Cybersecurity for Small Business
"We're too small to be a target" is the belief that gets small businesses breached. Attacks are automated and indiscriminate; small firms are hit more often because they pay ransoms faster, litigate less, and rarely have dedicated security. The good news is that you don't need an enterprise budget — a handful of fundamentals stops the overwhelming majority of what actually happens.
The short list that does the heavy lifting
- MFA everywhere it's offered — email, banking, cloud apps, remote access. Phishing-resistant (passkeys/security keys) on the accounts that matter. This single control defeats the leading cause of small-business compromise.
- Backups, offline and tested. Follow 3-2-1 with at least one copy the ransomware can't reach, and prove it by actually restoring. Backups are what turn a ransomware attack from an extinction event into a bad week.
- Patch and auto-update everything — computers, phones, the router, and especially anything reachable from the internet.
- Use business-grade tools. A password manager for the team, reputable endpoint protection, and separate accounts per employee (no shared logins). Standard user accounts for daily work, admin only when needed.
The scam that targets small businesses specifically
Business email compromise (BEC) is the most expensive threat most small firms will face, and it's not technical. A criminal spoofs or hijacks an executive's or vendor's email and asks for an urgent wire transfer or a change of payment details. No malware, just a convincing message. The defense is a rule, not a product: verify any payment or banking-detail change by calling a known number — never the number in the email. Make it policy, and make it un-embarrassing for staff to slow down and confirm.
People are your perimeter
Your employees decide most outcomes. Train them briefly and regularly to recognize phishing, to report anything suspicious without fear of blame, and to know who to call when something feels wrong. A short quarterly conversation beats a thick annual policy nobody reads. Cover the basics from this collection — passwords, phishing, Wi-Fi.
Plan for the bad day
- Write down what to do if you're breached: who to call (IT/MSP, bank, insurer, lawyer), how to isolate systems, how to restore. One page, printed.
- Know your obligations. Breaches involving customer data trigger notification duties — understand yours before you need them.
- Consider cyber insurance, and read the exclusions — many require MFA and backups to pay out, which is another reason to have them.
- Vet your vendors and MSP. Their security is your security; ask how they protect your data and access.
Stop believing you're too small to target. Think of MFA and tested backups as the seatbelt and airbag — cheap, boring, and the difference between a scare and a catastrophe. Connect a "call to verify" rule to every payment, and you've closed the most expensive door.