Ransomware: the real damage and the zero-cost defence with canary files.

Guide updated: July 2026 · Reading time: 7 minutes

What ransomware is (and why it targets small businesses)

Ransomware is malicious software that, once inside a computer, encrypts files — documents, management systems, photos, archives — making them unreadable, and leaves a ransom note for the unlock key. It is not a "big company problem": small businesses and professional firms are the favourite targets, precisely because they usually have lighter defences and equally vital data. In Palermo as anywhere else: one email opened in a hurry on a Monday morning is enough.

The real damage: the ransom is the smallest item

• Business standstill. Management software, invoices, quotes, email: all unreadable from one moment to the next. Recovery, at best, is measured in days; often in weeks. For many businesses this is the worst damage of all.
• Rebuilding the systems. Even if you pay (not recommended), compromised machines must be cleaned or reinstalled from scratch: hours of technical work nobody had budgeted.
• Customer and supplier data. If personal data is involved, GDPR kicks in: incident assessment, possible notification to the authority within 72 hours, communications to those affected. On top of the damage, the paperwork — and possible fines.
• Reputation. Explaining to clients and partners that their documents are in the hands of criminals is a phone call nobody wants to make.
• Backups encrypted along with everything else. The final blow: if the backup drive is always connected or reachable over the network, the ransomware encrypts that too. That is why "we have backups" often is not enough.

How it gets in and how it moves

The most common entry points never change: an email attachment disguised as an invoice or a courier notice, a link to a fake login page, a remote access (remote desktop, VPN) protected by a weak or reused password. Once inside, ransomware makes no noise: it moves towards network shares — shared folders, the server, the NAS — and starts encrypting silently. By the time a user notices files will not open, most of the damage is done.

This is where the game is decided: between the first encrypted file and the last, minutes pass — sometimes hours. Whoever notices within those minutes saves the network. Whoever notices the next day does not.

The zero-cost defence: monitored canary files

The method is as simple as it is effective, and it relies on an idea as old as traps: the decoy.

• 1. The decoys. In strategic spots — shared folders, drive roots, document folders — you plant canary files: fake documents that look appetising (lists, accounting, scans) that no human should ever touch.
• 2. The monitoring. An automated, extremely lightweight check verifies those files continuously: do they still exist? Same content? Same extension?
• 3. The alarm. If a canary file gets modified, encrypted or renamed, there is no doubt: nobody was supposed to touch it, so encryption is in progress. False positives are extremely rare, by construction.
• 4. Automatic isolation. In that same instant the affected PC disconnects itself from the network (network adapters disabled) and the alert goes out. The ransomware stays confined to one machine: the server, the other PCs and the backups never see it.

The best part is the cost: zero. No licences, no subscriptions — the tools already included in Windows (PowerShell scripts and scheduled tasks), configured with care, are enough. It is the same principle behind the monitoring systems I designed for national critical infrastructure: notice immediately, isolate immediately, limit the damage.

Why it works even when antivirus is not enough

Antivirus software reasons by signatures and similarities: it recognises what it has already seen. New ransomware variants are born precisely to look like nothing else — and in their first days they walk right through. The canary file reasons the opposite way, by behaviour: it does not care who you are; if you encrypt that file, you are hostile by definition. The two approaches do not exclude each other, they complete each other: antivirus stops the known, the canary catches the unknown.

The options compared: average market prices

Indicative averages (2026); every business is its own story:

The minimum checklist for an SME or a firm

• 3-2-1 backups with one offline copy. Three copies, two media, one off-site or disconnected: the only real insurance. An always-connected backup is just another drive to encrypt.
• Regular updates of system and software: they close the doors ransomware uses to get in.
• Two-factor authentication on email and remote access: a password alone is no longer enough.
• Canary files + automatic isolation on every workstation and on the server: the safety net that limits the damage when everything else has failed.
• A restore drill every now and then: a backup that has never been tested is a hope, not a plan.
• Five minutes of staff training on suspicious attachments and links: email remains entry point number one.

Frequently asked questions

Do I need to buy software?

No: the canary-file system is built with what Windows already includes — PowerShell scripts, scheduled tasks, well-configured permissions. The value is not in a licence but in the design: where to place the decoys, how often to check them, what happens at the first alarm.

What if a PC isolates itself by mistake?

It happens rarely, precisely because nobody is supposed to touch the canary files: whatever modifies them is almost certainly hostile. In doubt, re-enabling the network on an isolated PC takes a minute — recovering an encrypted network takes weeks. The risk/benefit ratio is not even a contest.

Does it work for a firm with three PCs?

Yes — that is actually the ideal scenario: few machines, often one shared folder with all the work inside, no IT department. The system runs by itself in the background and needs no daily maintenance.

If I pay the ransom, will I get my files back?

No guarantee: you are dealing with criminals. In many cases the key never arrives, or it arrives and the data turns out corrupted anyway — and meanwhile you have funded the next attack, possibly flagging yourself as "someone who pays". Prevention is cheaper in every possible scenario.