What do you do to protect us from ransomware and phishing?

There is no single product that stops ransomware. What works is layers that each catch what the previous one missed:

• Multi factor authentication on email and remote access, no exceptions
• Next generation endpoint protection that watches behavior, not just known signatures
• Email filtering and protection against lookalike domains and forwarding rule abuse
• Patching on a schedule, because most successful attacks use known holes
• Least privilege on accounts so one compromised user is not the whole network
• Backups that are isolated and actually restore
• Log monitoring so a compromise gets noticed in hours, not months

We will not take on a client who refuses multi factor authentication and working backups. Those two are the floor.