Actually, Windows Security has gotten pretty good. It has a nice white list policy with protected folders. I still use HitmanPro some, but I have upgraded to the Intercept X and use some of the professional version of BitDefender for server.
BUT.....there are only two 100% positive ways for protection from malware and especially from ransomware.
1. A complete online backup with incrementals nightly (still not 100%) plus unless you can boot from them, it can take a while to get your data back.
2. An air-gapped system using at least two drives so that ONE is always air-gapped. Taking home a backup is air-gapped during transit and at home, but while it is connected either during the day or during backup, it is prone to being attacked. Alternating two USB drives where when you add one for the backup, you either take the other one home (or as I do) put it in a safe three feet away, is the only sure way to protect yourself. At this point ransomware can only get to shares, but as most data needs to be shared, nearly all data is at risk. Backups are still the best defense against malware.
