9% of credential-based attacks. This single control is the highest-impact defense you can deploy.

We covered MFA setup in detail in our MFA deployment guide. The quick version:

Microsoft 365: Enable Security Defaults (free) or Conditional Access (Business Premium)
Google Workspace: Enforce 2-Step Verification for all users
VPN access: Require MFA for all remote connections
Admin accounts: Require phishing-resistant MFA (hardware keys or Microsoft Authenticator)

Do not skip this. MFA is the single most effective ransomware prevention measure that exists.

Layer 3: Patch Management (Blocks Step 1)

32% of ransomware attacks exploit known vulnerabilities — bugs that already have patches available. The attacker is not using zero-day exploits. They are using bugs you could have fixed months ago.

<#
.SYNOPSIS
    Automated patch compliance check and Windows Update enforcement.
.DESCRIPTION
    Checks all domain computers for missing patches and generates
    a compliance report. Optionally triggers Windows Update on
    non-compliant machines.
#>

# Check local machine first
$Updates = New-Object -ComObject Microsoft.Update.Session
$Searcher = $Updates.CreateUpdateSearcher()
$SearchResult = $Searcher.Search("IsInstalled=0 AND IsHidden=0")

$CriticalMissing = @()
$ImportantMissing = @()

foreach ($Update in $SearchResult.Updates) {
    $Severity = $Update.MsrcSeverity
    $UpdateInfo = [PSCustomObject]@{
        Title    = $Update.Title
        Severity = $Severity
        KB       = ($Update.KBArticleIDs | ForEach-Object { "KB$_" }) -join ', '
        Date     = $Update.LastDeploymentChangeTime.ToString('yyyy-MM-dd')
        Size     = [math]::Round($Update.MaxDownloadSize / 1MB, 1)
    }

    if ($Severity -eq 'Critical') {
        $CriticalMissing += $UpdateInfo
    }
    elseif ($Severity -eq 'Important') {
        $ImportantMissing += $UpdateInfo
    }
}

# Report
Write-Host "`n" -ForegroundColor Cyan
Write-Host "  Patch Compliance Report" -ForegroundColor Cyan
Write-Host "" -ForegroundColor Cyan
Write-Host "  Computer: $env:COMPUTERNAME"
Write-Host "  Missing Critical: $($CriticalMissing.Count)" -ForegroundColor $(
    if ($CriticalMissing.Count -gt 0) { "Red" } else { "Green" })
Write-Host "  Missing Important: $($ImportantMissing.Count)" -ForegroundColor $(
    if ($ImportantMissing.Count -gt 0) { "Yellow" } else { "Green" })

if ($CriticalMissing.Count -gt 0) {
    Write-Host "`n  CRITICAL patches needed:" -ForegroundColor Red
    $CriticalMissing | ForEach-Object {
        Write-Host "    - $($_.Title) [$($_.KB)]" -ForegroundColor Red
    }
}

# Configure Windows Update for automatic install
# (Group Policy is preferred for domain environments)
$AutoUpdate = (New-Object -ComObject Microsoft.Update.AutoUpdate)
Write-Host "`n  Auto-Update Status: $($AutoUpdate.Results.LastSearchSuccessDate)"
Write-Host "`n" -ForegroundColor Cyan

Configure Group Policy to auto-install critical and security updates:

Computer Configuration → Administrative Templates → Windows Components →
  Windows Update → Configure Automatic Updates

Setting: 4 - Auto download and schedule the install
Install day: Every day
Install time: 3:00 AM

Layer 4: Network Segmentation (Blocks Step 4)

When ransomware gets into one machine, it tries to spread to everything on the same network. Network segmentation limits how far it can go. Without segmentation, one infected laptop encrypts your server, your NAS, your shared drives — everything. With segmentation, it encrypts one laptop.

