Photo by Christian Velitchkov on Unsplash
You arrive at work, open your laptop, and nothing responds the way it should. Files that were there yesterday are locked. A message fills the screen telling you that your data has been encrypted, and that you have a limited window to pay if you want it back. A countdown clock is already running.
This is not a scene from a news story about a large corporation in another country. It happens to UK small businesses every week, across every sector. And the first question every business owner asks when they see that screen is the same one: should I just pay and make this go away?
Every credible cyber security authority gives the same answer: no. But the real answer is more useful than a single word.
What Paying Actually Gets You
The logic feels obvious. Pay the ransom, receive a decryption key, restore your files, move on. That is sometimes how it plays out. But there is a great deal that a ransom payment does not guarantee, and several things it actively makes worse.
Paying tells the group behind the attack that yours is a business willing to pay. That puts you on a list. Some organised ransomware operations have been documented returning to the same targets weeks after a successful payment, sometimes through the same weakness that let them in the first time, sometimes through a new one. The payment does not fix the underlying problem.
Decryption tools provided after a ransom is paid do not always work cleanly. Partial recovery, corrupted files, and very slow restoration are common outcomes even when the payment goes through without issue. Many businesses end up restoring from backups regardless, having paid a significant sum for a tool that did not fully deliver.
There is also a legal dimension that most small businesses are not aware of. Depending on which group carried out the attack, transferring money to them may put your organisation in breach of financial sanctions regulations. If the group behind the attack appears on a restricted list, a ransom payment could constitute a sanctioned transaction. This is a real risk that deserves careful thought before any payment decision is made.
What the Attackers Already Know
Ransomware operations are not random. They are organised, and some operate with support desks, negotiation teams, and structured pricing models. Ransom demands are often calibrated to what attackers can learn about a target during the intrusion itself: the size of the organisation, the sector it operates in, and whether there is evidence of cyber insurance coverage. If they find that evidence, some groups adjust their demands accordingly.
The ransom note is the end of a process that may have started weeks earlier. By the time files are locked, attackers have often already copied data out of the network. That changes the calculation entirely. Even a perfect recovery from backup does not undo the theft of data that has already left your systems. Paying does not change that either.
The Question That Actually Matters
The real question is not what to do once the countdown clock is running. It is whether your business is in a position to recover without paying at all. That question needs to be answered well before an incident happens.
Businesses with reliable, tested, and properly isolated backups are in a fundamentally different position from those without. The word isolated matters here. Ransomware regularly targets backup systems specifically because attackers understand that a working backup removes most of the leverage the ransom demand depends on. If your backup drive is connected to the same network as everything else, it is often encrypted alongside your live data. We have written more about this in why your backup alone may not be enough.
A backup that is stored separately, tested regularly, and restorable within a practical timeframe gives your business genuine options when an attack hits. You can refuse to pay, notify the relevant authorities, engage a specialist to help manage the incident, and focus on recovery. That path is not painless. But it is a path through.
Stopping Ransomware Before the Note Appears
Backups are the recovery answer. But there are controls that exist to prevent ransomware from reaching the encryption stage in the first place.
Ransomware-specific endpoint protection is built to detect the behavioural patterns that encryption activity produces, rather than waiting for a signature match that may not exist for a new variant. Combined with next-generation antivirus that monitors for suspicious behaviour in real time, this layer of protection can interrupt an attack before your files are ever touched.
Most ransomware still begins with a human action: clicking a link in a phishing email, opening an attachment that looked legitimate, or entering credentials into a convincing fake login page. Security awareness training remains one of the most practical investments a small business can make, because a member of staff who recognises a suspicious email and does not click it stops an attack at its earliest point.
What UK Authorities Recommend
The National Cyber Security Centre advises UK organisations not to pay ransomware demands. Their reasoning is consistent: payment funds criminal operations, does not reliably deliver recovery, and may carry legal risk depending on the group involved. Reporting to the NCSC and to Action Fraud after an incident gives investigators a clearer picture of which groups are operating and how they are getting in.
A Practical Takeaway
If ransomware hits your business, the ransom note will feel like your most urgent problem. In practice, the more important question is whether you have already built the conditions to recover without paying. That means tested, isolated backups. It means protection that works at the behavioural level, not just the signature level. And it means a team that knows what a phishing attempt looks like before anyone clicks. None of that is complicated to put in place. All of it is far better addressed now than when a countdown clock is already running.