Short answer: attackers don't choose small businesses — their software does. Automated scanning and credential-stuffing hit everyone, and small businesses without a handful of basic cybersecurity controls are simply the ones that break first. The good news: the controls that stop most attacks are known, and none of them require an enterprise budget.
Why "too small to hack" is backwards
Most intrusions start with automation: bots trying leaked passwords, scanning for unpatched systems, and mass-mailing phishing lures. The bot doesn't know or care that you have twelve employees. What decides the outcome is whether the basics were in place when your turn came.
The cybersecurity controls, in the order we implement them
1. Multi-factor authentication, everywhere
Stolen passwords are the most common way in. MFA on email, VPN, banking, and admin accounts shuts down the majority of credential attacks. "Everywhere" includes the owner and the bookkeeper — the accounts attackers want most.
2. Patching that actually happens
Vulnerabilities get weaponized within days of disclosure. Patching can't be "when someone remembers" — it has to be a managed, verified process across every device and server, including the forgotten machine running the label printer.
3. Endpoint detection and response (EDR)
Traditional antivirus checks files against known signatures; EDR watches behavior — encryption sprees, credential dumping, persistence tricks — and can isolate a machine automatically. This is the control that most often turns a ransomware incident into a non-event.
4. Tested, isolated backups
Backups only count if they restore. They must be isolated (immutable or offline) so ransomware can't encrypt them, and tested on a schedule. This is the control behind our 100% ransomware recovery record — see our ransomware recovery methodology.
5. Trained people
Phishing still opens most doors. Short, regular training plus a no-blame reporting culture beats an annual slideshow. Your team should know what business email compromise and AI voice-cloning fraud sound like.
Where to start
Use the free 7-question cybersecurity assessment as a starting point based on your answers, not a technical audit of your systems. For your public website, the free Tier 1 exposure review uses Penetrator after written scope and authorization. You keep the findings report and prioritized remediation. It does not include source code, internal systems, employee phishing tests or an on-site visit, and it cannot demonstrate every possible attack path. A broader security assessment or cyber insurance readiness review is scoped separately around the systems and evidence you need.
Have a security question to work through? Request a free 15-minute engineer call, or explore cybersecurity services.
If you would rather have these controls installed and watched for you, our cyber security services for small business run them month to month.
Sources and further reading
- CIS Critical Security Controls — the prioritized control set this guidance draws on.
- NIST Cybersecurity Framework 2.0 — the framework this guidance maps to.
Discuss cyber security for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.