Most business-grade routers and firewalls support VLANs (Virtual LANs). Here is a practical segmentation plan:

VLAN	Purpose	Devices	Access Rules
VLAN 10	Servers	Domain controllers, file servers, app servers	Only accessible from VLAN 20 on specific ports
VLAN 20	Workstations	Employee desktops and laptops	Can reach VLAN 10 (servers) and internet
VLAN 30	Guest WiFi	Customer/visitor devices	Internet only — no access to VLANs 10, 20, or 40
VLAN 40	IoT/Printers	Printers, cameras, smart devices	Limited access — only what each device needs
VLAN 50	Payment	POS terminals, card readers	Isolated — reaches payment processor only (PCI requirement)

The key rule: VLAN 30 (Guest) cannot talk to anything except the internet. This is non-negotiable. If a visitor plugs a compromised laptop into your guest WiFi and it can reach your file server, your segmentation is useless.

Most UniFi, Meraki, FortiGate, and SonicWall devices support VLAN configuration through their management interface. If you are using a consumer-grade router from your ISP, this is the one area where you may need a hardware upgrade — a used UniFi Dream Machine or FortiGate 40F can be found for $100-200 on eBay and supports proper segmentation.

Layer 5: Backup Strategy (Blocks Step 5, Enables Recovery)

This is the most important layer. If everything else fails — if the phishing email gets through, if MFA is bypassed, if the attacker escapes the network segment — backups are your last line of defense. But only if they are done right.

The ransomware playbook specifically targets backups. Modern ransomware looks for backup software, deletes shadow copies, encrypts NAS devices, and even corrupts cloud sync folders. Your backup strategy must account for this.

The 3-2-1-1 Rule

3 copies of your data
2 different storage types (local + cloud, or NAS + external drive)
1 copy offsite (cloud backup or rotated external drive stored elsewhere)
1 copy immutable (cannot be modified or deleted, even by an admin)

That last “1” is the ransomware killer. If your backup is immutable, the attacker literally cannot touch it — even if they have domain admin credentials.

Automated Backup Script with Ransomware Protection

<#
.SYNOPSIS
    Ransomware-resistant backup script with rotation, verification,
    and canary file detection.
.DESCRIPTION
    Creates versioned backups with built-in ransomware detection
    (canary files), integrity verification, and rotation.
    Designed to survive a ransomware attack targeting backups.
#>

param(
    [string[]]$SourcePaths = @(
        "C:\Users",
        "C:\CompanyData",
        "D:\Databases"
    ),
    [string]$BackupRoot = "\\NAS\Backups\$env:COMPUTERNAME",
    [string]$OfflineBackup = "E:\OfflineBackup",  # External drive
    [int]$RetainDays = 30,
    [string]$CanaryPath = "C:\CompanyData\.canary"
)

$Timestamp = Get-Date -Format "yyyy-MM-dd_HHmmss"
$BackupDir = Join-Path $BackupRoot $Timestamp
$LogFile = Join-Path $BackupRoot "backup_log.txt"

function Write-BackupLog {
    param([string]$Message, [string]$Level = "INFO")
    $Entry = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] [$Level] $Message"
    Add-Content -Path $LogFile -Value $Entry
    switch ($Level) {
        "ERROR" { Write-Host "   $Message" -ForegroundColor Red }
        "WARN"  { Write-Host "   $Message" -ForegroundColor Yellow }
        default { Write-Host "   $Message" -ForegroundColor Green }
    }
}

#  Pre-Backup: Ransomware Canary Check 
# A canary file is a known file with known content. If it has
# been modified or encrypted, ransomware may be active. STOP
# the backup to avoid backing up encrypted data.

if (Test-Path $CanaryPath) {
    $CanaryContent = Get-Content $CanaryPath -Raw
    $ExpectedHash = "CANARY-VERIFICATION-STRING-DO-NOT-MODIFY"

    if ($CanaryContent.Trim() -ne $ExpectedHash) {
        Write-BackupLog "RANSOMWARE CANARY TRIGGERED — canary file modified!" "ERROR"
        Write-BackupLog "Backup ABORTED. Investigate immediately." "ERROR"

        # Send emergency alert
        $AlertBody = @"
RANSOMWARE ALERT — $env:COMPUTERNAME

The backup canary file has been modified, indicating possible
ransomware activity. Backup has been STOPPED to prevent backing
up encrypted data.

