Ransomware protection services: what they actually involve
Ransomware locks or encrypts your files, and increasingly comes with data extortion on top, where criminals threaten to publish what they stole. No single product stops it, because it gets in through phishing emails, compromised accounts and unsafe downloads all at once. A proper service runs three layers: prevention, detection and recovery, each with someone actually responsible for it.
Last updated
The short answer
Ransomware protection is a managed set of controls that stop ransomware getting in, limit the damage if it does, and get you running again from clean backups. For a small business, clinic, factory or venue, the practical answer is one provider running the defences, watching for trouble and testing recovery regularly, because those jobs fail when nobody owns them.
The three layers that matter
Prevention
Patching, multi-factor authentication, email filtering, endpoint security, and limits on who can install software or change settings.
Detection
Someone watching for odd behaviour, like a login at 3am or thousands of files being renamed, so an attack is caught before it spreads.
Recovery
Backups kept apart from your live systems, restore tests that prove they work, and a plan for who does what in the first hour.
Restricted admin access
Only a handful of people can change systems. The common failure is everyone in the office running as a local administrator.
Backups with restore tests
A backup running every night means little if nobody has ever restored from it. The useful question is when you last recovered a file and how long it took.
A written response plan
Backups, contacts and first-hour steps written down in advance, not worked out for the first time during an actual incident.
Who this guide is for
- Business owners comparing ransomware protection or managed cyber security quotes.
- Anyone whose current setup is a single antivirus licence and nothing else.
- Healthcare, manufacturing and hospitality businesses with sector-specific weak points.
- Businesses above the $3 million turnover threshold that need to understand the ransom-payment reporting duty.
How to choose a ransomware protection service
- Check exactly what's covered. Every computer, server, phone and cloud account, or only some of them. Get the scope in writing.
- Ask who you actually speak to. A named person who knows your business, or a ticket queue that answers in order rather than by urgency.
- Ask how recovery is handled. Where backups live, how often they run, and when they were last restored in a real test, not just confirmed as running.
- Ask for the plan on the day. A written incident plan with names and phone numbers, so the first hour isn't spent working out who to call.
- Get a baseline first. An IT Health Check shows where your systems stand before you commit to anything ongoing.
How WaTo can help
- We run managed cyber security as an ongoing service, so prevention, detection and recovery all have a named owner instead of sitting between vendors.
- Backup and disaster recovery is where we set your recovery time objective and keep it under review, so the first restore test isn't the day you need it.
- Security monitoring and alerts mean the early signs of an attack, like new admin accounts or deleted backup jobs, get reviewed by someone who knows your environment.
- Our email security and anti-phishing and Microsoft 365 security hardening cover where most attacks actually start.
- For manufacturers and multi-site venues, our firewall, VPN and network security work separates the office network from machinery or point-of-sale systems.
Frequently asked questions
Is antivirus enough to protect my business from ransomware?
No. Antivirus is one control among several the ACSC recommends, alongside updates, multi-factor authentication, restricted admin access, tested backups and staff awareness. Ransomware often arrives through phishing or a compromised account, which software alone doesn't stop.
What does ransomware protection cost?
Our Managed Cyber Security runs $30 to $80 per user per month, depending on what your business needs. Managed IT Services, which covers broader support, runs $80 to $200 per user per month. An IT Health Check starts from $990 as a one-off.
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of storage, with one copy kept away from your main site. Current guidance goes further than that: backups should also be tested and kept separate from your main systems so ransomware can't reach them.
Do I have to report a ransomware payment?
If your business is in Australia with a previous-year turnover above $3 million, generally yes, within 72 hours of making the payment or becoming aware it was made. The penalty for failing to report can run up to $19,800. Confirm with your accountant or lawyer whether you're a reporting business entity under the Cyber Security Act 2024.
How WaTo can help with this
Sources & references
Not sure where your gaps are?
Book an IT Health Check and we'll show you where your ransomware defences stand, in plain English, with a prioritised list to work from.
Mon to Fri, 8:30am to 5pm
