Most small businesses I talk to assume security is something they’ll get to after the next hire, the next funding round, or the next quarter. Meanwhile the actual attacks they face aren’t sophisticated. They’re credential reuse, a stale admin account nobody disabled, an email that looked like it came from the CFO.
The good news is that the controls that stop those attacks are cheap and mostly one-time. The bad news is that the order matters, and most guides give you a list of forty things with no prioritization. Here’s the order I’d actually do them in.
1. Turn on MFA everywhere, starting with email
If you do one thing, do this. Email is the recovery mechanism for every other account you own. An attacker with your inbox can reset their way into your bank, your cloud provider, and your payroll system.
Enable multi-factor authentication on your email provider first, then your cloud accounts, then everything else. Prefer an authenticator app or a hardware key over SMS: SIM-swapping is real and not especially hard.
The part people skip: check that MFA is actually enforced, not just available. In Google Workspace and Microsoft 365 it’s a policy setting, and until you turn on enforcement, it’s opt-in, which in practice means half your team hasn’t done it.
2. Get every account under one identity provider
Shared logins are the single most common finding in small-business environments. One password for the company Twitter, one for the AWS root account, both in a shared spreadsheet, both known by two people who left last year.
Consolidating onto Google Workspace, Microsoft Entra, or Okta gives you three things that are hard to get any other way:
- One place to revoke access. Offboarding becomes one action instead of a checklist nobody follows.
- An audit trail. You can answer “who logged into that?” months later.
- Enforceable policy. MFA, session length, and device requirements apply everywhere at once.
If you’re too small for Okta, Google Workspace or Microsoft 365 with SSO configured for your major SaaS apps covers most of this at no extra cost.
3. Fix the offboarding gap
Ask yourself: if someone left today, how long until their access is actually gone? For most small companies the honest answer is weeks, and for some accounts, never.
Write the list of systems once. Not a policy document, but a literal checklist of every place a person can have an account. Then when someone leaves, you work the list. This takes an hour to build and it closes the most commonly exploited gap in small organizations.
4. Manage the laptops
Endpoint management is where small businesses tend to give up, because the enterprise tooling feels enormous. It isn’t necessary. What you need is:
- Full-disk encryption on. FileVault on macOS, BitLocker on Windows. Both are free and both are off by default in a surprising number of environments.
- Automatic OS updates enforced, not left to the user.
- A screen lock with a short timeout.
- The ability to wipe a lost device remotely.
Jamf Now, Microsoft Intune, or Apple Business Essentials handle all four for a few dollars per device per month. A stolen laptop with an encrypted disk is an inconvenience. Without one, it’s a breach notification.
5. Make backups you’ve actually restored from
Ransomware is the one category of attack that can genuinely end a small business, and the only reliable defense is a backup an attacker can’t reach.
Two rules:
- At least one copy is offline or immutable. A backup on a drive that’s always mounted, or in a cloud account that your compromised admin credentials can delete, is not a backup.
- Test a restore. An untested backup is a hypothesis. Restore one file this quarter and one whole system this year.
6. Train for the two attacks you’ll actually see
Skip the annual hour-long compliance video. Nobody retains it. Focus on the two things that account for most successful attacks on small companies:
- Business email compromise. Someone impersonates an executive or a vendor and asks for a payment or a wire change. The control is procedural, not technical: any change to payment details requires a verbal confirmation on a known phone number. Write that down and make it non-negotiable.
- Credential phishing. A convincing login page harvests a password. MFA blunts most of this, which is why it’s step one.
What this adds up to
None of the above requires a security team, and most of it is configuration rather than purchase. Done in this order, it addresses the overwhelming majority of what actually happens to small businesses, not the exotic threats but the ordinary ones.
What it doesn’t cover is anything specific to your environment: how your cloud infrastructure is configured, what your application exposes, what a customer’s security questionnaire is going to ask you. That’s the point where a review by someone who does this for a living starts to pay for itself.