Multi-Factor Authentication (MFA) on all accounts, especially email, admin, and financial accounts. MFA blocks 99%+ of automated credential attacks. Enabling TOTP-based MFA (authenticator app) takes less than an hour and is the highest-ROI security control available.

If you do nothing else: enable MFA everywhere you can today. Start with: email (Microsoft/Google), cloud services (AWS/Azure/GCP), banking portals, and any admin console.

In 75–80% of SMB ransomware cases, the initial access comes through one of three vectors:

Beyond the ransom itself, costs include: downtime productivity losses, incident response and forensics, legal and regulatory costs, customer notification, reputation damage, and potential regulatory fines. IBM's 2024 Cost of a Data Breach report places the global average at $4.45 million.

For an SMB specifically, even a minor ransomware event at $10K–50K in combined costs can be existential. Sophos' 2024 SMB ransomware report found the average SMB paid $6,600 in ransom and $52,000 in total recovery costs.

The 3-2-1 rule: keep 3 copies of your data, on 2 different types of media, with 1 stored offsite.

The critical addition against ransomware: at least one backup must be immutable (cannot be deleted or encrypted by an attacker) or stored air-gapped (offline). Ransomware specifically targets backup systems because it knows that backups are the organization's last line of defense.

• 3 copies = original data + 2 backups
• 2 media types = e.g., cloud backup + external hard drive
• 1 offsite = cloud or remote location not accessible from local network
• Immutable or air-gapped = not deletable by compromised credentials

Tabletop exercises: twice a year. Each exercise is a 1–2 hour guided walkthrough where the team discusses how they would respond to a specific scenario (ransomware, phishing breach, data exfiltration).

Full backup restoration tests: quarterly. This is the only way to verify your RTO and RPO are achievable. Many organizations discover too late that their "backup" hasn't been running for months.

Phishing simulations: monthly. Send simulated phishing emails to staff and track click rates. Target: below 5% click rate after 12 months of training.

Traditional antivirus matches files against a database of known malware signatures. It catches ~40–50% of threats. EDR (Endpoint Detection and Response) adds behavioral analysis — it monitors processes, network connections, registry changes, and file activity in real time, flagging anything that looks suspicious even if the malware is brand new.

SMB-friendly EDR options: Microsoft Defender for Endpoint (included with M365 Business Premium), SentinelOne, CrowdStrike Falcon Go.

Layer your defenses — no single control is perfect:

• Email gateway with URL sandboxing and attachment detonation (Microsoft Defender for Office 365, Google Workspace, Proofpoint)
• External email banners — tag all emails from outside the organization so staff know to scrutinize them
• DNS-based filtering on endpoints and networks — block known malicious domains before they load (Cloudflare Gateway, Quad9 DNS)
• Phishing simulation + training — KnowBe4, Cofense, or free via Gophish
• Report button — make it easy for staff to flag suspicious emails with a one-click "Report Phishing" button
• Verify by voice — establish a policy that any urgent financial request must be confirmed by phone call to a known number

Common regulations that apply to SMBs depending on industry and geography:

Enforce minimum 14-character passphrases and require unique passwords per account via a password manager. Eliminate password complexity rules (they push users toward predictable patterns) — the National Institute of Standards and Technology (NIST SP 800-63B) explicitly recommends against complexity rules.

• Password manager for all accounts: Bitwarden (free, open source), 1Password, or LastPass
• No password reuse across accounts
• No password hints or security questions (use password manager notes instead)
• Account lockout after 5–10 failed attempts
• Disable or change default credentials on all devices and software immediately on setup

Remote work expands the attack surface. Key controls:

• MFA everywhere — non-negotiable for remote access
• VPN for access to internal resources; require MFA to connect
• Device management (MDM/ MAM) — enforce encryption, remote wipe capability on all remote devices (Microsoft Intune, Jamf for Mac, Kandji)
• Home router security — document home worker router model and ensure firmware is updated; use a VPN for all work traffic
• Separate work and personal devices — enforce policy; personal devices should not access work systems
• Endpoint EDR on all remote devices — monitor for anomalous behavior regardless of location

Managed Detection and Response (MDR) is 24/7 outsourced monitoring, threat detection, and incident response by a dedicated security operations center (SOC). You get a team of security analysts watching your environment around the clock — without the cost of hiring them in-house.