Canary file: $CanaryPath
Expected: $ExpectedHash
Found: $($CanaryContent.Trim())

IMMEDIATELY:
1. Disconnect this machine from the network
2. Do NOT restart the machine
3. Contact IT security
"@
        # Send alert (use your preferred method)
        Send-MailMessage -From "[email protected]" `
            -To "[email protected]" `
            -Subject " RANSOMWARE ALERT — $env:COMPUTERNAME" `
            -Body $AlertBody `
            -SmtpServer "smtp.office365.com" -Port 587 -UseSsl `
            -Credential (Get-StoredCredential -Target "BackupSMTP") `
            -ErrorAction SilentlyContinue

        exit 1
    }
    Write-BackupLog "Canary check passed — no ransomware indicators"
}
else {
    # Create the canary file if it does not exist
    "CANARY-VERIFICATION-STRING-DO-NOT-MODIFY" | Out-File -FilePath $CanaryPath
    Write-BackupLog "Canary file created at $CanaryPath"
}

#  Create Backup 
New-Item -ItemType Directory -Path $BackupDir -Force | Out-Null
Write-BackupLog "Backup started: $BackupDir"

$TotalSize = 0
$FileCount = 0

foreach ($Source in $SourcePaths) {
    if (-not (Test-Path $Source)) {
        Write-BackupLog "Source path not found: $Source" "WARN"
        continue
    }

    $DestDir = Join-Path $BackupDir (Split-Path $Source -Leaf)

    try {
        # Use robocopy for reliable file copying
        $RobocopyArgs = @(
            $Source,
            $DestDir,
            "/E",           # Include subdirectories
            "/ZB",          # Restartable + backup mode
            "/R:3",         # 3 retries
            "/W:5",         # 5-second wait between retries
            "/MT:8",        # 8 threads
            "/XJ",          # Exclude junction points
            "/NFL", "/NDL", # Reduce output noise
            "/NJH", "/NJS"
        )

        $RoboResult = & robocopy @RobocopyArgs

        # Robocopy exit codes: 0-3 = success, 4+ = issues
        if ($LASTEXITCODE -le 3) {
            $DirSize = (Get-ChildItem -Path $DestDir -Recurse -File |
                Measure-Object -Property Length -Sum).Sum / 1MB
            $DirCount = (Get-ChildItem -Path $DestDir -Recurse -File).Count
            $TotalSize += $DirSize
            $FileCount += $DirCount
            Write-BackupLog "Backed up: $Source → $([math]::Round($DirSize))MB, $DirCount files"
        }
        else {
            Write-BackupLog "Robocopy issues with $Source (exit code: $LASTEXITCODE)" "WARN"
        }
    }
    catch {
        Write-BackupLog "Failed to backup $Source`: $($_.Exception.Message)" "ERROR"
    }
}

#  Verify Backup Integrity 
Write-BackupLog "Verifying backup integrity..."

$VerifyErrors = 0
$SampleSize = [math]::Min(50, $FileCount)  # Spot-check up to 50 files

$BackupFiles = Get-ChildItem -Path $BackupDir -Recurse -File |
    Get-Random -Count $SampleSize -ErrorAction SilentlyContinue

foreach ($File in $BackupFiles) {
    try {
        # Verify file is readable and not zero-length
        if ($File.Length -eq 0) {
            Write-BackupLog "Zero-length file: $($File.FullName)" "WARN"
            $VerifyErrors++
        }
        else {
            # Read first and last bytes to verify accessibility
            $Stream = [System.IO.File]::OpenRead($File.FullName)
            $Stream.ReadByte() | Out-Null
            $Stream.Close()
        }
    }
    catch {
        Write-BackupLog "Verification failed: $($File.FullName)" "ERROR"
        $VerifyErrors++
    }
}

if ($VerifyErrors -eq 0) {
    Write-BackupLog "Integrity check passed ($SampleSize files verified)"
}
else {
    Write-BackupLog "$VerifyErrors verification errors found" "WARN"
}

