Cybersecurity basics every SMB should have in place
The short list of security controls that stop the majority of attacks on small businesses — and how to set each one up without a big budget.
Most small-business breaches don't come from sophisticated, movie-style hackers. They come from a stolen password, an unpatched laptop, or an employee clicking a convincing email. The good news: a handful of basic controls stop the overwhelming majority of these attacks.
Here's the short list we'd want every SMB to have in place.
1. Multi-factor authentication (MFA), everywhere
If you do only one thing this quarter, make it MFA. Turn it on for:
- Email (Microsoft 365 / Google Workspace)
- VPN and remote access
- Your banking and financial tools
- Any admin account
MFA blocks the vast majority of account-takeover attacks, even when a password is stolen. It's usually free and takes minutes per account.
2. Keep everything patched
Attackers scan the internet for known, unpatched vulnerabilities. Turn on automatic updates for operating systems and browsers, and put a process in place for the apps that don't update themselves.
A vulnerability that's been patched for months is still a doorway if you haven't applied the patch.
3. Back up — and test the restore
Ransomware is a backup problem as much as a security problem. Follow the 3-2-1 rule: three copies of your data, on two types of media, with one copy offsite (or in the cloud). Then actually test that you can restore. An untested backup is a hope, not a plan.
4. Protect your endpoints
Built-in antivirus is no longer enough. Modern endpoint detection and response (EDR) tools catch suspicious behavior, not just known malware, and let you contain a compromised device quickly.
5. Train your people
Your team is your largest attack surface. A short, regular security-awareness program — plus simulated phishing — measurably reduces click rates over time.
Where to start
You don't have to do everything at once. The point of a risk assessment is to tell you which of these matters most for your business right now, so you fix the highest-impact gaps first.
Ready to see where you stand? Start a free assessment — it takes about ten minutes.