SMBs need MDR if: you have no dedicated IT security staff, you have sensitive customer data, your team handles financial transactions, or you cannot afford to have a breach go undetected for days.

Contain → Assess → Notify → Remediate → Review

• Contain immediately: isolate affected systems by disconnecting from the network. Change all credentials that may be compromised. Preserve logs before touching anything.
• Assess scope: what data was accessed? Was it exfiltrated? How did the attacker get in? Identify the blast radius.
• Notify: GDPR requires 72-hour notification to supervisory authority. HIPAA requires notification within 60 days of discovery. Many states have their own breach notification laws with specific timelines (typically 30–60 days).
• Remediate: close the attack vector, remove attacker persistence mechanisms, restore from clean backups.
• Post-incident review: document what happened, what controls failed, what will change. This is how you improve.

Cyber insurance (also called cybersecurity insurance or cyber liability insurance) helps cover the financial costs of a data breach or cyber incident. It typically has two components:

Average SMB cyber insurance premiums range from $500–$3,000/year for $1M in coverage, depending on company size, industry, revenue, and security posture. Deductibles typically range from $1,000–$10,000.

Factors that affect your premium: whether you require MFA, have documented incident response procedures, conduct regular backups, and provide security awareness training to employees.

Cyber insurance does not replace security controls — it transfers residual financial risk after you've implemented reasonable safeguards.

An incident response plan (IRP) documents how your team will detect, contain, and recover from security incidents. For an SMB, a concise, practical plan is better than an elaborate one nobody reads.

The six phases of incident response:

1. Preparation — assign roles (incident commander, communications lead, technical lead); document contact procedures; ensure tools are ready before anything happens.
2. Identification — detect anomalous activity: unusual logins, unauthorized access, ransomware notes, unexpected data exfiltration.
3. Containment — isolate affected systems immediately. Disconnect from the network; change credentials; preserve evidence. Do not wipe systems before forensics.
4. Eradiation — remove the attacker from all systems. Close the attack vector; remove malware, backdoors, and persistence mechanisms.
5. Recovery — restore systems from clean backups; verify integrity; gradually resume operations with enhanced monitoring.
6. Lessons Learned — post-incident review within 2 weeks. Document what happened, what controls worked, what failed, and what changes will prevent recurrence.

See also: the SMB Cybersecurity Handbook for a deeper walkthrough of each layer of defense that reduces incident likelihood in the first place.

Threat detection for SMBs falls into two tiers: automated tooling that runs 24/7, and manual checks you can do monthly. The goal is to detect a breach before it becomes a crisis — dwell time for SMBs averages 72 hours, so faster detection directly reduces damage.

Essential automated tooling:

• EDR on all endpoints (Microsoft Defender for Endpoint, SentinelOne, or CrowdStrike Falcon Go) — monitors process behavior, file changes, and network connections on every device in real time.
• Email security with link detonation — sandbox links before delivery, detonate attachments in isolated environments (Microsoft Defender for Office 365, Proofpoint Email Protection).
• DNS-based filtering — block known-malicious domains at the DNS layer before they can connect (Cloudflare Gateway, Quad9 DNS, OpenDNS).
• Cloud infrastructure monitoring — if you use AWS/Azure/GCP: enable GuardDuty, Security Hub, or Azure Defender for cloud-native threat detection.

Monthly manual checks (do-it-yourself audit):

• Review access logs — check for logins from unusual locations, at unusual hours, or with unusual failure patterns. Enable login anomaly alerts in Google Workspace/Microsoft 365.
• Audit user accounts — remove inactive accounts, check for accounts with excessive privileges, verify no shared or default credentials remain.
• Review backup integrity — confirm backups are running, test restoration on a sample file, verify immutability settings on cloud backups.
• Check software patch status — review the patch management dashboard for any critical or high-severity patches older than 30 days.

