How does malware usually get into a small organisation?
Malware usually gets in through an email attachment, a malicious website, or an unpatched or exposed remote access service, the routes the NCSC highlights in its guidance. Stolen passwords then let attackers move from one machine to others on the network.
Consider a fictional eight-person charity, Northgate Food Network. Its volunteer coordinator, Sam, keeps a list of jobs nobody has got round to: 'laptop keeps saying restart for updates, keep postponing. backup = USB drive plugged into office PC permanently. remote desktop left open so treasurer can work from home. donation spreadsheet arrived as .xlsm from new supplier, asked me to enable content'. Each line is a doorway that ransomware groups look for.
What are the main types of malware?
The main types of malware are grouped by what they do once inside, and many attacks combine several.
| Type | What it does | Typical sign |
|---|---|---|
| Ransomware | Encrypts or steals files and demands payment | Files will not open, renamed extensions, a ransom note |
| Info-stealer or spyware | Collects passwords, cookies and documents | Unknown sign-ins, accounts changed without you |
| Trojan | Hides inside something that looks useful | A program or document you did not expect asks for extra permissions |
| Worm | Spreads itself across a network | Several machines slow down or misbehave at once |
| Wiper | Destroys data, sometimes disguised as ransomware | Files gone even after a demand is met |
How do you prevent malware and ransomware?
You prevent most malware and ransomware with layered habits rather than one product: install updates promptly, keep backups that attackers cannot reach, and protect accounts with multi-factor authentication. The NCSC stresses defence in depth because no single measure stops every infection.
Updates
Install security updates as soon as they are available and turn on automatic updates. Patch remote access services and internet-facing devices first, since attackers scan for them.
Offline backups
Keep regular backups that are not permanently connected to your network, ideally in another location, and test that you can restore them. CISA recommends offline, encrypted backups that you test regularly.
Multi-factor authentication
Turn on MFA for email, cloud storage and every remote access point, so a stolen password alone is not enough.
Macros and downloads
Do not enable macros or content in documents you did not expect. Ask the sender through a known channel instead.
Least access
Give people only the access they need, and close remote access that nobody uses.
What does a weak and an improved fix list look like?
A weak fix list says 'buy better antivirus' and stops. Antivirus helps, but it would not have fixed any of Sam's four doorways: the USB backup would still be encrypted along with the PC, the open remote desktop would still invite attackers, and the macro would still run if someone clicked enable.
An improved fix list maps each doorway to a habit. Updates: restart and install tonight, then switch on automatic updates. Backup: unplug the USB drive after each weekly backup, keep a second copy in a separate cloud account with its own MFA, and test one restore this month. Remote access: close the open remote desktop and give the treasurer a supported, MFA-protected way to reach the files. Supplier spreadsheet: do not enable content; ring the supplier on the number from their website to confirm they sent it. Every item has an owner and a date.
What should you do if ransomware hits?
If ransomware hits, isolate affected devices from the network straight away, call whoever manages your IT, and report it. CISA advises disconnecting rather than powering down where possible, because switching off can destroy evidence, then restoring from offline backups once systems are clean. The NCSC points victims to the No More Ransom project for possible decryption tools and notes that law enforcement does not encourage paying, because payment does not guarantee recovery and funds criminal groups. Our incident response basics lesson covers the full first hour.
How do you check your defences are real?
You check your defences by testing them, not by assuming. Try restoring one folder from backup, look at a device's update history, confirm MFA is on for every account that matters, and list every remote access route you have. If you cannot answer one of these in five minutes, that is your next job.
What are the common mistakes with malware protection?
The most common mistake is a backup that is always connected, because ransomware encrypts it along with everything else. Other mistakes: postponing updates for weeks, leaving remote access open for convenience, sharing one admin account, enabling macros because a message asks politely, and never testing a restore until the day it is needed.
Where does this lesson sit in Tosheo.ai?
This lesson sits in the Cybersecurity category and the cybersecurity course, alongside phishing, incident response and safe use of AI agents. In Tosheo.ai you audit a fictional organisation's setup like Northgate's, write a prioritised fix list, and get rubric feedback on what you missed. It is awareness training for everyday staff and managers, not a technical security or malware-analysis course.
Sources and scope
NCSC, mitigating malware and ransomware attacks (checked 19 October 2026) ↗
CISA, StopRansomware (checked 19 October 2026) ↗
CISA, I've been hit by ransomware (checked 19 October 2026) ↗
NCSC, Small Business Guide: Response and Recovery (checked 19 October 2026) ↗