@GossiTheDog I've seen a small org do it successfully. AWS platform with small EC2 instances running standard web SPAs and S3 based data deployments. No clustered DB or indexing stuff, just single instance. Recovery post ransom was fast and smooth once the attack vector was closed off. Data loss was negligible to nonexistent, but they also had quite low volumes of data change.