Cyber threats are increasing around the globe. Regardless of the size of your business, you will likely be a target sooner or later.

Speaking at Tuesday’s session, “Cyber Attacks Are Not a Matter of If, But When,” Andrew Buel, special agent with the Las Vegas Cyber Task Force of the FBI, said that there are a number of threats businesses face on a daily basis. Ransomware tops the list.

“I’m sure a lot of people in this room are familiar with ransomware and have heard of ransomware. There are actually over 700 different variants, so it’s a multimillion-dollar industry,” Buel said.

In addition to ransomware, Buel said phishing—using phony emails to gain access to a company’s systems—accounts for 80% of initial breaches into companies. The FBI offers a resource, the Internet Crime Complaint Center (IC3.gov), that provides information on the latest cyber threats as well as a place to report them. Buel said the FBI recommends contacting law enforcement as soon as possible after an incident.

“If you call us within three days of a wire transfer, we have a 75% success rate in getting money back,” he said. “So it is vital that you call us in those three days.”

Paul Suarez, vice president and chief information security officer at Casey’s General Stores Inc., said the best way to deal with these threats is to be prepared.

“Planning is everything, so you have to have a plan in place that guides you through the recovery,” he said. “And one of the best practices that I’ve seen is making sure you appoint an incident lead. That person will focus on the technical recovery of your systems.”

The plan should also include training exercises with your staff to walk them through threat education and mitigation as well as simple things like password management. One of the keys to that, Suarez said, is communication.

“How am I communicating, and do I have the contact list of those people that I need to call?” he said. “Are you going to be able to find the contact number for a critical [person] that you need? Just practice the plan. In the heat of battle, you’re going to resort to habits and things that have been ingrained, and the more you practice, the easier that becomes, versus ‘hey, we’ll just wing it when something happens.’”

Todd McClelland, partner in cybersecurity and data privacy at Sterlington Law, said that communication should extend to everyone affected by the incident.

“There is a 24-hour clock that starts when we have a payments-related breach,” he said. “There’s a lot of stuff we need to do in rapid succession, so you want to lay this out on your plate, but you want to be thinking about this in a calm mindset.”