The cybersecurity industry made a fortune in the 2010s convincing small and mid-sized businesses they needed enterprise-grade defenses. Most of the actual breaches I see at SMBs are still the boring ones: a re-used password, an unpatched server, an employee clicking a link they shouldn't have. The same five categories of basic hygiene would have prevented 9 out of every 10 SMB breaches I've worked.
If you're an SMB owner, you don't need a Security Operations Center. You need the basics done well. Here's what actually matters in 2026, in priority order.
1. Multi-factor authentication on everything
If I could only do one thing for every SMB, it'd be enforce MFA on every account that supports it. MFA prevents the single most common attack vector — credential reuse — by requiring a second factor (an app, a hardware key, an SMS as a last resort).
Practical implementation:
- Email and core SaaS first — Google Workspace, Microsoft 365, Slack, financial apps. These are the highest-impact targets.
- Use authenticator apps, not SMS — SIM-swap attacks have become common enough that SMS-based MFA is now a liability. Apps like Google Authenticator, Authy, or 1Password are free.
- Hardware keys for finance and admin accounts — YubiKeys for anyone who can move money or change administrative settings. About $50/key.
- Make it mandatory, not opt-in — most identity providers can enforce MFA for the entire org. Turn it on.
Cost: under $200 for a 25-person company. Time: half a day to deploy. Impact: blocks ~80% of common attack vectors.
2. A working backup system you've actually tested
Ransomware is the most common attack on SMBs in 2026. The defense isn't exotic technology — it's having backups you can actually restore from.
The 3-2-1 rule still works:
- 3 copies of important data
- 2 different storage media
- 1 copy off-site (cloud, ideally with versioning)
The trap most SMBs fall into: they have backups, but they've never tested a restore. Six months into a ransomware incident, they discover the backups were corrupted, incomplete, or encrypted by the same attacker.
Practical setup:
- Cloud backup with versioning — Backblaze, Carbonite, or similar for endpoints. Every file SaaS (Google Drive, Microsoft OneDrive, Dropbox) — turn on version history retention for at least 90 days.
- Test a restore quarterly — pick a random file from 6 weeks ago and verify you can pull it back. If you can't, the backup isn't working.
- Critical-systems backups — accounting, customer database, code repositories — get full snapshots weekly with off-site retention.
3. Patch management — the unglamorous foundation
Most breached SMBs were running software with known, patched vulnerabilities. The attacker didn't need to be sophisticated — they just scanned the internet for unpatched systems.
The fix:
- Auto-update everything that supports it — operating systems, browsers, the apps in your tech stack. Friction here is misplaced; the cost of an interruption is much smaller than the cost of a breach.
- Inventory your software — most SMBs can't list every piece of software running in the company. You can't patch what you don't know about. A 30-minute audit per quarter is enough.
- Sunset unused software — every dormant SaaS subscription is an attack surface. If nobody's used it in 6 months, cancel and revoke access.
4. Vendor risk management
Most SMBs have 30–80 SaaS vendors with access to company data. Each one is a potential breach vector. When a vendor gets breached, your data goes with it.
Basic vendor hygiene:
- Maintain a vendor inventory — what data each vendor has, what they're contracted to do, who owns the relationship.
- Require security questionnaires for high-data-access vendors — who handles customer PII, financial data, employee records. The vendor should provide SOC 2 Type II reports or equivalent.
- Use SSO for all SaaS access — single sign-on through Okta, Microsoft, or Google means you can revoke access in one place when someone leaves.
- Right-size permissions — most SaaS access is over-permissioned. Quarterly access reviews catch employees who don't need access anymore but still have it.
5. Employee training — the 90-minute version
The most common attack vector against SMBs is still social engineering — phishing emails, fake invoice scams, CEO impersonation. No technology stops this entirely; trained employees do.
The 90-minute basics:
- 15 minutes: identifying phishing — the URL doesn't match the sender, urgent language, requests outside normal process.
- 15 minutes: financial process discipline — no wire transfers approved over email; require phone-call verification for any payment change request.
- 15 minutes: password and MFA hygiene — password managers, why re-use is fatal, what to do if you suspect a credential is compromised.
- 15 minutes: device security — laptop encryption, lock screens, what to do if a device is lost.
- 30 minutes: incident reporting — what to do if you clicked something you shouldn't have, who to tell, what's the worst that happens (much worse if you don't tell anyone).
Run this annually. Add quarterly 5-minute reminders. The teams that do this catch 70%+ of phishing attempts before they succeed.
Incident response: the 90-minute plan
When something does go wrong, the first hour matters most. A simple written plan, even if it's one page, prevents a small incident from becoming a catastrophe.
The plan needs three things:
- Detection and containment — who do employees report incidents to? Who decides to take systems offline? Single point of contact matters.
- External communication — who calls legal counsel? When do customers get notified? When do you call cyber insurance?
- Recovery — what's the order of restoration? Which systems come back first? Who validates that the threat is removed before restoring?
Rehearse the plan twice a year. The companies that recover well from incidents are the ones who'd practiced. The ones that fumble for two weeks are the ones who'd written the plan but never run through it.
What you don't need (yet)
If you're under 500 employees, you probably don't need:
- A dedicated security team. A part-time security consultant or fractional CISO is enough.
- Enterprise EDR/XDR platforms. Microsoft Defender for Business or Google Workspace's built-in protections are sufficient for the segment.
- A 24/7 SOC. The basics above prevent the attacks that would justify this investment.
Save the budget. Spend it on the basics done well.
The cost of getting this right
Total cost of the basics for a 25-person SMB:
- MFA tools and YubiKeys: ~$300/year
- Cloud backup: $5–10/user/month = $1,500–$3,000/year
- Patch management: $0 (auto-update is free)
- SSO + access management: $5–10/user/month = $1,500–$3,000/year
- Annual training: ~$2,000 for facilitator OR $500 for an off-the-shelf course
Total: $7k–$10k/year. The average cost of an SMB ransomware incident is $120k–$300k including downtime, recovery, and customer notification. Math is on the side of doing the basics.
The cybersecurity industry will sell you complexity if you let them. The actual data on SMB breaches says simplicity, done consistently, prevents most of what would hurt you. Pick one of the five categories above this quarter and get it right. Add another next quarter. Within a year, you've built the foundation that 90% of SMBs still don't have.
