Ransomware protection and endpoint security management, run to an SLA
Endpoint security management is central control of the protection on every laptop, desktop and server: antivirus, detection and response, patching and policy, from one console. Arke Technologies, in Johannesburg, runs it as ransomware protection for organisations, public bodies and schools across South Africa, with immutable backups and monthly SLA reporting.
What is ransomware protection?
Ransomware is malicious software that encrypts or steals an organisation's files and demands payment for the key, or for silence. In cyber security, ransomware is among the most disruptive attacks an organisation can suffer, because one incident can take payroll, billing, learner records and email down at once. In plain terms, the meaning of ransomware protection is the set of controls that stops the attack getting in, stops it spreading and lets you recover without paying.
The usual ways in are a ransomware email, a stolen remote-access password or an unpatched internet-facing server. Before encrypting, attackers work through what MITRE ATT&CK calls Defense Evasion (switching off antivirus, clearing logs) and Inhibit System Recovery (deleting shadow copies and backups), and many copy data out first so they can threaten to publish it. The best defence against ransomware is therefore layered, from the inbox to the backup vault, within our wider cybersecurity services.
Windows ransomware protection: Defender, Windows 10 and 11, and Windows Server
Most organisations' desktops and file servers run Windows, so protection starts there. Microsoft Defender Antivirus, still widely called Windows Defender, is built into Windows 10 and Windows 11, and the ransomware protection page in the Windows Security app holds controlled folder access: only trusted applications may change files in protected folders. It is off by default, and switching it on device by device is not management. For organisations, we configure Microsoft ransomware protection centrally:
- Attack surface reduction rules, including one that applies advanced protection against ransomware.
- Tamper protection, so nobody can quietly switch Defender off.
- Controlled folder access through Intune or Group Policy, in audit mode first.
- Endpoint detection and response in Defender for Business or Defender for Endpoint, which can isolate an infected device.
Windows 10 reached the end of Microsoft's support in October 2025, so devices still running it need Extended Security Updates or an upgrade to Windows 11. Ransomware protection for Windows Server differs in features and licensing; see Windows Server upgrades and, for Defender licensing, Microsoft 365 security.
Ransomware protection for servers, Linux and VMware
One encrypted file server or hypervisor takes down everything on it, so ransomware protection for servers starts with fewer ways in and fewer rights once inside.
- File servers. Share permissions matched to each role, SMBv1 switched off (WannaCry spread through it in 2017), and snapshots that user and file-share accounts cannot delete.
- Linux. Ransomware groups now build Linux encryptors for web, database and file servers. Ransomware protection on Linux means patching, SSH keys, no direct root log-in and file-integrity monitoring: anti-ransomware on Linux is mostly discipline. Our team administers Ubuntu, AlmaLinux, Debian and CentOS servers.
- VMware and Hyper-V. VMware ransomware protection matters because attackers target hypervisors to encrypt every virtual machine at once. Management stays on a separate network with its own administrator accounts, and backups sit beyond the hypervisor's credentials; see private cloud and virtualisation and server and infrastructure management.
Ransomware in the cloud: OneDrive, AWS and Azure
Ransomware in the cloud takes three forms: files encrypted on a laptop and synced to OneDrive, SharePoint or Google Drive; storage encrypted or deleted with stolen keys; and cloud servers attacked like any other. Your data, identities and configuration remain your responsibility.
- Ransomware protection in OneDrive. Version history and "Restore your OneDrive" roll files back within 30 days. That is recovery within a window, not a backup of Microsoft 365 or Google Workspace.
- AWS ransomware protection (Amazon Web Services). S3 versioning and S3 Object Lock keep copies nobody can change or delete for a set period, AWS Backup Vault Lock does the same for backups, and a separate backup account keeps them from a compromised production account.
- Azure ransomware protection (Microsoft Azure). Immutable Blob Storage, soft delete, and immutable Azure Backup vaults with multi-user authorisation.
Ransomware backup: protecting backups from ransomware
Attackers go after backups first, because a clean restore makes the ransom worthless, so protecting backups from ransomware decides the outcome. Our standard:
3-2-1-1-0: three copies on two kinds of storage, one off site, one offline or immutable, and zero errors on a verified restore.- Immutable backups that ransomware cannot change or delete before their retention period ends.
- Separate credentials for the backup system, with multi-factor authentication.
- Monitored jobs, with failures logged as tickets for follow-up.
- Timed restore tests, so disaster recovery from ransomware is measured against your recovery objectives, not assumed.
Backup storage and appliances, including Synology NAS units that support immutable snapshots, come through our trading division, Server Hub (opens serverhub.co.za); design and testing sit with backup and disaster recovery.
A ransomware protection playbook, and how to test it
A ransomware protection playbook is the written plan for the first hours of an attack: who decides, who isolates which systems, who calls the bank, the insurer and the Information Regulator, and in what order systems return. We write it in line with NIST SP 800-61 and name your decision-makers by role. How to test ransomware protection without waiting for an attacker:
- A tabletop exercise with your leadership, so gaps surface in discussion.
- A timed restore of a critical system, recorded against your recovery objective.
- Audit-mode logs showing what controlled folder access and attack surface reduction rules would have blocked.
- A penetration test that checks whether one stolen password could reach your backups.
When an attack is live, our incident response service takes over.
What ransomware protection costs
Last reviewed: September 2026.
Ransomware protection for business has three cost lines: licences, backup storage and management. Licences are often partly owned: Defender Antivirus comes with Windows, Defender for Business with Microsoft 365 Business Premium, and Defender for Endpoint Plans 1 and 2 with Microsoft 365 E3 and E5. We supply Microsoft 365 licences monthly or annually, and backup storage is priced by data volume and retention.
The work is a hardening project quoted after the assessment, then management per user per month under an SLA; published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026); see managed IT pricing. When comparing ransomware protection companies, check what those rates include: server count, data volume, recovery objectives and alert handling drive the price most.
Governance, compliance, procurement and continuity
- SLA. Incidents are prioritised P1 to P4, from a critical outage to a low-impact request, and a ransomware outbreak is a P1. Response and resolution targets are matched to what downtime costs you and agreed in your SLA; out-of-hours cover is available by agreement.
- Reporting and change control. A monthly service review covers device coverage, patching, backup and restore results, incidents and open risks. Changes are approved and logged against documented runbooks.
- Compliance. Controls that support POPIA sections 19 and 22, ISO/IEC 27001-aligned evidence (Annex A 8.7, protection against malware, and 8.13, information backup), King IV Principle 12 and PFMA or MFMA audits; see ISO 27001 readiness and POPIA compliance.
- Procurement. Arke Technologies (Pty) Ltd is a Level 1 B-BBEE contributor, giving buyers 135% procurement recognition (sworn affidavit available on request). Company documents, our CSD supplier number and SARS tax compliance status are available on request, and we complete SBD forms when a bid requires them; see company facts and procuring from Arke. The hardening project is bought on a proposal and purchase order, or through your tender process, and ongoing management under an SLA.
- Continuity. Policies live in your own tenant and consoles. You own your data, credentials, backup keys and documentation, and at exit we hand over administrator access and runbooks. One certified team works under one contract, so adding devices changes the SLA schedule, not the supplier.