Cybersecurity for Small Businesses: The 5 Things That Actually Matter

In October, a recruiting email landed in my inbox with my own name baked into the URL. A Cloudflare Pages deployment, three hops deep, ending on a fake login page and a dormant malware package. Personalized per victim. Built by a kit. Coalition's insurance-claim data says kits like this write the lure, bypass MFA, and hide the intrusion with mailbox rules, and they rent for about $1,500 upfront.

The 2025 Verizon Data Breach Investigations Report found ransomware in 88 percent of small-business breaches, and small businesses logged roughly four times as many confirmed breaches as large enterprises. You are a target because you are small, not despite it: the kits are automated, the ransom demands are sized to what a small firm can quietly pay, and there is no PR risk when a five-person shop goes down.

1. Make the password useless

KnowBe4's 2025 phishing-threat analysis found 82.6 percent of the phishing emails it examined contained AI-generated content, and the AI-written lures drew a 54 percent click rate against 12 percent for human-written ones. The tells are gone. Train people to verify through a second channel, and to report instead of investigating alone.

Then kill the password. Per FIDO's 2026 numbers, five billion passkeys are in active use, sign-ins succeed 93 percent of the time against 63 for passwords, and they run about three times faster. The 2026 upgrade that matters: SMS and push MFA are under active attack through help-desk impersonation and MFA-reset fraud, so the thing to deploy is phishing-resistant, hardware keys or synced passkeys. The full setup for non-technical owners lives in the password-security post.

2. Own one backup you have actually tested

Cybersecurity consultant Dave Hatter tells the story of a construction firm that turned down a security assessment. The owner's line: "We got a guy, my brother's uncle's cousin does my IT." Three weeks later ransomware took their single unpatched server, and the only backup, an external drive plugged into that same server, went with it. No payroll, no receivables. The business folded within months.

The line worth keeping: an untested backup is a hope. Keep one copy offline or immutable, because a synced cloud copy encrypts right along with everything else, and run the restore before you need it. The ten-minute test lives in the backup post.

You are a target because you are small, not despite it.

3. Patch on a schedule

Vulnerability exploitation is now the number-two way breaches start, up 34 percent year over year per the 2025 DBIR. Microsoft's October 2026 defense report puts the median window between a vulnerability going public and someone exploiting it at well under 24 hours. Automatic updates on, unsupported machines retired, and one monthly check that the updates actually applied.

4. Put a DMARC record on your domain

The FBI's 2024 Internet Crime Report logged $16.6 billion in reported cybercrime losses, and business email compromise was the second-costliest crime type: 21,442 complaints, $2.77 billion, roughly $135,000 a case. SPF, DKIM, and DMARC stop anyone from sending as you, and they fix the other direction too: Gmail and Yahoo now require authentication, so the same record set keeps your quotes out of spam. One fix, two payoffs. The thirty-minute setup lives in the deliverability post.

5. Name one person who owns the incident

CrowdStrike's 2025 threat report: 79 percent of attacks to gain initial access are now malware-free, stolen credentials, social engineering, legitimate remote tools. Plain antivirus is a bystander for most of that. Put EDR on the business machines, and name the person (or the vendor) who owns the checklist and knows who to call before the incident. Write the who-calls-who page before you need it.

Your website is part of the attack surface

In October we ran our own site through a full audit while I was out on errands. The first thing it found was a mistake we had made that same morning: a bearer token hardcoded in the new newsletter code, which would have turned our own trusted domain into what the finding called "a phishing cannon" if it leaked. Fixed the same day, token rotated, never published. The three mediums were the boring kind: missing clickjacking protection, missing HSTS and security headers, no rate limit on the endpoint. Boring is good. Boring means nothing exotic is exposed.

What a developer actually hardens on a small-business site: HTTPS everywhere plus HSTS, real security headers, rate limits on every form and API endpoint, no secrets in code, parameterized queries. And the 2026 footnote: the Morphing Meerkat phishing operation routed its victims through compromised WordPress sites. Your unpatched install becomes somebody else's attack infrastructure.

The construction firm's backup was a drive plugged into the same server it was backing up. If your setup looks anything like that, start there.

Sources

• Retarus, Verizon 2025 DBIR briefing (88% of SMB breaches involve ransomware; SMBs log ~4x the breaches)
• Insurance Business, Coalition October 2026 briefing (BEC claims up ~30%; EvilTokens kit, $1,500 upfront)
• Sagiss, AI phishing statistics 2026 (KnowBe4: 82.6% AI-generated; 54% vs 12% click rate)
• FIDO Alliance, State of Passkeys 2026 (5B passkeys; 93% vs 63% sign-in success)
• FBI IC3, 2024 Internet Crime Report (PDF; $16.6B losses; BEC $2.77B)
• Flashpoint, 2025 DBIR vulnerability trends (exploitation +34%, #2 initial access vector)
• Microsoft Digital Defense Report 2026 via ad-hoc-news (exploit window under 24 hours)
• WebProNews, CrowdStrike 2025 Global Threat Report (79% malware-free initial access)
• Artificial Unintelligence, the construction firm that refused security help (via consultant Dave Hatter)
• SecurityOnline, Morphing Meerkat phishing via compromised WordPress sites