Before ransomware strikes: Why proactive defence is critical for UK businesses

In a recent CRN webinar, experts from Huntress explain why businesses must move beyond reactive security and adopt proactive, people-focused strategies to stay protected

Ransomware now moves in minutes, not days, and when clients get hit, MSPs feel the fallout. With SMEs firmly in attackers’ sights, it’s no longer a question of if, but when.

In a recent webinar hosted by CRN, experts from Huntress, Dray Agha, senior manager, tactical response and Christopher Rodipe, security operations analyst warned that ransomware is evolving rapidly, and businesses must act before an attack occurs.

One of the biggest changes is speed. While attackers are still “breaking in in the same ways they did five years ago,” the pace has accelerated dramatically.

As Agha explained to viewers, ransomware should no longer be measured in days or weeks, but “spoken about in minutes.”

In some cases, attackers can move from initial access to domain-wide activity in under half an hour, turning incidents into fast-moving “smash and grab” operations.

At the same time, the nature of ransomware itself is shifting. Rather than simply locking systems, attackers increasingly focus on data theft and extortion.

They are “not trying to disable your computer so they stop working,” but instead aim to “inconvenience you, steal your data so that you pay.” This evolution makes attacks both more subtle and more dangerous.

Despite high-profile breaches dominating headlines, many organisations still underestimate the risk. A key misconception is that only large enterprises are targeted. In reality, “this happens to any organisation,” from small businesses to hospitals.

The Huntress duo highlighted that cybercriminals are opportunistic, often exploiting weak points such as third-party suppliers or misconfigured systems.

Even organisations with strong security can fall victim. As Rodipe noted, companies may “do everything right… and then something unexpected happens,” such as a vulnerability in a widely used device or service. This underscores the growing importance of understanding supply chain risk and maintaining full visibility over IT environments.

The webinar also addressed the limitations of traditional antivirus. While it remains a valuable first line of defence, it “can only do what it’s designed to do,” and attackers can eventually bypass or disable it.

Without active monitoring, businesses may not even realise they have been compromised. This is why endpoint detection and response (EDR) is increasingly essential, providing deeper visibility and enabling faster intervention.

However, technology alone is not enough. A strong security culture is critical.

Many attacks rely on human behaviour, particularly phishing and social engineering. Encouragingly, Agha emphasised that “a security aware workforce will repudiate 80 per cent of threats.” Rather than blaming employees, organisations should foster engagement and awareness across all teams.

For MSPs, shifting customer mindset is a major challenge. Too many organisations still adopt a “we’ll deal with it when it happens” approach. But ransomware can be devastating: “50 per cent of all small businesses that have a cybersecurity event will shut and never reopen their doors.” As a result, security must be positioned as essential, not optional.

In terms of practical steps, the advice was clear. Implementing multi-factor authentication is one of the most effective controls, with experts stressing that it can “remove a class of threat actor” entirely. Alongside this, organisations should focus on asset visibility, access control, and layered security.

Finally, while AI is increasing the speed and scale of attacks, it is not fundamentally changing attacker behaviour. Threat actors are “still using the same trade craft,” just faster.

The takeaway is simple: businesses should focus on getting the basics right.

Ultimately, ransomware is a business risk as much as a technical one. As both Agha and Rodipe concluded, success depends on combining strong technology with a proactive, organisation-wide security culture—before ransomware strikes.