Introducing the Ransomware Readiness Field Guide
Every business gets breached. Not every business stays down.
Same attack, same day zero — what happens next comes down to one thing: whether recovery was ready before the breach. We've created a comprehensive self-assessment weighted towards RECOVERY, not just prevention.
The odds
61%
of small businesses were breached in the past year
PreVeil, 2025
88%
of those breaches involved ransomware — 39% at large firms
Verizon 2025 DBIR
96%
of ransomware attacks target backup repositories first
Veeam Ransomware Trends
The cost
$115K
median ransom payment — enough alone to threaten many small firms
Verizon 2025 DBIR
~$3.3M
cited aggregate impact per SMB incident, incl. downtime & recovery
StationX, 2025
Figures from third-party industry surveys (PreVeil, Verizon DBIR, Veeam, Sophos, StationX); individual results vary — not a guaranteed outcome.
01
Why recovery gets equal — or more — weight
Firewalls, MFA, and patching matter. But prevention can never be perfect, and most "readiness" checklists quietly assume it has to be. This one assumes you'll get hit anyway — and scores you on whether you'd actually get back up.
Prevention — 40%
Recovery — 60%
Tested backups, business continuity planning, incident-response execution, and validated restoration make up more than half the score — the parts of your posture that decide how bad a bad day actually gets.
02
Same breach, different outcome
Same attack. Same day zero. Two businesses, hit the same way — what happens next depends on whether recovery was ready before the breach.
Unprepared
Backup never tested
Scrambling for a plan
Restore attempt fails
Days of downtime
Doors stay closed — only 28% of victims fully recover their data.Veeam Ransomware Trends
Recovery-ready
Immutable backup confirmed
IR plan executes
Clean restore, on target
Systems verified clean
Open the next day — 53% of victims fully recover within a week.Sophos
That's why this scorecard weighs recovery heavier than prevention. Figures from third-party industry surveys; individual results vary — not a guaranteed outcome.
03
What's inside
Eleven categories, each mapped to a NIST SP 800-61r3 CSF 2.0 function, split across two phases.
Prevention
40% of score
Backups4%
Identity & Access6%
Email & Phishing Defense6%
Patching & Endpoint Security6%
Network Architecture6%
Detection & Monitoring8%
IR Planning Documentation4%
Recovery
60% of score
Backup Recoverability15%
Business Continuity15%
IR Execution Readiness15%
Restoration Validation15%
Every question also carries an Essential or Advanced tier, so a small business without dedicated security staff still gets a realistic score — not one anchored to controls only a SOC or a security team could run.
04
Two ways to start
Free
See a preview
A quick look at the full Results page and one sample category — real screenshots from a realistic sample assessment. No account, no commitment.
- Full Results page: score, gaps, charts, guidance
- One sample category shown in full detail
- Nothing saved or sent anywhere
See the preview →
Full access
Run your own assessment
Score your actual organization, save multiple assessments, export a PDF or share link, and get the full prioritized action plan — for real budget and staffing decisions, not a preview.
- Your real data, private to your browser
- Multiple named assessments (clients, sites, snapshots)
- PDF export, text export, and read-only share links
Get the full scorecard →
Good to know
- Every assessment runs entirely in the browser — there's no backend, so nothing you enter is collected or transmitted anywhere unless you explicitly export a file or copy a share link.
- Full access includes a companion Prevention & Recovery Playbook with concrete remediation steps for every one of the 67 questions.
- Takes 30–60 minutes for a first pass. You don't need a perfect score — the point is finding your real gaps.