Industry benchmarks suggest SMBs should spend 5–10% of annual revenue on IT, with cybersecurity representing 10–20% of that IT budget — roughly 0.5–2% of total revenue. For a company with $2M in revenue, that is approximately $10,000–$40,000 per year on IT security. This may sound high, but the average ransomware ransom for an SMB is $150,000–$500,000, plus downtime costs, legal fees, and reputational damage — making prevention far cheaper than recovery.

Priority-based spending allocation:

Budget by company size:

• 1–10 employees: Focus on M365 Business Premium (~$22/user/mo — includes Defender + email security) + automated backup. Total: ~$300–600/month.
• 10–50 employees: Add dedicated EDR, DNS filtering, and security awareness training platform. Total: ~$800–2,500/month.
• 50–200 employees: Consider a vCISO to build a security program roadmap. Add vendor risk management and incident response retainer. Total: ~$3,000–10,000/month.

Zero Trust is a security model based on one principle: never trust, always verify. Every user, device, and request is treated as potentially compromised — regardless of whether it originates inside or outside the corporate network perimeter. The traditional castle-and-moat model (hard exterior, soft interior) fails because 60–80% of breaches involve lateral movement from inside the network once an attacker gains initial access.

The five core Zero Trust pillars:

Realistic SMB Zero Trust roadmap (12–18 months, no enterprise team needed):

• Month 1–3: Enforce MFA on all accounts (M365, Google Workspace, AWS/Azure console). Enable conditional access policies blocking legacy auth. Inventory all SaaS apps and move to SSO where possible.
• Month 4–6: Deploy endpoint management (Intune for Windows, JAMF for Mac). Enforce device compliance policies before allowing email/SaaS access. Segment the network: isolate HR/finance systems from general user subnets.
• Month 7–12: Replace VPN with Zero Trust Network Access (ZTNA) — Cloudflare Access, Twingate, or Azure Conditional Access App Proxy are SMB-accessible options. Begin data classification and label sensitivity tiers.
• Month 13–18: Integrate threat signals across identity + device + network into a unified view. Automate response: if a device fails compliance check, revoke access automatically. Review and tighten least-privilege on all privileged accounts.

Third-party vendors — especially SaaS providers, managed service providers (MSPs), and cloud platforms — often have direct access to your systems, data, or network. A vendor breach can be as damaging as a direct attack on your business.

Step 1: Inventory all vendors with access. Maintain a vendor register covering: vendor name, service provided, data accessed, access level (read-only, admin, API), contract end date. Review this quarterly. Common high-risk vendors include: email providers, accounting software, CRM platforms, IT support firms, and payroll systems.

Step 2: Assess vendor security posture before onboarding. Request a Security Questionnaire (SIG Lite or CAIQ), ask for SOC 2 Type II reports, verify ISO 27001 certification, and confirm their incident notification process. Do not sign contracts with vendors that cannot provide any security documentation.

Step 3: Enforce least-privilege access. Use OAuth or SSO integrations instead of sharing credentials. Rotate API keys regularly. Revoke access immediately when a vendor relationship ends. For MSPs with remote access, require dedicated privileged access management (PAM) tools.

Step 4: Monitor vendor access continuously. Enable audit logs for all vendor-integrated systems. Set up alerts for unusual login times, geographic anomalies, or bulk data exports. If your MSP uses RMM tools, ensure those RMM dashboards are included in your own security monitoring.

Step 5: Include security requirements in vendor contracts. Require: notification of breaches within 24–72 hours, compliance with your industry standards (SOC 2, HIPAA, PCI DSS as applicable), right to audit, and data deletion upon contract termination.

Annual review cadence: Re-assess all vendors with privileged access at least once per year. Offboard vendors that no longer have a business justification for access.