--- title: "The 4 stages of a cyberattack and where an SME can stop it" description: "The 4 stages of a cyberattack on an SME and the control that stops it at each one: MFA, VLANs, immutable backups and a NOC. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/cyberattack-four-phases-managed-cybersecurity/ source: https://www.dataroad-it.com/en/cyberattack-four-phases-managed-cybersecurity/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > The 4 stages of a cyberattack on an SME and the control that stops it at each one: MFA, VLANs, immutable backups and a NOC. No-obligation proposal. # The 4 stages of a cyberattack and where an SME can stop it At a glance For decision-makers short on time. - 01 A ransomware attack starts days or weeks before the files are encrypted. - 02 Phases: reconnaissance, entry, expansion and impact; each has its own brake. - 03 Expansion is decisive: VLANs, least privilege and immutable backups contain the damage. - 04 Highest-return first step: MFA on all external access and off-network backups. ### In this article **Three weeks of partial shutdown, recovery fees, notifications to the CNPD and clients asking what happened: that is the price of a cyberattack nobody stopped in time.** And it almost never starts on the night of the ransom. A cyberattack on a business moves through four phases (reconnaissance, entry, expansion and impact) and each one has a control that works. The earlier the attack stops, the smaller the bill. This is the logic DataRoad - IT Services and Consulting uses to design managed cybersecurity for the SMEs it protects. ## How long does a company have to react? | Phase | What happens | Typical window | Effective control | | --- | --- | --- | --- | | Reconnaissance | Gathering public information about the company | Hours to weeks | Unique credentials, less exposure | | Entry | Phishing, exposed access or an unpatched flaw | Minutes | MFA, email filtering, patches, managed firewall | | Expansion | Hunting for credentials, servers and backups | Days to weeks | VLANs, least privilege, immutable backups, NOC | | Impact | Encryption, data theft, diverted payments | Hours | Planned containment and recovery | ## Phase 1: what does an attacker know about your company? More than you think. From LinkedIn they take names and roles; from the website, email addresses; from the news, suppliers; from job adverts, internal software. Add employee credentials leaked in breaches at other services. The result is a targeted attack: the message from the usual supplier, the call from the bank, the login attempt with the reused password. None of this leaves a visible trace. **The brake:** strip credentials of their value and shrink the public surface. A different password for each service, stored in a [password manager](https://www.dataroad-it.com/en/business-password-manager/), makes other people's breaches useless. Fewer generic addresses published and a clear rule for requests made "on behalf of" someone leave less room for social engineering. ## Phase 2: how do attackers get into an SME? - **Fraudulent email** Credentials typed into a fake portal or an attachment that installs malware. - **Access open to the internet** RDP, VPN or old portals protected only by a password. - **Known flaws** A firewall with outdated firmware, an unpatched server, Windows 10 out of support. The intrusion itself takes minutes. **The brake:** [MFA](https://www.dataroad-it.com/en/mfa-business-14-day-plan/) on all external access, so a stolen credential opens nothing; email filtering and a [team trained to spot and report phishing](https://www.dataroad-it.com/en/phishing-deepfakes-team-awareness-plan/); patches applied and a [managed firewall](https://www.dataroad-it.com/en/managed-vs-purchased-firewall-comparison/) that exposes only what is essential. Most attacks on SMEs should end here. ## Phase 3: why is this where the damage is decided? Once inside, the intruder wants three things: administrator accounts, a route to the servers and access to the backups. If the network is flat, if every user administers their own PC and if the admin password is the same on every machine, a few hours are enough. Next comes the antivirus switched off, accounts created to come back later and backups deleted or encrypted. **The brake:** - **Segmented network** VLANs separating workstations, servers and backups ([segmentation guide](https://www.dataroad-it.com/en/vlan-network-segmentation-business/)). - **No local administrators** Each person works with strictly the rights they need. - **Immutable, isolated backups** Out of reach of any network account. - **Eyes on the network** [NOC and