Cybersecurity advice aimed at small businesses tends to arrive in one of two unhelpful forms: a wall of alarming statistics, or a list of enterprise controls that assume a security team you do not have.
What follows is neither. It is the baseline we look for when assessing a small business environment — a manageable number of controls that, in place and maintained, put a business meaningfully ahead of most organizations its size.
First, the mental model
The most useful correction to make early is this: the overwhelming majority of attacks affecting small businesses are not aimed at that business specifically.
They are broad and automated. Scanners look for exposed services across entire address ranges. Phishing campaigns go to every address that can be scraped or guessed. Credentials leaked from unrelated breaches get tried in bulk against other services, because password reuse is common.
This matters for two reasons. First, “we’re too small to be a target” misunderstands how targeting works. Second — and this is the encouraging part — defenses that stop automated, opportunistic attacks are considerably cheaper and simpler than defenses against a determined attacker who has chosen you specifically.
The baseline below is aimed squarely at the automated majority.
1. Multi-factor authentication, everywhere it is supported
If you do one thing, do this. Multi-factor authentication means a stolen or guessed password is no longer sufficient on its own to get into an account.
Enable it on email first, because email is the account that can reset the others. Then on remote access, financial systems, your accounting platform, and any administrative account anywhere.
Two implementation notes worth knowing. Authenticator apps and hardware keys are meaningfully stronger than SMS codes, which can be intercepted or redirected. And administrative accounts should have it without exception — an unprotected admin account undermines everything else.
2. Managed endpoint protection on every device
Every computer that touches business data needs protection that is centrally managed, not left to individual users.
The distinction that matters is between traditional antivirus, which matches known bad files, and endpoint detection and response (EDR), which watches for suspicious behavior — a process encrypting files rapidly, an unusual administrative action, a program calling out to somewhere it should not. Behavior-based detection catches things that signature matching does not.
The word “managed” is doing real work in that sentence. Protection that is installed but not monitored means nobody sees the alert when it fires.
3. Email filtering configured against phishing and spoofing
Email is how most attacks arrive. Not as sophisticated technical exploits, but as a message that looks routine: an invoice, a shared document, a password expiry notice, a request from a director who is traveling.
Beyond spam filtering, there are specific configurations that reduce impersonation — SPF, DKIM and DMARC records that make it substantially harder for someone to send email that appears to come from your domain. These are configuration changes rather than products, and many small business domains still do not have them set correctly.
A pattern worth training your team onThe most costly email attacks are rarely the obvious ones. They are quiet, plausible messages about payment details changing — often arriving in an existing conversation thread. Any change to bank details should be verified by phone on a number you already hold, never on a number supplied in the message.
4. Backups that are monitored and actually tested
Backups belong in a security baseline because they determine how bad a bad day becomes.
Three things to verify: that backups cover everything that matters (including Microsoft 365 data, which many businesses assume is covered by Microsoft and is not, in the sense of a recovery point you control); that someone checks they are running, rather than assuming silence means success; and that a restore has actually been tested.
Also worth knowing: backups reachable with everyday credentials from the everyday network are frequently targeted during ransomware incidents. Separation matters.
5. Patching on a schedule
A large share of successful automated attacks exploit vulnerabilities that were publicly known and had fixes available — sometimes for months.
Patching is unglamorous and easy to defer, which is exactly why it should be scheduled rather than left to individual users clicking “remind me tomorrow”. Include operating systems, business applications, browsers, and — the one most often forgotten — firewalls, routers, switches and access points.
6. Access that matches what people actually need
Two habits cause most of the damage here: everyday accounts holding administrative rights, and access accumulating over years without ever being removed.
Three practical rules. Administrative work should use a separate account from everyday email and browsing. Access should be granted based on role, not on who asked. And when someone leaves the business, access should be revoked the same day, across every system — including the ones IT did not set up.
7. A team that knows what to look for
Your staff see attacks before any tool reports them. That makes training a security control rather than a compliance exercise.
Useful training is short, regular and specific to how your business actually operates — the systems you use, the suppliers you pay, the kinds of request that would be plausible. What matters most is that people feel able to report a mistake immediately. An employee who clicks something and says so within five minutes has given you a manageable incident. The same click, unreported for a fortnight because they feared blame, is a different situation entirely.
8. A written plan for when something happens
Not a thick document. A page is enough: who gets contacted first, in what order; who can authorise disconnecting systems; where the backups are and who can restore them; how staff communicate if email is unavailable; and which clients or authorities may need to be notified.
The value of writing it down is that decisions get made calmly, in advance, rather than at 7am by whoever answered the phone.
Being realistic about what this does
This baseline is aimed at the automated, opportunistic attacks that make up the bulk of what small businesses face. It raises the cost of attacking you above the point where indiscriminate campaigns bother.
It is not a guarantee, and anyone offering you one is overselling. Security is a continuous process rather than a state you reach: your business changes, your tools change, and the controls have to be reviewed against how you actually work today rather than how you worked when they were configured.
What the baseline does give you is a clear answer to a question worth being able to answer — which risks are we carrying, do we know about them, and have we decided deliberately which ones to accept?
This article is general guidance and is not legal, regulatory or compliance advice. Technology and threats change — if you are making a decision based on it, check that it still reflects your current environment.