You don't need an enterprise budget — you need the right basics
Most small businesses assume they're too small to be a target. The opposite is true. Attacks are automated: bots scan every public IP address, leaked passwords are tested against every login page, and phishing kits hit millions of inboxes at once. You don't get attacked because you're interesting — you get attacked because you're reachable.
The good news: effective cybersecurity for a small business isn't about buying enterprise tools. The attacks that actually hit SMBs are rarely sophisticated, and a handful of inexpensive, consistently applied measures stops the vast majority of them.
The realistic threat model for an SMB
Forget nation-state hackers and Hollywood scenarios. In practice, four things cause most incidents:
- Phishing. An email that looks like an invoice, a courier notification, or a Microsoft 365 login prompt. One click, one password typed into a fake page — and the attacker is in.
- Credential reuse. An employee's password leaks from some unrelated breached website. If the same password protects your business email or admin panel, that breach is now yours.
- Unpatched software. Old CMS plugins, forgotten servers, VPN appliances without updates. Automated scanners find these within hours of a vulnerability being published.
- Ransomware. Usually the end stage of one of the above: attackers get in, encrypt your data, and demand payment. For a business without working backups, this is existential.
Exotic zero-days and insider spies exist — but they're not what takes down a 15-person company.
The 20% of measures that stop 80% of attacks
1. Multi-factor authentication (MFA) — everywhere that matters
Start with email, then admin panels, cloud consoles, and banking. MFA turns a stolen password from a catastrophe into a non-event. It costs almost nothing and is, in most cases, the single highest-return security measure available.
2. Patch relentlessly — prioritize what's internet-facing
Turn on automatic updates for operating systems and browsers. Then inventory everything exposed to the internet — website, CMS, VPN, remote access — and make sure someone owns keeping it current. Most exploited vulnerabilities have had a patch available for months.
3. Backups on the 3-2-1 rule
Three copies of your data, on two different types of storage, with one copy offsite — ideally offline or immutable, so ransomware can't encrypt it too. Then, critically, test a restore. A backup you've never restored from is a hope, not a plan.
4. A password manager for the whole team
Long, unique, generated passwords for every service, and shared vaults instead of spreadsheets and sticky notes. This one tool kills credential reuse.
5. Least privilege
Nobody gets admin rights unless the job requires them, and access is revoked the day someone leaves. Granular permissions are how serious platforms are built — Finsense, the financial platform we develop, ships with 243 permission settings across 22 categories precisely so businesses control who sees what. You don't need 243, but you do need more than "everyone is admin."
When to commission a security audit or penetration test
The five basics are things you can largely do yourself. An external assessment makes sense when:
- You handle personal, financial, or health data at any real volume.
- You're about to launch (or have just launched) a customer-facing application.
- A client, partner, or insurer is asking about your security posture.
- You've grown past the point where anyone knows what's actually running.
A vulnerability assessment — automated scanning plus manual review — is the affordable starting point. A full penetration test, a simulated attack under realistic conditions, makes sense for higher-risk systems. As a rule of thumb: audit at least annually and after any major release. Our cybersecurity and IT auditing service covers both, with severity-rated findings and a prioritized remediation plan instead of a 100-page PDF nobody reads.
What GDPR expects at minimum
GDPR doesn't prescribe specific products, but Article 32 requires "appropriate technical and organisational measures." For an SMB, that typically means at minimum:
- Access control and encryption for personal data, in transit and at rest.
- The ability to restore data after an incident — working, tested backups.
- Regular testing of your measures, which is where audits come in.
- A record of what personal data you process and why.
- The ability to detect a breach and notify the regulator within 72 hours.
If MFA, patching, backups, and least privilege are in place, you've already covered a large share of the technical side.
Your prioritized starter checklist
- This week: MFA on email and admin accounts; automatic updates turned on.
- This month: password manager rolled out; 3-2-1 backups with a tested restore; inventory of everything internet-facing.
- This quarter: least-privilege review; same-day offboarding process; a one-page incident plan (who to call, what to shut down, how to notify).
- This year: an external security audit or penetration test if you handle sensitive data.
Doing steps 1–3 consistently matters more than any tool purchase. And if nobody on your team has time to own patching, monitoring, and backups, that's a solvable problem too — it's exactly what managed IT services exist for.
Want to know where your real gaps are? Get in touch — we'll scope a security audit in a free 30-minute call.