Ransomware recovery is the part nobody plans for. Businesses spend their security budget on keeping attackers out, which is right, and then discover that the question that actually decides their survival is a different one: when it happens anyway, how long until we are trading again?
The honest answer for most UK small businesses is weeks, not hours. Here is what ransomware recovery actually involves, why paying the ransom usually disappoints, and the handful of things that decide whether you are down for three days or three months.
Why ransomware recovery now matters more to small businesses
The target has moved. Small and medium-sized businesses now account for more than 60% of ransomware victims, because attackers worked out something uncomfortable: SMEs hold data worth encrypting but rarely have the monitoring, tested backups or in-house expertise of a large enterprise.
Automation did the rest. Campaigns that once needed a skilled operator per target now run across thousands of victims at once. You are not being singled out. You are being scanned.
That shift is why managed cybersecurity stopped being an enterprise concern and became a basic operating requirement for businesses of 10 to 200 people.
The NCSC’s three-stage recovery framework
In July 2026 the NCSC published guidance on recovering from highly disruptive cyber attacks, and the framing is useful because it is honest about timescales. Ransomware recovery from a serious incident is measured in weeks or months, not an afternoon.
Stage 1 — Immediate response
The first hours and days. Contain the spread, work out what has been touched, establish who is making decisions, and get control of communications. The NCSC recommends engaging a vetted incident response firm at this point rather than improvising.
The thing that goes wrong here is almost always the same: nobody knows who decides. Can you take the whole network offline? Who signs that off at 11pm on a Friday? If that answer is not already written down, you lose your first night arguing about it.
Stage 2 — Short-term recovery
Getting back to what the NCSC calls minimum viable operations — not everything, just the handful of systems the business genuinely cannot trade without. Temporary workarounds are expected and encouraged.
This is the stage where an untested backup becomes a catastrophe rather than an inconvenience. Which is why restores need testing on a schedule, not faith. Our guidance on disaster recovery and business continuity covers how to define and prove those priorities before you need them.
Stage 3 — Long-term recovery
Fixing the root cause and rebuilding properly. Restoring the same environment with the same weakness simply schedules the next incident — and reinfection from a restored backup is common, because the attacker was often inside for weeks before anything was encrypted.
An IT audit at this stage is not bureaucracy. It is what stops you paying for the same recovery twice.
Should you pay the ransom?
The NCSC and the National Crime Agency both advise against it, and the numbers support them. Roughly six in ten UK victims pay anyway, usually under enormous pressure. Of those who do, only about 65% receive a working decryption key.
So paying is a coin flip with a premium attached. And it buys less than people expect:
- A decryption key is not a restore — it is slow, often partial, and frequently corrupts data on the way through
- Paying does not delete the copy they already took, so the data-exposure problem remains
- It marks you as a payer, which materially raises your odds of being hit again
- Depending on who is behind the attack, payment can carry sanctions exposure
The businesses whose ransomware recovery succeeds without paying are rarely the ones with the biggest budgets. They are the ones whose backups were isolated and tested.
Why your backups probably will not save you
This is the single most common gap we find, and it is worth being blunt about. Most businesses that believe they are protected are not, for one of four reasons.
| The assumption | What actually happens |
|---|---|
| “We back up to a network drive” | Ransomware encrypts mapped drives too. An attacker with domain admin deletes the backups first — that is standard practice now. |
| “Microsoft backs up our 365 data” | It does not. Microsoft guarantees uptime, not recovery of your content. Retention and recycle bins are not backup. |
| “We have backups going back months” | Untested backups fail at restore more often than not, and nobody discovers this until the worst possible day. |
| “We could restore in a few hours” | Restoring the data is not restoring the business. Rebuilding domain controllers, identities and applications is the long part. |
The fix for the second row in particular is specific and cheap: proper Microsoft 365 backup. Most businesses assume this is included. It is not, and finding out during an incident is an expensive way to learn.
What decides whether recovery takes days or months
- Isolated, tested backups. Offline or immutable, so an attacker holding domain admin cannot reach them, and restored for real on a schedule.
- Knowing what happened. Without logging and monitoring you cannot tell what was accessed or when they got in — so you cannot safely declare anything clean.
- A rehearsed plan. The NCSC is emphatic that organisations should practise their response rather than just document it. A plan nobody has run is a document, not a capability.
- Identity recovery. If Active Directory or Entra ID is compromised, rebuilding trusted identity is usually the critical path — and almost nobody has tested it.
- Closing the way in. Most incidents start with a phished credential or an unpatched edge device. Security awareness training and vulnerability management address the two most common entry points directly.
What to do before it happens
None of this is exotic, and most of it is cheap relative to a single day of downtime:
- Get Cyber Essentials certified — the five controls map onto the entry points attackers actually use
- Turn on MFA everywhere, not just for admins
- Make sure something is watching out of hours, because attacks are timed for when nobody is looking
- Test a restore this quarter, end to end, and time it
- Write the one-page plan: who decides, who calls the insurer, who calls customers
- Harden email and the network edge with email security and network security services
- Have someone try to break in on purpose, via penetration testing, before someone does it uninvited
Our earlier guide on disaster recovery plans for small businesses goes further on the planning side, and essential tips for securing your business data covers the day-to-day habits.
How Cyber Kaizen approaches this
We work with UK businesses of 10 to 200 staff, and we would rather talk about ransomware recovery before you need it than during.
Our Secur-IT Framework builds tested backups, monitoring and a rehearsed response into ordinary managed IT support, so resilience is a property of how your IT is run rather than a project you fund after something goes wrong. For smaller businesses especially, that is the difference between a bad week and a closed business.
Frequently asked questions
How long does ransomware recovery take?
For a serious incident, weeks to months. The NCSC’s guidance is explicit that ransomware recovery from highly disruptive attacks is a long programme, not a single restore. Businesses with isolated, tested backups and a rehearsed plan routinely recover far faster than those improvising.
Should I pay the ransom?
The NCSC and National Crime Agency advise against it. Around six in ten UK victims pay, and only about 65% of those receive a working decryption key. Payment also does not remove the stolen copy of your data and marks you as likely to pay again.
Will my backups protect me from ransomware?
Only if they are isolated from the network and tested. Modern ransomware deliberately seeks out and deletes backups first. Backups on a mapped network drive, or relying on Microsoft 365 retention, usually do not survive.
Does Microsoft 365 back up my data?
No. Microsoft operates a shared responsibility model: they guarantee the platform’s availability, you remain responsible for your data. Retention policies and recycle bins are not backup, and a dedicated Microsoft 365 backup is needed to recover from ransomware or malicious deletion.
What is minimum viable operation?
The NCSC’s term for the smallest set of systems your business genuinely cannot trade without. Recovery prioritises restoring those first, with temporary workarounds, rather than attempting to bring everything back at once.
How do most ransomware attacks start?
Overwhelmingly through a phished or stolen credential, or an unpatched internet-facing device. Attackers are typically inside the network for weeks before anything is encrypted, which is why monitoring matters as much as prevention.
Find out where you actually stand
Most businesses do not know whether they could recover, because nobody has tested it. That is a question worth answering on a quiet Tuesday rather than during an incident.
Book your free IT health check and we will tell you honestly whether your backups would survive a ransomware attack and how long recovery would realistically take. Or talk to our team if you want that conversation sooner.
Sources: NCSC — ransomware guidance; NCSC guidance on recovering from disruptive cyber attacks (July 2026).
