In short: Ransomware awareness training teaches staff how ransomware usually gets in (phishing, stolen or reused credentials and exposed remote access), what the early warning signs look like, and exactly what to do if they suspect an infection: disconnect, do not hide it, and report it immediately. It works alongside offline backups and endpoint protection.
What ransomware is, in plain English
Ransomware is malicious software that locks or encrypts an organisation's files and systems so they cannot be used, followed by a demand for payment, usually in cryptocurrency. Many groups also copy data before encrypting it and threaten to publish it, so even good backups do not remove the whole risk.
The NCSC breaks an attack into stages, which is a useful picture for staff: attackers first gain access to your network, establish control and plant the encryption software (often copying data on the way), and only then activate it and display the ransom demand. That gap between getting in and launching the attack is where alert staff and good monitoring can stop it.
The NCSC and UK law enforcement do not encourage, endorse or condone paying a ransom. There is no guarantee of getting data back, the systems may still be infected, payment funds further crime and it can make the organisation more likely to be targeted again. That decision belongs to leadership and advisers, not staff, but staff should understand why prevention and fast reporting matter so much.
How ransomware usually gets in
Training should be honest that the initial step is often ordinary. The routes staff can influence are:
| Route in | What staff can do |
|---|---|
| Phishing email or message | Spot the lure, do not open unexpected attachments or enable macros, and report it. See phishing awareness training |
| Stolen or reused passwords | Use unique passwords and MFA, and deny unexpected sign-in prompts. See password and MFA training |
| Remote access and fake support | Never install remote-access software because a caller or chat message asked you to. See social engineering training |
| Malicious downloads | Only install software from approved sources, and do not bypass security warnings |
| Removable media | Do not plug in found USB drives. See physical security awareness |
The remaining routes, such as unpatched internet-facing systems and weak remote access configuration, are for IT to fix, which is why training must sit inside a wider set of controls.
Warning signs and what to do in the first minutes
Staff do not need to diagnose ransomware. They need to recognise that something is wrong and act quickly. Signs worth reporting include:
- Files that will not open, have changed names or extensions, or a ransom note on screen
- The computer suddenly running very slowly, or security software being switched off
- Unexpected sign-in prompts, password reset emails or MFA requests
- A colleague or 'IT' asking you to install a tool or approve access you did not expect
- Having just opened an attachment or link that now seems suspicious
Then the response we train for, which should match your own incident plan:
- Stop what you are doing and do not try to fix it yourself.
- Disconnect the device from the network (unplug the cable or turn off Wi-Fi) if your plan says to, but do not switch it off unless IT asks, as that can destroy evidence.
- Report it straight away to IT or your security contact using the agreed route, even out of hours.
- Do not delete emails, pay anything or contact the attackers.
- Write down what you saw and when, to help the investigation.
Speed of reporting is the behaviour that matters most, so staff must know they will be thanked, not blamed. That is the heart of a positive security culture.
How training fits with backups and endpoint protection
Training reduces the chance of an attack starting and shortens the time to detection. It does not replace technical controls. The NCSC advises keeping recent offline backups of important data, and organisations also need endpoint protection with ransomware-specific defences, MFA on remote access, patching and monitoring.
| Layer | What it does |
|---|---|
| Security awareness training | Fewer clicks, faster reports, staff who know the incident routine |
| Email security | Blocks many phishing and malware emails before they arrive |
| Endpoint protection and XDR | Detects and stops malicious behaviour, including encryption, on devices |
| Backups, including an offline or immutable copy | Lets you restore without paying |
| Incident response plan and exercises | Everyone knows who decides what when it happens |
For endpoint protection see Sophos Intercept X and endpoint security and XDR. For backups, see Forever Group's cloud backup. The NCSC also offers a free Early Warning service that notifies UK organisations of malicious activity it detects on their networks.
Reporting a ransomware attack in the UK
Your first report is internal, but organisations should also know the national routes. The NCSC's service at gov.uk/report-cyber tells UK organisations where to report a cyber incident, including ransomware, and the NCSC points to it from its ransomware guidance. Cyber crime and fraud in England, Wales and Northern Ireland are reported to Report Fraud, the national service that replaced Action Fraud; in Scotland, report to Police Scotland. If personal data may have been affected, the incident may also need reporting to the ICO, which our GDPR training for staff page explains.
Insurers usually have their own notification requirements and incident response arrangements, so check your policy. Our page on security awareness training for cyber insurance covers the evidence insurers ask for.
How we help
We add a ransomware module to your security awareness training programme, run phishing simulations that use the attachment and link lures ransomware groups favour, and make sure every member of staff knows exactly how to report a suspected incident. We can also review your email security, endpoint protection and backups so training is backed by the right technology.
Contact us to add ransomware awareness to your programme.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What should an employee do if they suspect ransomware?
Stop using the device, disconnect it from the network if your incident plan says to, do not switch it off unless IT asks, and report it immediately to IT or the security contact. Do not delete anything, pay anything or contact the attackers.
How does ransomware usually get into a business?
Common routes are phishing emails and messages, stolen or reused passwords, exposed or poorly protected remote access, malicious downloads and unpatched internet-facing systems. Staff can influence the first few; IT controls handle the rest.
Should a business pay a ransomware demand?
The NCSC and UK law enforcement do not encourage, endorse or condone paying. Payment does not guarantee you get your data back, your systems may stay infected, it funds criminals and it can make you a target again. The decision is for leadership with legal, insurance and incident response advice.
Where do you report a ransomware attack in the UK?
Start with the NCSC's gov.uk/report-cyber service, which tells you where to report a cyber incident. Cyber crime in England, Wales and Northern Ireland is reported to Report Fraud, which replaced Action Fraud; in Scotland, contact Police Scotland. Also notify your insurer under the terms of your policy, and consider whether the ICO needs to be told about a personal data breach.
Is training enough to stop ransomware?
No. Training reduces the chance of an attack starting and speeds up reporting, but you also need email security, endpoint protection, MFA, patching and tested backups, including an offline copy.