How Organization Size Impacts Ransomware Readiness

When it comes to ransomware preparedness, it’s not just about if an attack might happen, but attacks happen no matter the size of your organization.

And, the same statement holds true when talking about ransomware awareness and the ability to recover from an attack.

“It is no surprise that smaller companies face greater challenges than larger ones in many ways, especially when it comes to funding what may be considered “optional” things such as robust data protection, disaster recovery, and ransomware mediation activities”, says Scott Lowe from ActualTech Media.

In a previous post, we asked the question, “how important is board involvement to your ransomware preparedness strategy?”

The short answer is “very important.”

What’s equally important is how company size impacts and affects ransomware readiness, awareness, and recoverability.

These are key topics that produced some interesting findings in our recently published State of Ransomware Preparedness Report. The Report was a survey conducted by ActualTech Media.

The significance of ransomware and the headaches it warrants continue to dominate headlines. Three key findings from the research were:

1. Organization size matters when it comes to ransomware preparedness outcomes.
2. Business disruption due to ransomware is not overstated; it’s real and it’s significant.
3. Common recovery metrics are impeded by financial, human resource, and skills constraints.

Let’s look at these topics and the ensuing questions that follow in more detail.

‍Baseline Ransomware Awareness

Prior to planning mitigation, you must be fully aware and have a clear understanding of what you are trying to accomplish. Previous experience and considering current trends will give you some of that understanding, but having the answers to questions such as these will give you greater awareness:

• Has your organization ever experienced a ransomware incident of any size that resulted in infiltration and/or encryption?
• Does your organization’s board have any level of involvement in your cybersecurity posture, including ransomware prevention efforts?

‍Ransomware Preparedness

How well an organization is prepared for a potential threat will usually indicate how well that organization will respond to such an attack. While it may seem like a no-brainer, there are several warning signs that suggest that company size plays a substantial role when it comes to predicting outcomes. The bigger an organization is, does not always translate to being better prepared when it comes to ransomware preparedness. In fact, SMBs will sometimes outperform their much larger counterparts.

Here are a few more questions to consider when planning your strategy:

• As compared to 2020 and 2021, for overall ransomware prevention and recovery spending, as compared to 2022 and 2023, we are expecting to spend . . .
• What changes have you made to your backup and recovery strategy as a direct result of the threat of ransomware or a successful ransomware attack?
• If your organization were to experience a ransomware attack that impacted all systems, how long do you think it would take you to recover to the following levels?
• What prevents your organization from improving RTO and RPO metrics?

‍Ransomware Recoverability

Ransomware preparedness is all about the ability to protect, recover and maintain critical data and applications in the event of an attack. In less than 10 years, it is predicted that ransomware attacks will increase from every 11-seconds to every 2-seconds. That stat alone is significant enough to solidify the importance of ransomware preparedness no matter the size of your organization. This brings up one final question:

• Does your organization have a complete and documented disaster recovery and/or ransomware remediation plan with associated policies and processes?

The research from the Report firmly suggests that organization size plays a role in the perception of ransomware readiness. As you would expect, larger companies are more likely to have a comprehensive DR plan as compared to smaller companies. Although, the results might surprise you. However, smaller companies do need to increase their efforts or run the risk of paying higher consequences in the event of a disaster.

To learn more and to find out if you are prepared in the inevitable event of an attack, you can Download the report today!

‍