Ransomware-as-a-Service lets criminals rent attacks. This article assesses its impact on small and medium enterprises and the controls that reduce exposure.