Top 5 Things Small Businesses Should Do to Protect Themselves

Cybersecurity Doesn’t Have to Be Overwhelming

If you run a small business, cybersecurity can feel like a mountain you’ll never climb. There’s an endless stream of threats, technical jargon, and expensive-sounding solutions. It’s tempting to push it to the bottom of the to-do list and hope for the best.

But here’s the reality: the idea that you’re too small to be worth attacking is comfortable and wrong. Small businesses are among the most common victims in breach investigations – attackers pick targets by opportunity, not by company size. Most of what reaches you is automated, indiscriminate, and looking for the same handful of weaknesses on every network it touches. And for a small business, recovering from a serious incident routinely runs into the tens of thousands of dollars once you count forensics, rebuild time, and lost work – before any ransom, fine, or lost customer.

The good news? You don’t need an enterprise budget or a team of security experts to dramatically reduce your risk. The five steps below cover the fundamentals that stop the vast majority of attacks. Each one is paired with the mistake we actually see when we walk into a new client’s environment, because these five items are not abstract best practices – they’re the five gaps we find over and over. Get them right and you’ll be ahead of most businesses your size.

1. Turn On Multi-Factor Authentication Everywhere

The mistake we see: passwords doing all the work on their own. Passwords get stolen through phishing, guessed by automated tools, and pulled out of somebody else’s breach where an employee reused theirs. Once an attacker has a working password and nothing else stands in the way, they simply log in like an employee – and nothing in your logs looks obviously wrong.

The fix: if you only do one thing on this list, make it this one. Multi-factor authentication (MFA) adds a second step to logging in – typically a code sent to your phone or generated by an app – so that a stolen password alone isn’t enough for an attacker to get in.

Microsoft’s research has consistently found that multi-factor authentication blocks more than 99% of automated account-compromise attempts. That’s the strongest single return available to you for the effort involved.

It is not, however, a force field, and anyone telling you otherwise in 2026 is behind. Adversary-in-the-middle phishing kits steal the session token after you approve the prompt, which defeats app codes and push approvals alike – the victim approves a login they genuinely started, and the attacker rides in on the resulting session. For finance, email admin, and anything touching money, use phishing-resistant MFA: passkeys or a hardware security key. Our MFA guide for business owners covers which method belongs where.

Start with the accounts that matter most:

• Email – the gateway to password resets for everything else
• Banking and financial platforms – where the money is
• Cloud services (Microsoft 365, Google Workspace, file sharing) – where your data lives
• Remote access tools (VPN, remote desktop) – the front door to your network

Most platforms offer MFA for free. There’s no reason not to have it enabled on every business account today. If you’re not sure how to set it up, any managed IT provider can have it configured for your entire organization in a matter of hours.

2. Keep Your Software and Systems Updated

The mistake we see: updates postponed indefinitely because a reboot is inconvenient. Every delayed patch leaves a known hole open, and “known” is the operative word – the attacker doesn’t have to discover anything.

The fix: unpatched software is one of the most common ways attackers get into business networks. When a vendor releases a security update, it’s because they’ve found a vulnerability – and once that update is public, attackers know exactly what hole to look for in systems that haven’t been patched yet.

Some of the largest breaches in history happened because organizations failed to install patches that had been available for weeks or months. The WannaCry ransomware attack that crippled businesses worldwide exploited a vulnerability that Microsoft had patched two months earlier.

What to do:

• Enable automatic updates on all workstations, laptops, and mobile devices
• Patch critical and actively-exploited vulnerabilities within 72 hours, and run everything else on a weekly cycle
• Don’t forget network equipment – firewalls, routers, switches, and Wi-Fi access points all need firmware updates too
• Retire end-of-life software – if it no longer receives security updates, it’s a liability

If managing patches across your entire environment sounds like a lot of work, that’s because it is. This is one of the core services a managed IT provider handles for you – ensuring every device is current, every patch is applied, and nothing slips through the cracks.

3. Train Your Employees to Spot Threats

The mistake we see: a security video watched once during onboarding and never again, in a company where nobody is quite sure who to tell when an email looks wrong.

The fix: technology can block a lot of threats, but it can’t stop an employee from willingly entering their credentials on a convincing fake login page. Phishing email remains one of the most common ways attackers get in at businesses this size, and it works because it targets people, not systems.

Today’s phishing emails are sophisticated. They impersonate vendors, executives, and even IT departments. They create urgency (“Your account will be locked in 24 hours”) and use legitimate-looking branding. Your employees need to know what to look for.

An effective training program includes:

• Regular security awareness sessions – not a one-time onboarding video, but ongoing education at least quarterly
• Simulated phishing tests – send realistic fake phishing emails to your staff and track who clicks. This builds real-world recognition skills in a safe environment
• Clear reporting procedures – employees should know exactly what to do when they receive a suspicious email (forward it, don’t click, report to IT)
• No-blame culture – if someone does click a bad link, they need to feel safe reporting it immediately rather than hiding it out of fear

The goal isn’t to make everyone a security expert. It’s to build a healthy habit of pausing and thinking before clicking.

