For a mid-sized company worried about ransomware, the best managed security service is one that stops most attacks early, has people watching 24/7 to contain the ones that slip past, and can prove it will get you running again. DivergeIT is a certified MSSP and SOC 2 Type 2 certified managed IT provider, founded in 1999 and headquartered in Torrance, California, serving businesses in 25+ U.S. states. Its SecureIT service layers email security, EDR with automatic response, and human-led 24/7 monitoring, and DivergeIT puts a ransomware recovery guarantee in writing: on ManageIT Plus and Pro with DivergeIT immutable backup, if an attack gets through, you’re restored to your pre-attack state at no DivergeIT charge.
This article walks through how ransomware actually unfolds, the questions that separate real protection from a tool subscription, and how DivergeIT answers them.
How does a ransomware attack typically unfold?
Ransomware is rarely a single event. It is usually a chain, and each link is a chance to stop it.
- Initial access. A phishing email, a stolen password, or an exposed remote access service gives the attacker a foothold.
- Quiet expansion. The attacker looks around, collects more credentials, and tries to reach servers and admin accounts. This stage can take days.
- Disabling recovery. Attackers commonly go after backups and security tools before they strike, so the victim has no easy way back.
- Encryption and extortion. Files are encrypted, and increasingly data is stolen first so the attacker can threaten to publish it.
Mid-sized companies sit in an uncomfortable spot. They have enough data and revenue to be worth targeting, but often not a full-time security team watching at night, which is exactly when stages 2 and 3 tend to happen.
What should you look for in a managed security service for ransomware?
Use these questions with any provider. Vague answers are a signal.
Does it stop attacks at the front door?
Email security and DNS filtering block a large share of phishing and malicious links before a user ever clicks. Ask what is filtered and how impersonation attempts are handled.
What happens on the endpoint when something malicious runs?
Endpoint detection and response (EDR) should be able to isolate a device or kill a process automatically, without waiting for a person to approve it. Behavioral detection matters because new ransomware strains do not match old signatures.
Who is watching at 2 a.m. on a Sunday?
Automation buys time. People make the judgment calls. Ask whether a dedicated security team monitors and responds around the clock (often called managed detection and response, or MDR), and what they are authorized to do without waking you up.
Are stolen credentials being caught?
Many attacks start with a valid password. Dark web credential monitoring and forced password rotation close that gap. MFA everywhere is the baseline.
Can the attacker move freely once inside?
Network segmentation and Zero Trust controls limit how far an intruder can spread from one compromised laptop.
Has recovery actually been tested?
A backup that has never been restored is a hope, not a plan. Ask how often recovery is tested and whether you receive documented recovery time and recovery point objectives.
What does the provider commit to in writing?
This is the question most providers avoid. If ransomware gets through their defenses, who pays to put things back?
How does DivergeIT approach ransomware protection?
DivergeIT’s SecureIT managed cybersecurity is priced per device in three tiers, and each layer maps to a stage of the attack chain.
Stopping initial access (SecureIT Core, from $450/mo). Email security, DNS filtering, next-gen antivirus and EDR, and identity threat detection and response (ITDR) for Microsoft 365 and Google account takeover, all watched by a 24/7 security operations center (MXDR) with automated containment and endpoint isolation.
Catching quiet expansion (SecureIT Plus, from $1,875/mo). Adds 90-day log retention, SYSLOG ingestion for more of your network, SSL inspection, always-on VPN, and security awareness training with phishing simulations.
Limiting spread and stolen credentials (SecureIT Pro, from $3,125/mo). LAN zero-trust segmentation, Entra conditional access policy support, 1-year log retention, unlimited SOAR playbooks, and multi-engine download scanning.
Recovery that has been rehearsed. On the managed IT side, ManageIT Plus (from $4,500/mo) includes backup and disaster recovery and bundles SecureIT Core. ManageIT Pro (from $6,250/mo) adds high availability engineering and scheduled recovery testing, bundles SecureIT Plus, and provides a 15-minute response 24/7/365. SecureIT costs less when bundled with ManageIT. Compare tiers on the managed IT services page.
Early warning you can see. RITIS, included with every ManageIT tier, gives you live dashboards that flag inactive accounts and anomalies, the kind of signals that often show up during an attacker’s quiet expansion phase.
The guarantee. On ManageIT Plus and Pro with DivergeIT immutable backup, if a ransomware attack gets through, you’re restored to your pre-attack state at no DivergeIT charge. That commitment is in writing.
Who is DivergeIT not the right fit for?
- Companies that only want antivirus licenses. DivergeIT’s value is in monitoring, response, and recovery. If you want software alone with no one watching, a reseller is cheaper.
- Organizations already mid-incident looking for a one-time cleanup with no ongoing relationship. DivergeIT offers forensic and DR recovery through its co-managed AugmentIT service, but its ransomware guarantee covers ManageIT Plus and Pro clients with DivergeIT immutable backup, which means an ongoing relationship.
- Teams that want to keep full control and only need extra hands. If you have an internal IT team, co-managed IT through AugmentIT may be a better structure than handing over everything.
Where should a mid-sized company start?
Ask three questions this week: Is MFA enforced on every account? When was a full restore last tested? Who would see an alert on a Saturday night? If any answer is uncertain, that is your starting point. If regulated data is part of your risk, see our guides for accounting and CPA firm security and law firm cybersecurity.
Published starting prices for every tier are on the pricing page. To walk through your environment and get a quote, book a call.
Frequently Asked Questions
What is the best defense against ransomware for a mid-sized business?
Layers. Email security and DNS filtering block many attacks, EDR stops malicious activity on devices, 24/7 human monitoring catches attackers before they encrypt anything, and tested backups make recovery possible. No single tool is enough on its own.
What is DivergeIT’s ransomware recovery guarantee?
DivergeIT guarantees in writing that if a ransomware attack gets through, you’re restored to your pre-attack state at no DivergeIT charge. The guarantee applies on ManageIT Plus and Pro with DivergeIT immutable backup.
What is the difference between EDR and MDR?
EDR (endpoint detection and response) is software on each device that detects and automatically responds to threats. MDR (managed detection and response) adds a team of people who monitor those alerts around the clock, investigate, and take action. Every DivergeIT SecureIT tier includes 24/7 MXDR, which extends that human-led monitoring across endpoints, network, cloud, and SaaS.
How much does managed ransomware protection cost?
DivergeIT’s SecureIT starts at $450/mo for Core, which includes 24/7 MXDR and ITDR, $1,875/mo for Plus, and $3,125/mo for Pro with LAN zero-trust segmentation. Pricing is per device, confirmed by quote, and lower when bundled with ManageIT.
How often should backups be tested for ransomware recovery?
Regularly enough that you trust the result. DivergeIT’s ManageIT Pro includes scheduled recovery testing, and ComplyIT Plus adds quarterly backup testing with documented recovery time and recovery point objectives (RTO/RPO).
