Most small business owners think of cybersecurity as something large enterprises worry about. That assumption is exactly what attackers count on. In 2026, small and medium businesses account for more than 60 percent of all ransomware targets precisely because their defences are weaker and their recovery budgets are small. A single breach can cost tens of thousands of dollars in downtime, recovery fees, and reputational damage.
This guide covers the practical steps a small business can take today to reduce its exposure without hiring a dedicated security team. For a full security review of your web application or infrastructure, see our cybersecurity service.
Why small businesses are the primary target now
The economics of cybercrime have shifted. Attacking a large enterprise means dealing with enterprise-grade security operations centres, incident response teams, and rapid threat detection. Attacking a small business typically means dealing with default router passwords, shared staff accounts, and no monitoring whatsoever.
Ransomware-as-a-service toolkits have made it trivial for low-skill actors to launch sophisticated attacks. The average ransom demand against a small business in 2025 was $47,000. The average cost of recovery, including downtime, data loss, and IT remediation, exceeded $200,000. Cyber insurance premiums have tripled in three years.
The good news: most small business breaches exploit basic, preventable weaknesses. Fixing these does not require a large budget.
The most common attack vectors against small businesses
Understanding how attackers get in is the first step to closing the gaps.
Phishing and business email compromise
More than 80 percent of breaches start with a phishing email. Attackers impersonate suppliers, couriers, or internal staff to trick employees into clicking malicious links or wiring money to fraudulent accounts. Business email compromise (BEC) cost small businesses $2.9 billion globally in 2024.
Weak or reused passwords
Credential stuffing attacks take username and password combinations leaked from one breach and try them across hundreds of other services. If your staff reuse passwords across personal and business accounts, a breach at an unrelated website gives attackers a direct path into your systems.
Unpatched software and plugins
Every unpatched vulnerability is an open door. WordPress sites with outdated plugins, web apps running on old frameworks, and servers running unsupported operating systems are found and exploited automatically by scanning tools that run continuously across the internet.
Unsecured remote access
Since 2020, Remote Desktop Protocol (RDP) exposure has exploded. Many businesses opened remote access during the pandemic and never secured or closed it. RDP endpoints with weak passwords are brute-forced within hours of being exposed to the internet.
Third-party and supply chain risk
A breach at your accounting software provider, your marketing email platform, or your e-commerce plugin can expose your customer data even if your own systems are secure. Third-party risk is now the largest unaddressed vulnerability for most small businesses.
The web application security checklist for 2026
1. Enforce multi-factor authentication everywhere
Multi-factor authentication (MFA) blocks more than 99 percent of credential-based attacks. Enable it on:
- Email accounts (Google Workspace, Microsoft 365)
- Cloud services (AWS, Azure, GCP)
- Accounting and payroll software
- CRM and customer data systems
- Admin panels for your website or web app
- Banking and payment portals
Use an authenticator app (Google Authenticator, Authy, Microsoft Authenticator) rather than SMS codes, which can be intercepted via SIM swapping.
2. Deploy a password manager
Require all staff to use a business password manager such as 1Password, Bitwarden, or Dashlane for Teams. This solves reuse, enforces complexity, and makes offboarding former employees safe by revoking access instantly.
3. Keep software and systems patched
Assign someone responsibility for monthly patching:
- Operating systems on all workstations and servers
- Web applications and CMS plugins (WordPress, WooCommerce, etc.)
- Third-party libraries in any custom software
- Firmware on routers and network devices
Enable automatic updates where possible. For production servers, test patches in a staging environment first, then deploy within 72 hours of a critical vulnerability disclosure.
4. Segment your network
Put guest Wi-Fi, IoT devices, and point-of-sale terminals on separate network segments. If an attacker compromises a smart TV in the boardroom, network segmentation stops them from reaching your financial system or customer database.
5. Back up data daily and test restores
Ransomware is most damaging when businesses have no clean backup to restore from. Follow the 3-2-1 rule:
- 3 copies of the data
- 2 different storage media (local drive and cloud)
- 1 copy offsite or air-gapped
Run a restore test quarterly. A backup you have never tested is a backup you cannot trust.
6. Train staff to recognise phishing
One hour of phishing awareness training reduces click rates on simulated phishing emails from 33 percent to under 5 percent within 12 months. Run quarterly training and simulated phishing tests using tools like KnowBe4 or Proofpoint Security Awareness.