4. Back Up Your Data and Test Your Backups

The mistake we see: a backup job that has been quietly failing for months, discovered on the one morning it was needed. An untested backup is barely better than no backup at all – it just costs you the false confidence in between.

The fix: backups are your last line of defense. If ransomware encrypts your files, if a server fails, if an employee accidentally deletes a critical folder – a solid backup means the difference between a minor inconvenience and a business-ending disaster.

But having backups isn’t enough. You need to test them. We’ve seen too many businesses discover their backup system was silently failing for months – and they only found out when they desperately needed to restore.

Follow the 3-2-1 rule:

• 3 copies of your data (the original plus two backups)
• 2 different types of storage (local drive plus cloud, for example)
• 1 copy offsite – if your office floods or burns, your backups shouldn’t be in the same building

Additionally:

• Automate backups so they run daily without anyone needing to remember
• Test a restore quarterly to confirm backups are actually working, and do one full restore test a year
• Keep at least 30 days of backup history so you can recover from issues that aren’t discovered immediately
• Ensure backups are encrypted and protected from ransomware (attackers increasingly target backup systems first)

5. Use Business-Grade Security Tools

The mistake we see: consumer-grade security holding up a business. The free antivirus that came with your computer and the consumer-grade router from the electronics store are not designed to protect a business. They lack centralized management, advanced threat detection, and the kind of real-time monitoring that catches attacks in progress.

The fix: business-grade tools that all report to one place, so somebody can see the whole estate at once. The price gap between consumer and business security tools is small next to the cost of a single incident.

Business-grade security doesn’t have to mean enterprise-level complexity or cost. At minimum, every small business should have:

• Endpoint Detection and Response (EDR) – next-generation antivirus that monitors behavior, not just known virus signatures. It can detect and stop threats that traditional antivirus misses entirely
• Business-grade firewall – with intrusion prevention, content filtering, and VPN capabilities. Consumer routers don’t offer any of this
• Email security filtering – catches phishing, malware attachments, and spam before they reach your employees’ inboxes
• DNS filtering – blocks access to known malicious websites, even if someone clicks a bad link

These tools work together to create layers of defense. No single product stops everything, but when properly configured and monitored, they make it exponentially harder for an attacker to succeed. A managed security provider can deploy and monitor all of this for a predictable monthly cost.

Two Habits That Make All Five Stick

The five steps above are controls. These last two are the habits that keep them working, and in our experience they are what actually separates the businesses that stay out of trouble from the ones that buy the same tools and get breached anyway.

Write Down What You’ll Do When Something Goes Wrong

The mistake we see: no incident response plan. When something does happen, panic and confusion produce decisions that make it worse. Nobody knows who to call, which systems to isolate, whether to power a machine off (you shouldn’t – it destroys forensic evidence), or what to tell customers and when.

The fix: write the plan before you need it, and keep it somewhere you can reach when email is down – printed, or on a phone. It doesn’t need to be long. Who to contact: your internal lead, your IT provider, your cyber insurance carrier, legal counsel, and law enforcement. What to do first: isolate affected systems from the network without shutting them down, preserve logs, rotate credentials from a clean device. Who talks to customers, and who signs off on that. Then walk the plan through as a tabletop exercise once a year so it isn’t the first time anyone has read it. Our hour-by-hour walkthrough of what happens when a business gets hacked is a reasonable place to start drafting from.

Get Out of Reactive Mode

The mistake we see: assuming IT problems will fix themselves, or at least wait. Plenty of small businesses run entirely in reactive mode – something breaks, somebody calls someone. The trouble is that security gaps don’t announce themselves by breaking. They sit open for months or years while everything appears to work perfectly, and small problems compound quietly into the vulnerability that finally gets used.

The fix: make the work continuous rather than occasional. Patching, backup verification, monitoring, and security review are ongoing activities, not projects with an end date. That’s the whole argument for proactive IT management: somebody is looking at your environment on a Tuesday when nothing is wrong. If you’re still calling for help only after something breaks, it’s worth reading the signs your business has outgrown break-fix IT – the security consequences of reactive support are usually the ones that cost the most.

Where to Start

If this list feels like a lot, start with step one – MFA. You can enable it today, it costs nothing on most platforms, and it shuts down the bulk of the automated attacks that rely on a stolen password and nothing else. Then work through the rest of the list at whatever pace makes sense for your organization.

The important thing is to start. Cybercriminals aren’t waiting, and the gaps described above are well known and heavily exploited – they’re the same handful of weaknesses on almost every network we’re called into. Every step you take makes your business a harder target, and attackers will move on to easier ones.

If you want to know exactly where your business stands today, a professional security assessment can pinpoint your specific gaps and give you a clear, prioritized action plan.

Related Questions