Cybersecurity for Small Business

Cybersecurity for small business starts with six controls

A small business gets most of its protection from six controls, in this order: MFA, endpoint detection and response (EDR or MDR), email security, protected backups, patching and staff training. The order follows how attacks start. Insurers ask for the same list, and CISA's small business guidance and the SBA name most of them ⁴⁵.

The costs are smaller than most owners expect. Using published list prices and ranges:

For a 25 person office, adding EDR, email filtering, Microsoft 365 backup and training at the low to middle of these ranges comes to a few hundred dollars a month by our arithmetic. Bundled into managed IT, a 2026 published guide puts managed IT at $100 to $250 per user per month ¹⁴. Our managed IT pricing guide breaks that down.

The threats that hit small firms most

Small firms are hit hardest by three things: business email compromise, ransomware and stolen or guessed passwords.

• Business email compromise (BEC). An attacker takes over or imitates an email account and redirects a payment. The FBI's IC3 received 24,768 BEC complaints in 2025 with about $3.05 billion in reported losses ¹. In Coalition's 2025 claims data, BEC and funds transfer fraud made up 58% of incidents ¹⁵.
• Ransomware. The 2026 Verizon Data Breach Investigations Report found ransomware in 48% of all breaches ³, and a summary of the report says small organizations made up 96% of ransomware victims in its data ¹⁶.
• Credential theft and unpatched systems. In the 2026 DBIR, exploitation of vulnerabilities became the most common way in, at 31% of breaches, with credential abuse at 13% ¹⁷. Sophos found 79% of ransomware attacks in its 2026 survey began with compromised identities ¹⁸.
• Suppliers. Third parties were involved in 48% of breaches in the 2026 DBIR ¹⁷, which is why your IT provider's own security matters.

Across all crime types, IC3 logged 1,008,597 complaints and $20.877 billion in reported losses in 2025 ¹. In a 2025 Identity Theft Resource Center survey of businesses with 500 or fewer employees, 81% said they had suffered a security breach ¹⁹.

MFA and email security for small business

MFA is the single most effective control for a small business and is usually already paid for. A Microsoft study of its business accounts found MFA reduces the risk of account compromise by 99.22% ². CISA tells small businesses to mandate MFA with technical controls, "not faith," and to enable it on all administrator accounts ⁴. The SBA singles out financial, accounting and payroll accounts ⁵.

Where MFA matters most:

• Email, because almost every BEC and many ransomware attacks start there.
• Remote access: VPNs, remote desktop tools and cloud admin portals. At-Bay found 80% of ransomware attacks against its insureds came through a remote access tool ²⁰.
• Banking, payroll and accounting systems.
• Your IT provider's own access to your systems.

Prefer an authenticator app or phishing-resistant keys over text messages where you can.

Email security adds filtering for malicious links, attachments and look-alike domains. Microsoft Defender for Office 365 lists at $2 per user per month for Plan 1 and $5 for Plan 2 ¹⁰; third-party filters cluster around a median of $5 per user at list ¹¹. Pair it with a simple payment rule: any request to change bank details gets a call-back to a number you already have, never one in the email.

Endpoint security, backups and patching

Endpoint protection, backups and patching are the controls that decide whether an attack is caught early and whether you can recover without paying.

Endpoint detection and response. Traditional antivirus is no longer enough. EDR records what happens on each device and can stop and isolate a machine. Tools list at $3 to $20 per endpoint per month ⁶. The catch is that someone has to watch the alerts, nights and weekends included. Managed detection and response (MDR) adds a 24/7 team for about $8 to $25 per endpoint per month ⁸. Our managed detection and response guide compares the options.

Backups. Keep at least one copy that attackers cannot reach or delete, and test restores. CISA tells small businesses to regularly test partial and full restores ⁴. Published guides put managed backup for a 20 to 50 person office at $300 to $1,200 a month ²¹. See our backup and disaster recovery guide.

Patching. Set updates to install automatically, as the SBA advises ⁵, and replace anything past end of support. Windows 10 support ended October 14, 2025; staying on it with security updates means paying for Extended Security Updates at $61 per device in year one, doubling each year ²². Firewalls and VPN appliances need patching too; a managed firewall service handles that for about $50 to $300 a month ²³.

What you can do yourself and what to buy

A business with a capable office manager can set up several controls itself; 24/7 monitoring and recovery are the parts to buy.

Do it yourself (with Microsoft's or Google's admin guides):

• Turn on MFA for every user and admin, and remove admin rights from daily accounts.
• Turn on automatic updates for Windows, macOS, browsers and phones.
• Enable the email filtering and endpoint protection your existing plan includes.
• Write the payment call-back rule and a one-page incident plan.
• Use free resources: CISA's Cross-Sector Cybersecurity Performance Goals are built to help small and medium-sized organizations start with a limited set of essential actions ²⁴.

Buy from a provider:

• 24/7 alert monitoring and response (MDR or a managed security service).
• Backup design, immutable storage and restore testing.
• Firewall and remote access hardening.
• A cybersecurity risk assessment and, if customers ask for proof, penetration testing.

If you already pay a managed IT provider, ask which of the six controls they deliver today and in writing. Our managed security services guide explains the next step up, and our managed IT for small business guide covers the full support picture.

Why insurers and customers now ask for these controls

Insurers, larger customers and regulators now ask for the same controls before they will cover or work with you. Marsh says adopting certain controls has become a minimum requirement of insurers, and its list starts with MFA, email filtering, protected and tested backups, privileged access management, EDR and patching ²⁵. Our cyber insurance requirements guide covers the application questions in detail.

Regulated firms face written requirements:

• Tax preparers, mortgage brokers and other non-bank financial firms must use MFA for anyone accessing their information systems under the FTC Safeguards Rule, unless their Qualified Individual approves equivalent controls in writing ²⁶. See our WISP guide.
• Healthcare practices fall under the HIPAA Security Rule; see our HIPAA compliance checklist.
• Defense contractors that handle CUI must implement NIST SP 800-171; see our CMMC overview.

Larger customers increasingly send security questionnaires to suppliers, since third parties were involved in 48% of breaches in the 2026 DBIR ¹⁷. Having the six controls in place, and being able to show them, makes those questionnaires a formality instead of a lost deal.