Cybersecurity Essentials for Small Businesses
Most small businesses don't get breached by a sophisticated attack. They get breached because a password was reused, a laptop went six months without an update, or somebody clicked a link and there was nothing standing behind them. This guide covers the controls that actually stop those things — in the order we'd fix them.
We support businesses across Birmingham and Central Alabama, and the pattern almost never varies: the company is already paying for most of the protection it needs, and simply hasn't turned it on. Before you buy a single new product, work through this list.
Start here: the four controls that do the most work
If you only do four things, do these. In our experience they close off the large majority of the ways a small business actually gets compromised.
- Multi-factor authentication on every account. Not just email — your accounting package, your remote access, your domain registrar, and above all your administrator accounts. A stolen password is worth very little to an attacker who then hits an MFA prompt. This is the single highest-value control available to you, and if you're on Microsoft 365 Business Premium you already own it.
- Patching on a schedule you can prove. Attackers scan for known, already-fixed vulnerabilities. "We update when we remember" is not a schedule. You want operating systems, browsers, and third-party apps (Adobe, Java, Zoom) on automatic monthly cycles with reporting that shows what actually applied.
- Backups you have restored from at least once. An untested backup is a hope, not a control. Keep at least one copy offline or immutable so ransomware can't encrypt your backups along with everything else.
- Remove administrator rights from daily-use accounts. When a standard user gets compromised, the attacker gets a standard user. When an admin gets compromised, they get your network.
Everything below is worth doing. But if you're triaging with limited time and budget, those four come first, and they come in that order.
1. Identity: the new perimeter
Your firewall used to be the boundary of your business. Now your staff sign in from home networks, phones, and coffee shops, and your data lives in Microsoft 365 or Google Workspace. The thing separating an attacker from your business is a set of credentials.
What that means practically:
- Turn on MFA everywhere, then check for gaps. The common failure is enabling MFA for staff but leaving service accounts, shared mailboxes, or the "temporary" admin account exempt. Attackers look specifically for those.
- Block legacy authentication. Old mail protocols bypass MFA entirely. If they're still enabled in your tenant, your MFA rollout has a hole straight through it.
- Use a password manager. The point isn't complexity, it's uniqueness — so one breached site doesn't hand over your email too.
- Have a documented offboarding process. Ex-employees with live accounts are a genuinely common source of incidents, and it's an entirely self-inflicted one.
We've written a fuller walkthrough of the rollout in implementing MFA everywhere, including how to handle the staff who push back on it.
2. Email: where the attacks arrive
The overwhelming majority of incidents at small businesses start with an email. Two very different things are worth defending against.
Credential phishing is the fake login page. Modern versions proxy the real Microsoft login in real time and capture the session token, which means they can defeat basic MFA. Defending against it means phishing-resistant MFA (authenticator app number matching at minimum, security keys if you can) plus conditional access rules that only allow sign-in from known devices or locations.
Business email compromise involves no malware at all. Somebody impersonates your owner or a vendor and asks for a payment or a change of bank details. No security product reliably catches this, because there's nothing technically malicious in the message. The control is a process one: any change to payment details gets verified by phone, on a number you already had, no exceptions, regardless of who appears to be asking.
On the technical side, make sure SPF, DKIM, and DMARC are configured on your domain. Without them, anyone can send mail that appears to come from your company — to your customers, with your name on it. See phishing trends in 2025 for what these messages look like now.
3. Devices: assume one will be lost
Every laptop and phone with access to company data is part of your attack surface, including the personal ones you never approved.
- Disk encryption on everything. BitLocker on Windows, FileVault on Mac. A stolen laptop with an encrypted drive is a hardware loss. Unencrypted, it may be a reportable data breach.
- EDR, not just antivirus. Traditional antivirus matches known-bad files. Endpoint detection and response watches behavior — a process suddenly encrypting hundreds of files gets stopped even if the malware itself has never been seen before. This matters because ransomware operators recompile constantly to defeat signatures.