monitoring](https://www.dataroad-it.com/en/noc-it-monitoring-portugal/), 24/7 on the Premium 365 plan, to catch logins at odd hours, new accounts or anomalous traffic while they are still alerts. This is the reasoning behind the [four Zero Trust steps applied to SMEs](https://www.dataroad-it.com/en/zero-trust-sme-90-day-plan/). The entry will never be fully closed: there is always a wrong click and a new vulnerability. Impact can no longer be prevented. It is during expansion that a segmented, monitored network with protected backups reduces a serious incident to one workstation to reinstall. Even so, it is the phase companies neglect most, they spend on the front door and on recovery and leave the inside without partitions. ## Phase 4: what is left to do once the attack is visible? Contain it. The damage shows up as encrypted files with a ransom note, data exposed or sold, fraudulent transfers or services down. The attacker picks the time (Friday night, the eve of a bank holiday) to buy time. From then on you pay in days of downtime, recovery consultants, notifications to the CNPD and to clients, and reputation. **Containment:** a written, rehearsed response plan (who switches off what, who talks to whom); verified backups the attacker cannot reach, the difference between restoring in hours and negotiating with criminals; [disaster recovery](https://www.dataroad-it.com/en/disaster-recovery-services-portugal/) with defined recovery objectives; and the first hours handled with method, as described in the guide to [data recovery straight after an incident](https://www.dataroad-it.com/en/data-loss-first-hour-response-protocol/). ## How does a typical case unfold? *A reconstruction drawn from several SME incidents.* - **Tuesday**: a "supplier invoice" reaches the accounts team; the employee enters her credentials in a fake portal. - **That night**: the attacker opens the mailbox and watches for a week. They find remote desktop access without a second factor. - **Days later**: now on the network, they exploit the fact that the user is a local administrator, harvest credentials and reach the file server and the backup NAS, on the same segment. - **Thursday night**: they delete the backups. - **Early Saturday morning**: they encrypt all the data. The company only notices on Monday. A second factor on remote access would have stopped everything in phase 2. VLANs and isolated backups would have left only one server to restore. Without any of these measures, the bill was three weeks at half speed. ## Frequently asked questions ### How long is there between intrusion and ransom? Between a few days and a few weeks, in a typical SME. Automated attacks can encrypt within hours; targeted ones wait longer because the attacker first wants to destroy the backups. ### Does a good antivirus solve the problem? Not on its own. It blocks malicious attachments and known attack tools, but it cannot tell apart an intruder using valid credentials, and that is how most attacks progress. MFA and segmentation are worth more. ### Does paying the ransom get the data back? There is no guarantee. Paying does not ensure the data is returned or prevent it being leaked, and it funds the next attack. With tested, isolated backups, the question does not even arise. ### What is the first step if the company has none of these defences? MFA on all external access. Then isolated, tested backups, removal of administrator rights and network segmentation; the first two steps can be done in days. ## Next step: find out at which phase an attack would stop today We analyse your infrastructure phase by phase and deliver, in writing, the point at which an attack would be stopped today and what is missing to stop it earlier. Find out more about [DataRoad's managed cybersecurity](https://www.dataroad-it.com/en/managed-cybersecurity-services/): in 11 years, DataRoad has never recorded a security incident. No-commitment proposal. **More than 10 workstations · support contract · remote, on-site and telephone support.** Call +351 211 459 950 * or write to sales@dataroad.pt. **Call to a Portuguese landline.* Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed cybersecurity ## One StepAhead of IT. The risk belongs to the board, the protection is ours. In 11 years, DataRoad has never suffered a security incident. - **MFA** on every managed account - **Top 5%** SMEs · scoring.pt - **11** years in business, since 2015 We do **IT** right. DataRoad IT Unlimited ## Does your IT depend on a single person? Documentation, inventory and one contact who answers for everything. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/cyberattack-four-phases-managed-cybersecurity/