Teach staff to:
- Check sender addresses, not just display names
- Hover over links before clicking
- Verify unusual payment or transfer requests via a separate channel (call the person, do not reply to the email)
- Report suspicious emails immediately rather than deleting them
7. Secure your web application
If your business runs a web app or customer portal, treat it as a primary attack surface. Common vulnerabilities to address:
- SQL injection: Use parameterised queries. Never concatenate user input into SQL strings.
- Cross-site scripting (XSS): Sanitise all user-supplied output. Use a Content Security Policy header.
- Broken authentication: Enforce session expiry, secure cookie flags, and account lockout after failed attempts.
- Sensitive data exposure: Encrypt data at rest and in transit. Do not log passwords or credit card numbers.
- OWASP Top 10: Treat the OWASP Top 10 as a minimum baseline for any web application you build or commission.
If you commissioned a web app from a developer, ask them to run an automated vulnerability scan (Snyk, OWASP ZAP, or Burp Suite Community) and share the report.
8. Manage third-party access
Every software vendor with access to your systems is a potential breach vector. Audit your third-party integrations annually:
- List every tool that has API access to your data
- Remove integrations for tools you no longer use
- Review permission scopes and reduce to least privilege
- Check vendor security certifications (SOC 2, ISO 27001)
9. Implement endpoint protection
Replace free antivirus with a business-grade endpoint detection and response (EDR) tool such as CrowdStrike Falcon Go, SentinelOne, or Microsoft Defender for Business. EDR tools detect behavioural threats that signature-based antivirus misses.
10. Monitor and log activity
You cannot detect a breach you cannot see. Enable basic logging on:
- Failed login attempts
- Privileged account activity
- File access on sensitive directories
- Firewall and network activity
Cloud providers (AWS CloudTrail, Azure Monitor, Google Cloud Logging) make this straightforward. For on-premises systems, a simple SIEM tool like Graylog or Elastic SIEM centralises logs.
Data breach prevention: the most overlooked controls
Most breach prevention advice focuses on technical controls. These three organisational controls are equally important and consistently overlooked.
Define who has access to what
The principle of least privilege means every staff member should have access only to the data and systems they need for their role. A junior marketing assistant should not have admin access to your customer database. Audit permissions annually and remove access the moment someone leaves the company.
Write an incident response plan
When a breach happens, panic costs time and time costs money. Write a one-page incident response plan that answers:
- Who do we call first (IT, legal, insurance)?
- How do we contain the breach (isolate affected systems)?
- Who needs to be notified (customers, regulators, payment processors)?
- How do we preserve evidence for insurance purposes?
Review it annually and run a tabletop exercise with your team once per year.
Check your cyber insurance
Cyber insurance has become a necessity for businesses that hold customer data or process payments. Policies cover ransom payments, forensic investigation, legal fees, customer notification costs, and business interruption. Premiums range from $1,000 to $5,000 per year for most small businesses. Read the exclusions carefully: many policies exclude attacks resulting from known unpatched vulnerabilities, so your patching discipline directly affects your coverage.
How to prioritise if you have a limited budget
Not every control is equal. If you are starting from zero, implement in this order:
- Multi-factor authentication on email and cloud services (free on most platforms)
- Password manager for the team ($3 to $8 per user per month)
- Daily cloud backup with tested restores ($20 to $100 per month)
- Staff phishing training ($10 to $30 per user per year)
- Endpoint protection on all workstations ($5 to $15 per device per month)
- Network segmentation (one-time configuration, usually under $500)
- Web application security review (one-time, $500 to $2,000 for a basic assessment)
These seven steps address the vast majority of small business breach vectors and can be implemented within 30 days for most organisations.
When to bring in professional help
Some situations require more than internal effort:
- You handle medical records (HIPAA), payment card data (PCI DSS), or EU customer data (GDPR). Each regulation has specific technical and documentation requirements that carry significant penalties for non-compliance.
- You have experienced a breach and need forensic investigation to determine scope and preserve evidence.
- You are building or maintaining a web application that processes sensitive customer data. A penetration test by a qualified security firm identifies vulnerabilities before attackers do.
- You want an independent security posture assessment before a major fundraising round, acquisition, or enterprise client onboarding.
An offshore development team with security expertise can perform these assessments and implement the technical controls at a fraction of the cost of a local security consultancy. The right offshore partner brings both the security knowledge and the development capability to fix what they find. You can hire a dedicated security engineer or engage our cybersecurity service for a structured audit and remediation programme. For API-specific security controls, see our companion post on API security best practices.
Cybersecurity is not a one-time project. It is an ongoing operational function. The businesses that get breached are not always the ones with the worst security — they are often the ones that put off the basics one quarter too many. Start with MFA and backups this week. Build from there.