Top 5 Things Small Businesses Should Do to Protect Themselves

Cybersecurity Doesn’t Have to Be Overwhelming

If you run a small business, cybersecurity can feel like a mountain you’ll never climb. There’s an endless stream of threats, technical jargon, and expensive-sounding solutions. It’s tempting to push it to the bottom of the to-do list and hope for the best.

But here’s the reality: small businesses are the primary target of cyber attacks, not large corporations. According to recent data, 43% of all cyber attacks target small businesses, and the average cost of a data breach for a small company exceeds $100,000. Many never recover.

The good news? You don’t need an enterprise budget or a team of security experts to dramatically reduce your risk. The five steps below cover the fundamentals that stop the vast majority of attacks. Get these right, and you’ll be ahead of most businesses your size.

1. Turn On Multi-Factor Authentication Everywhere

If you only do one thing on this list, make it this one. Multi-factor authentication (MFA) adds a second step to logging in – typically a code sent to your phone or generated by an app – so that a stolen password alone isn’t enough for an attacker to get in.

Microsoft reports that MFA blocks 99.9% of automated account compromise attacks. That’s not a typo. Almost every account takeover that succeeds does so because MFA wasn’t enabled.

Start with the accounts that matter most:

• Email – the gateway to password resets for everything else
• Banking and financial platforms – where the money is
• Cloud services (Microsoft 365, Google Workspace, file sharing) – where your data lives
• Remote access tools (VPN, remote desktop) – the front door to your network

Most platforms offer MFA for free. There’s no reason not to have it enabled on every business account today. If you’re not sure how to set it up, any managed IT provider can have it configured for your entire organization in a matter of hours.

2. Keep Your Software and Systems Updated

Unpatched software is one of the most common ways attackers get into business networks. When a vendor releases a security update, it’s because they’ve found a vulnerability – and once that update is public, attackers know exactly what hole to look for in systems that haven’t been patched yet.

Some of the largest breaches in history happened because organizations failed to install patches that had been available for weeks or months. The WannaCry ransomware attack that crippled businesses worldwide exploited a vulnerability that Microsoft had patched two months earlier.

What to do:

• Enable automatic updates on all workstations, laptops, and mobile devices
• Patch critical vulnerabilities within 48 hours of a security update being released
• Don’t forget network equipment – firewalls, routers, switches, and Wi-Fi access points all need firmware updates too
• Retire end-of-life software – if it no longer receives security updates, it’s a liability

If managing patches across your entire environment sounds like a lot of work, that’s because it is. This is one of the core services a managed IT provider handles for you – ensuring every device is current, every patch is applied, and nothing slips through the cracks.

3. Train Your Employees to Spot Threats

Technology can block a lot of threats, but it can’t stop an employee from willingly entering their credentials on a convincing fake login page. Phishing remains the number one attack vector for small businesses, and it works because it targets people, not systems.

Today’s phishing emails are sophisticated. They impersonate vendors, executives, and even IT departments. They create urgency (“Your account will be locked in 24 hours”) and use legitimate-looking branding. Your employees need to know what to look for.

An effective training program includes:

• Regular security awareness sessions – not a one-time onboarding video, but ongoing education at least quarterly
• Simulated phishing tests – send realistic fake phishing emails to your staff and track who clicks. This builds real-world recognition skills in a safe environment
• Clear reporting procedures – employees should know exactly what to do when they receive a suspicious email (forward it, don’t click, report to IT)
• No-blame culture – if someone does click a bad link, they need to feel safe reporting it immediately rather than hiding it out of fear

The goal isn’t to make everyone a security expert. It’s to build a healthy habit of pausing and thinking before clicking.

4. Back Up Your Data and Test Your Backups

Backups are your last line of defense. If ransomware encrypts your files, if a server fails, if an employee accidentally deletes a critical folder – a solid backup means the difference between a minor inconvenience and a business-ending disaster.

But having backups isn’t enough. You need to test them. We’ve seen too many businesses discover their backup system was silently failing for months – and they only found out when they desperately needed to restore.

Follow the 3-2-1 rule:

• 3 copies of your data (the original plus two backups)
• 2 different types of storage (local drive plus cloud, for example)
• 1 copy offsite – if your office floods or burns, your backups shouldn’t be in the same building

Additionally:

• Automate backups so they run daily without anyone needing to remember
• Test restores at least monthly to confirm backups are actually working
• Keep at least 30 days of backup history so you can recover from issues that aren’t discovered immediately
• Ensure backups are encrypted and protected from ransomware (attackers increasingly target backup systems first)

5. Use Business-Grade Security Tools

The free antivirus that came with your computer and the consumer-grade router from the electronics store are not designed to protect a business. They lack centralized management, advanced threat detection, and the kind of real-time monitoring that catches attacks in progress.

Business-grade security doesn’t have to mean enterprise-level complexity or cost. At minimum, every small business should have:

• Endpoint Detection and Response (EDR) – next-generation antivirus that monitors behavior, not just known virus signatures. It can detect and stop threats that traditional antivirus misses entirely
• Business-grade firewall – with intrusion prevention, content filtering, and VPN capabilities. Consumer routers don’t offer any of this
• Email security filtering – catches phishing, malware attachments, and spam before they reach your employees’ inboxes
• DNS filtering – blocks access to known malicious websites, even if someone clicks a bad link

These tools work together to create layers of defense. No single product stops everything, but when properly configured and monitored, they make it exponentially harder for an attacker to succeed. A managed security provider can deploy and monitor all of this for a predictable monthly cost.

Where to Start

If this list feels like a lot, start with step one – MFA. You can enable it today, it costs nothing, and it immediately eliminates the single largest category of attacks against small businesses. Then work through the rest of the list at whatever pace makes sense for your organization.

The important thing is to start. Cybercriminals aren’t waiting, and the common mistakes small businesses make are well-known and heavily exploited. Every step you take makes your business a harder target, and attackers will move on to easier ones.

If you want to know exactly where your business stands today, a professional security assessment can pinpoint your specific gaps and give you a clear, prioritized action plan.

Related Questions