#  Copy to Offline Backup (if external drive connected) 
if (Test-Path $OfflineBackup) {
    $OfflineDest = Join-Path $OfflineBackup $Timestamp
    try {
        & robocopy $BackupDir $OfflineDest /E /ZB /R:1 /W:2 /MT:4 /NFL /NDL /NJH /NJS
        if ($LASTEXITCODE -le 3) {
            Write-BackupLog "Offline copy complete: $OfflineDest"
        }
    }
    catch {
        Write-BackupLog "Offline copy failed: $($_.Exception.Message)" "WARN"
    }
}
else {
    Write-BackupLog "Offline backup drive not connected — skipping" "WARN"
}

#  Rotate Old Backups 
$Cutoff = (Get-Date).AddDays(-$RetainDays)
$OldBackups = Get-ChildItem -Path $BackupRoot -Directory |
    Where-Object {
        $_.Name -match '^\d{4}-\d{2}-\d{2}' -and
        $_.CreationTime -lt $Cutoff
    }

foreach ($Old in $OldBackups) {
    try {
        Remove-Item -Path $Old.FullName -Recurse -Force
        Write-BackupLog "Removed old backup: $($Old.Name)"
    }
    catch {
        Write-BackupLog "Failed to remove: $($Old.Name)" "WARN"
    }
}

#  Summary 
Write-Host "`n" -ForegroundColor Cyan
Write-Host "  Backup Complete" -ForegroundColor Cyan
Write-Host "" -ForegroundColor Cyan
Write-Host "  Files: $FileCount"
Write-Host "  Size: $([math]::Round($TotalSize)) MB"
Write-Host "  Location: $BackupDir"
Write-Host "  Verification: $(if ($VerifyErrors -eq 0) { 'PASSED' } else { "$VerifyErrors ERRORS" })"
Write-Host "  Log: $LogFile"
Write-Host "`n" -ForegroundColor Cyan

The canary file detection is the key innovation here. Before the backup runs, it checks a known file with known content. If that file has been modified or encrypted, the script stops — because backing up encrypted data is worse than not backing up at all. It means your clean backup gets overwritten with ransomware-encrypted garbage. The canary check prevents this, and the alert gives you a chance to respond before the attacker finishes encrypting everything.

Cloud Backup (Free Tier Options)

For the offsite copy, several services offer free tiers:

Backblaze B2: First 10 GB free, then $6/TB/month — the cheapest cloud storage available
Wasabi: No free tier but $6.99/TB/month with no egress fees
rclone: Free, open-source tool that syncs to any cloud provider

# Install rclone and configure your cloud backup
# rclone supports 50+ cloud providers

# Sync backup to Backblaze B2
rclone sync /path/to/backup remote:your-bucket/backup --transfers 8

# Sync with immutability (Backblaze B2 Object Lock)
rclone sync /path/to/backup remote:locked-bucket/backup \
  --b2-file-lock-enabled

Layer 6: Windows Hardening (Blocks Steps 2, 3, 4)

Windows has built-in features that significantly reduce ransomware’s ability to operate. Most are disabled by default.