- Device management with remote wipe. Intune (included in Business Premium) enforces encryption and screen locks, and lets you wipe company data from a lost device without touching personal photos.
- Know what's connecting. Staff routinely sync company files to personal phones without realizing it — we covered how that happens in the hidden BYOD risk.
4. Data and backup: your recovery plan is your last line
Everything above is about prevention. This is about what happens when prevention fails, because eventually something gets through.
The traditional rule is 3-2-1: three copies of your data, on two different media, one off-site. For ransomware specifically, add one more requirement: at least one copy must be immutable or genuinely offline. Modern ransomware deliberately hunts for backup systems and encrypts those first, and a backup your servers can reach is a backup the attacker can reach.
One thing that catches businesses out: Microsoft 365 is not backed up by default. Microsoft keeps your service running and replicates data across their infrastructure, but if a user deletes a mailbox folder and nobody notices for 90 days, that is gone. Third-party Microsoft 365 backup is inexpensive and worth having.
Then test a restore. Pick a file, pick a mailbox, restore them, and time it. The number you get is your actual recovery time — and it is usually much longer than anyone assumed.
5. Your people
Training gets sold as the answer to phishing. It isn't — well-built phishing defeats trained people routinely, and blaming staff for clicking is both unfair and unproductive. What training genuinely achieves is a shorter reporting time.
The goal is that somebody who clicks a bad link tells you within five minutes instead of hiding it for two days. That requires a culture where reporting is rewarded rather than punished, and a reporting path that takes one click. The gap between a five-minute report and a two-day one is very often the gap between an incident and a disaster.
6. Write the plan before you need it
At 2am during an active incident, nobody is thinking clearly. A single page covering who to call, where the backups are, which systems must come back first, and what your insurer and regulator require is worth more than another security product.
Alabama's breach notification law requires notifying affected individuals within 45 days of determining a breach occurred, and notifying the Attorney General when more than 1,000 residents are affected. Those clocks start whether or not you're ready. Our guide to creating and testing an incident response plan covers what to write down.
What this costs
For a typical ten-person business, a solid baseline is roughly:
- Microsoft 365 Business Premium — around $22–25 per user per month, and it includes MFA, conditional access, Intune device management, and Defender. Most of this list is already in that license.
- Managed EDR — roughly $5–10 per device per month if you want it monitored rather than just installed.
- Microsoft 365 backup — roughly $3–5 per user per month.
- Security awareness training — roughly $2–4 per user per month.
Call it $35–45 per user per month all-in. The reason we list prices is to make a point: the gap between a small business with good security and one with poor security is usually not budget. It's whether anybody owns the problem.
Common questions
We're small. Are we really a target?
Nobody is choosing you specifically. Attacks are automated and indiscriminate — scanners sweep the internet for exposed services and unpatched systems, and phishing goes out by the million. Being small doesn't make you invisible; it usually just means less resistance once something lands.
Doesn't cyber insurance cover this?
It helps with cost, not consequences, and it won't recover your data or your customers' confidence. Insurers now also require specific controls — MFA and tested backups in particular — and a claim can be reduced or denied if the answers on your application didn't reflect reality. Read your policy's requirements and make sure they're actually true.
Where do we start if we're behind on everything?
MFA this week. Patching and backup verification this month. Everything else after. Doing the first item properly beats doing all six halfway.
A quick self-check
If you can't answer these, that's where to start:
- Which accounts are exempt from MFA right now?
- When did you last restore a file from backup to confirm it worked?
- How many people have administrator rights, and does each still need them?
- If a laptop went missing this afternoon, could you wipe it?
- Who gets called first if something goes wrong at 2am on a Saturday?
Need help working through this list?
Vulcan365 provides managed IT and security for small businesses across Birmingham and Central Alabama. We'll audit what you already own, tell you what's switched off, and fix the gaps in priority order — usually without adding much to what you already spend.
Get a security assessment