What shuts a company down today isn't a virus: it's data held hostage
The damage rarely starts on an infected machine. It starts with an e-mail that looked like the supplier's, a password that leaked, a USB stick somebody plugged in. Within hours the server is encrypted, the sales system won't open, invoices can't be issued — and the ransom demand arrives.
For a small or medium business, the loss isn't only the ransom. It's the day lost, the customer who wasn't served, the accounting history that vanished, and the hard conversation with whoever trusted you with their data. Recovering costs far more than preventing, and almost always more than a full year of protection.
That's why security stopped being a program you install and became a structure: protection on machines and servers, control over what gets plugged in, mail protection, a console where you can see the whole estate — and someone responsible for looking at it.