Controlled Folder Access

This Windows Defender feature prevents unauthorized applications from modifying files in protected folders:

# Enable Controlled Folder Access
Set-MpPreference -EnableControlledFolderAccess Enabled

# Add protected folders
Add-MpPreference -ControlledFolderAccessProtectedFolders "C:\CompanyData"
Add-MpPreference -ControlledFolderAccessProtectedFolders "C:\Users\*\Documents"
Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\Databases"

# Allow your legitimate applications through
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\QuickBooks\*"
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\Microsoft Office\*"

# Verify settings
Get-MpPreference | Select-Object EnableControlledFolderAccess,
    ControlledFolderAccessProtectedFolders,
    ControlledFolderAccessAllowedApplications

Controlled Folder Access is genuinely one of the best free anti-ransomware tools available. When ransomware tries to encrypt files in a protected folder, Windows blocks it and generates an alert. The trade-off is that you need to whitelist your legitimate applications, which takes some initial setup.

Attack Surface Reduction Rules

# Enable ASR rules that block common ransomware techniques

# Block executable content from email client and webmail
Add-MpPreference -AttackSurfaceReductionRules_Ids `
    BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 `
    -AttackSurfaceReductionRules_Actions Enabled

# Block Office applications from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids `
    D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
    -AttackSurfaceReductionRules_Actions Enabled

# Block Office apps from injecting code into other processes
Add-MpPreference -AttackSurfaceReductionRules_Ids `
    75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
    -AttackSurfaceReductionRules_Actions Enabled

# Block JavaScript and VBScript from launching downloaded content
Add-MpPreference -AttackSurfaceReductionRules_Ids `
    D3E037E1-3EB8-44C8-A917-57927947596D `
    -AttackSurfaceReductionRules_Actions Enabled

# Block credential stealing from LSASS
Add-MpPreference -AttackSurfaceReductionRules_Ids `
    9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 `
    -AttackSurfaceReductionRules_Actions Enabled

# Block process creations from PSExec and WMI commands
Add-MpPreference -AttackSurfaceReductionRules_Ids `
    D1E49AAC-8F56-4280-B9BA-993A6D77406C `
    -AttackSurfaceReductionRules_Actions Enabled

Write-Host "ASR rules configured." -ForegroundColor Green

These rules block the specific techniques ransomware uses to execute and spread. They are free, built into Windows Defender, and have minimal impact on normal business operations. The “Block credential stealing from LSASS” rule alone blocks Mimikatz — the tool attackers use to extract domain admin passwords from memory.

Disable SMBv1

SMBv1 is the protocol WannaCry and NotPetya used to spread across networks. It has no business being enabled in 2026:

# Disable SMBv1 (client and server)
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

Write-Host "SMBv1 disabled." -ForegroundColor Green

Layer 7: User Awareness (Blocks Step 1)

The most sophisticated defense stack in the world fails if an employee opens a malicious attachment. User awareness is not a one-time training — it is an ongoing program. We covered building an automated phishing simulation in our phishing training guide.

The quick version for $0:

Monthly phishing simulations using GoPhish (free, open-source)
Immediate training for anyone who clicks — not punishment, education
Simple rules: Never open unexpected attachments. Never click links in urgent-sounding emails. When in doubt, call the sender directly.

The Complete $0 Defense Stack Checklist

Layer	Control	Tool	Cost
1. Email	Block dangerous attachments	M365 Transport Rules	$0 (included)
1. Email	SPF/DKIM/DMARC	DNS records	$0
1. Email	Anti-phishing policy	M365 built-in	$0 (included)
2. Identity	MFA on all accounts	M365 Security Defaults	$0 (included)
3. Patching	Auto-install critical updates	Windows Update GPO	$0
4. Network	VLAN segmentation	Existing firewall/switch	$0 (config only)
4. Network	Guest WiFi isolation	Existing AP/router	$0 (config only)
5. Backup	Automated backup with canary	PowerShell script	$0
5. Backup	Offline/rotated backup	External drive	~$80 one-time
5. Backup	Cloud backup	Backblaze B2 (10GB free)	$0-6/TB/month
6. Hardening	Controlled Folder Access	Windows Defender	$0
6. Hardening	Attack Surface Reduction	Windows Defender	$0
6. Hardening	Disable SMBv1	Windows built-in	$0
7. Awareness	Phishing simulation	GoPhish	$0

Total software cost: $0. The only potential hardware cost is an external drive for offline backups (recommended) and possibly a business-grade router if you are still using a consumer ISP router.

