Ransomware day is not about whether the attack comes. It is about whether Tuesday's disaster is a lost morning or a lost business. Here is the same attack, in an office that built the four layers - and one that did not.
Let us walk through the attack honestly. 9:12 AM: a staff member opens an attachment that looked like an invoice. It was not. Malware starts encrypting files on that PC and reaches for the shared folders. In an unprepared office, this story ends with a ransom note on every screen. In an office with the firewall, endpoint, antivirus and backup layers in place, the same morning plays out very differently. This page follows the prepared office, hour by hour - and notes where each layer earns its cost.
Ransomware spreads at machine speed, so the first minutes are worth more than the next days. In the prepared office, the antivirus/EDR layer notices hundreds of files being renamed and encrypted - behaviour no invoice program shows - and isolates the PC from the network automatically. The staff member, trained that reporting brings help rather than blame, calls IT within minutes instead of quietly rebooting and hoping.
While the cleanup starts, the other layers explain why the damage stayed small. The firewall had no open ports, so the attackers could not also walk in from the internet to finish the job or steal data twice. Every other PC was fully patched, so the malware could not jump machine-to-machine using known Windows flaws - the sideways movement that turns one bad PC into a whole encrypted office simply found no doors. The endpoint console shows exactly which machines the infected PC talked to, so the investigation has a map instead of a panic.
Now the question that decides the day: are the backups clean and reachable? The attacker deleted the server's shadow copies - they always try - but the offline and immutable copies were beyond reach, exactly as the 3-2-1 setup intended. Because the office runs a monthly restore test, nobody is experimenting under pressure; the restore procedure is a known drill.
Within the week, the office reviews how the attachment got past the mail filter, adds the lesson to the next phishing session, and checks every layer again end to end. Total cost: one lost morning, one rebuilt PC, and some pride. Compare the unprepared version of this day: no isolation, unpatched PCs encrypting one by one, a permanently connected backup drive encrypted too, and a stranger demanding payment for the business's own data - with days or weeks of downtime and no guarantee. The four layers did not stop the click. They stopped the click from mattering.
See the complete security setup live - firewall, endpoint, antivirus and backup, all in one video.
Watch Full VideoThe consistent advice from law enforcement and security professionals is no: payment does not guarantee your data back, marks you as a payer for future attacks, and may fund further crime. A tested backup is the reliable exit - which is why it must exist before the attack.
Restore from a point clearly before the infection time, verify sample files open correctly, and scan the restored data. The monthly restore-test habit means you already know your backups work and how far back clean copies go.
Yes - treat it as a full incident. Ransomware on one machine means an attacker or malware got inside; find the entry point, check other machines, and reset involved passwords. The quiet cases are where second attacks are planted.