The Three Security Controls Worth Paying For First

Security vendors will sell you a dozen products. A small business with a real budget can fund maybe three properly. These are the three — chosen for how much attack they block per dollar, not for how comprehensive they sound.

One thing first: most of what follows may already be included in licensing you own. Check before you buy. Businesses on Microsoft 365 Business Premium frequently pay a second vendor for capabilities sitting unused in their existing subscription.

1. Endpoint detection and response

Roughly $5–10 per device per month managed, or included with Business Premium via Defender for Business

Traditional antivirus compares files against a list of known-bad signatures. That model stopped being sufficient because attackers recompile their malware constantly — a trivial change produces a file no signature list has ever seen.

EDR watches behavior instead. It doesn't need to recognize the file; it recognizes that a process has started encrypting hundreds of documents, or is reading credentials out of memory, or is trying to disable security tooling. Those behaviors are hard to disguise because they're what the attack fundamentally has to do.

It also records what happened, which matters enormously afterward. When you're trying to establish whether data was accessed — a question your insurer and possibly a regulator will ask — EDR telemetry is often the only way to answer.

Managed matters more than the product. EDR generates alerts, and alerts nobody reads are worthless. At 2am on a Saturday, either someone is watching or the alert waits until Monday. Budget for the monitoring, not just the license.

2. Identity protection

Usually already included in Microsoft 365 Business Premium

Since credentials are now the perimeter, this is where attacks actually arrive. Three capabilities matter:

MFA with number matching — blocks credential stuffing outright and defeats push-fatigue attacks. Free with every Microsoft 365 plan, and the single highest-value control available to you.

Conditional access — policies that evaluate each sign-in: is the device managed and compliant, is the location plausible, is the risk level acceptable. This is what stops a stolen session cookie from working on the attacker's machine, which matters because modern phishing defeats basic MFA. Business Premium only.

Risk detection — automatic flagging of impossible travel, sign-ins from anonymized networks, and credentials appearing in known breach data.

We put identity second on cost grounds rather than importance. If you have Business Premium, this costs nothing extra and should genuinely be done first — see rolling out MFA.

3. Immutable, tested backup

Roughly $3–5 per user per month for Microsoft 365; varies for servers

This is the control that determines whether a bad day ends in recovery or in a negotiation.

Two words carry the weight. Immutable means the backup cannot be altered or deleted for a defined retention period, even by someone holding administrator credentials. That property exists specifically because ransomware operators hunt for backup systems and destroy them first — a backup your servers can reach is a backup the attacker can reach. Tested means you have actually restored from it and know how long it takes.

The gap that catches most businesses: Microsoft 365 is not backed up by default. Microsoft protects the service and their own infrastructure. They do not protect you from a deletion nobody noticed until after the retention window closed. This is a separate, inexpensive purchase that a surprising number of businesses discover they need at the worst possible moment.

What we deliberately left out

Standalone email security gateways. Defender for Office 365, included in Business Premium, covers most of what a small business needs. Worth adding only if you have a specific gap.

SIEM and log aggregation. Genuinely valuable at scale, but it produces volume that needs staff to interpret. Without someone to act on it, it's cost without benefit.

Password managers. Not omitted because they're unimportant — they're excellent value at a few dollars per user. They're just cheap enough that they don't compete for the same budget. Buy one.

Security awareness training. Worth having, but its realistic benefit is faster incident reporting rather than perfect detection. Fund the three above first.

What this adds up to

For a ten-person business: Business Premium at roughly $22–26 per user gives you identity protection and Defender. Add managed EDR monitoring and Microsoft 365 backup, and you're at roughly $35–45 per user per month for a genuinely defensible setup.

Compare that to a single ransomware incident — where the recovery cost, downtime, and notification obligations run to tens of thousands of dollars for a business this size — and the arithmetic isn't close.

The more common failure isn't underspending. It's paying for capabilities and never switching them on. Before buying anything, audit what your current licensing already includes; see our security baseline for the full picture.