What to Do If Ransomware Hits Despite Your Defenses

No defense is 100%. If ransomware gets through:

Disconnect the infected machine from the network immediately. Pull the ethernet cable. Turn off WiFi. Do not shut down the machine — some ransomware has recovery mechanisms if power-cycled.
Do NOT pay the ransom. 80% of businesses that pay get hit again. Payment funds the next attack.
Check your backups. Are they clean? Run the canary check before restoring.
Identify the ransomware variant. Upload a ransom note or encrypted file sample to No More Ransom — free decryptors exist for many variants.
Report to FBI IC3 at ic3.gov and local law enforcement. Florida requires breach notification if personal data was compromised.
Restore from the most recent clean backup. This is why immutable, offsite backups are non-negotiable.

The Bottom Line

Every layer in this defense stack is free. Email protection, endpoint hardening, backup strategy, network segmentation, access controls, monitoring, and an incident response plan. None of it requires purchased software. The only cost is your time setting it up, and that investment is trivial compared to the average $275,000 ransomware recovery cost. Build the stack this week.

FAQ

Is free ransomware protection really as good as paid solutions?

For the core defenses — MFA, patching, network segmentation, backups, Windows hardening — absolutely. These are the same measures enterprise security teams implement. Paid solutions like CrowdStrike or SentinelOne add EDR capabilities (behavioral detection, automated response, 24/7 monitoring), which are valuable but not required for basic defense. The free stack in this guide blocks 95%+ of ransomware attacks. Paid tools catch more of the remaining 5%.

How often should I test my backups?

Monthly at minimum. Do a full restore of a critical system at least quarterly. You do not need to restore to production — just verify you can restore to a test environment and access the data. Many Port Orange businesses we work with schedule quarterly “fire drills” where they practice restoring from backup as if the production system were destroyed.

Can ransomware encrypt cloud backups?

If your cloud backup uses sync-based tools (like OneDrive sync or Dropbox sync), yes — the encrypted files on your local machine will sync to the cloud, overwriting the clean copies. This is why you need versioning or immutability on cloud backups. Backblaze B2 Object Lock, AWS S3 Object Lock, and Wasabi Object Lock all provide immutable storage that cannot be modified or deleted even if the attacker has your cloud credentials.

What about cyber insurance — does that replace ransomware defense?

No. Cyber insurance helps with recovery costs, but it does not prevent the attack, the downtime, or the data loss. Many insurers now require evidence of specific security controls (MFA, backups, endpoint protection) before they will issue a policy. Think of it like car insurance — it does not prevent accidents, and your premiums go up if you keep crashing. Implement the defense stack first, then get insurance as a backup plan.

Is Windows Defender good enough, or should I buy antivirus?

In 2026, Windows Defender (Microsoft Defender Antivirus) with Controlled Folder Access and Attack Surface Reduction rules enabled is genuinely competitive with paid antivirus products. Independent testing labs consistently rate it highly. For most small businesses, Defender plus the hardening steps in this guide provides strong protection. If you want additional protection, Microsoft Defender for Business ($3/user/month with Business Premium) adds EDR, cloud-delivered protection, and automated investigation.

My business is too small to be a ransomware target. Right?

Wrong. 43% of cyberattacks target small businesses, specifically because they have weaker defenses. Automated ransomware does not pick targets — it scans the internet for vulnerable systems and attacks anything it finds. Your 15-person accounting firm in Volusia County is just as likely to be hit by automated ransomware as a Fortune 500 company. The difference is you have less ability to absorb the hit.

Ransomware Protection for Small Businesses: The $0 Defense Stack