Most small business breaches aren't sophisticated. They're opportunistic. Attackers scan thousands of businesses at once looking for the easiest targets — and if your business has basic gaps, you're the easy target.

The good news: fixing those gaps doesn't require a big IT budget. Here are the five things every small business must have in place before an attack happens.

1. Multi-Factor Authentication (MFA) on Everything

If your email, banking, or cloud storage only requires a password to log in, you're one stolen password away from losing everything. MFA adds a second step — a text code, an app approval — that stops attackers even if they have your password.

2. Automatic Backups That Aren't Connected to Your Main System

Ransomware works by encrypting your files and demanding payment. If your backup is connected to your main network, it gets encrypted too. You need an offsite or cloud backup that runs automatically every night.

• Use a service like Backblaze, Carbonite, or Microsoft OneDrive
• Test your restore process — a backup you've never tested is not a backup
• Keep at least 30 days of backup history

3. A Password Manager for Your Whole Team

Reusing passwords is the #1 way small businesses get breached. A password manager like Bitwarden (free) or 1Password ($3/month) generates strong unique passwords for every account and stores them securely.

4. Software Updates Turned On Automatically

Unpatched software is an open door. Most attacks exploit vulnerabilities that were patched months ago — attackers count on people not updating. Turn on automatic updates for Windows, Mac, your browsers, and every business application.

5. A Written Response Plan (Even One Page)

When an attack happens, panic makes things worse. A one-page plan that answers "who do I call, what do I shut down first, where are my backups" saves critical time. You don't need a 50-page document — just the basics written down.

Phishing is the #1 way attackers get into small businesses. And it works not because people are dumb — it works because the emails look legitimate. Here's a 10-second checklist your whole team can use.

The 10-Second Phishing Check

1. Who actually sent it?

Don't just look at the display name — look at the actual email address. "PayPal Support" can be sent from attacker@gmail.com. Tap or hover over the sender name to see the real address.

2. Is there urgency or a threat?

"Your account will be closed in 24 hours." "Immediate action required." "Your payment failed." Attackers use urgency to make you act before thinking. Slow down when you feel rushed.

3. Does the link match where it says it goes?

Hover over any link before clicking. If the email says "Click here to log into Chase" but the URL shows chasebank-secure.ru — that's phishing. Never click a link in an email to log into a financial account. Always go directly to the website.

4. Are they asking for credentials, payment, or personal info?

Legitimate companies don't email you asking for your password, social security number, or bank details. Ever. If an email asks for this, delete it and call the company directly using a number you find yourself.

5. Does something feel off?

Trust your gut. Odd formatting, strange wording, a logo that looks slightly wrong — these are all signals. When in doubt, don't click. Call or text the sender directly to verify.

Credential stuffing attacks — where hackers take leaked passwords from one site and try them on others — are up 300% this year. The reason they work so well: most people reuse the same password across multiple accounts.

A password manager solves this completely. Here's why every small business owner needs one.

What a Password Manager Actually Does

It generates a long, random, unique password for every account you have — like "X7#mK9$pLq2w" — and stores it in an encrypted vault. You only need to remember one master password. Everything else is handled automatically.

Best Options for Small Businesses

• Bitwarden — Free for individuals, $3/month for teams. Open source and audited. This is what I recommend to most clients.
• 1Password — $3/month per user. Excellent team features, very polished interface.
• Dashlane — Good for non-technical users. Slightly more expensive.

How to Roll It Out to Your Team

• Start with yourself — get comfortable with it for a week
• Set up a business account and invite your team
• Have everyone change their top 10 most important passwords first
• Set a rule: any new account must use a generated password

You store client names, phone numbers, addresses, project photos, and invoices on your phone. If that phone gets hacked — or just lost — that's your clients' personal data in someone else's hands. And in many states, that makes you legally responsible.

What's Actually on Your Phone

• Client contact info in your address book
• Job site photos (often geotagged with exact addresses)
• Invoice and payment information
• Email conversations with personal or financial details
• Contracts and signed documents

What Happens if It Gets Breached

At minimum, you have to notify every affected client. In many states this is legally required within 72 hours. Beyond the legal obligation, you're looking at destroyed trust, lost contracts, and potential lawsuits from clients whose data was exposed.

Six Things to Do Right Now

• Enable full-device encryption (on by default on modern iPhones and Androids — verify it's on)
• Set a strong PIN — not 1234, not your birthday
• Enable remote wipe so you can erase it if it's stolen
• Stop storing sensitive client files in your regular photo roll — use an encrypted app
• Set your screen to auto-lock after 30 seconds
• Never connect to public WiFi without a VPN

The average ransomware demand against a small business is $812,000. The average downtime after an attack is 21 days. Most small businesses that experience a major ransomware attack never fully recover.

Here's what actually happens — and what prevention actually costs by comparison.

How Ransomware Gets In

• A phishing email that an employee clicks
• Outdated software with a known vulnerability
• Weak or reused passwords on remote access tools
• A compromised vendor or contractor with access to your network

What Happens After It Lands

The ransomware sits quietly for days or weeks, spreading through your network and identifying your backups. Then it encrypts everything simultaneously — files, databases, backups connected to your network. You get a message demanding payment in cryptocurrency.

The Real Cost of Recovery

• Ransom payment (if you pay — not recommended, no guarantee you get your files)
• Incident response team: $150-400/hr
• 21+ days of downtime for a typical SMB
• Data reconstruction if backups were also encrypted
• Legal fees and client notification requirements
• Reputation damage and lost contracts

What Prevention Costs

Our Shield retainer — $497/month — covers monitoring, backup verification, software patch management, and phishing training. That's less than $6,000/year to avoid a $500,000+ event.

Most business owners treat their phone as a personal device. But if you use it for email, client communication, invoices, or anything business-related — attackers treat it as a business target. Here are 6 settings to change in the next 15 minutes.

Setting 1: Enable Full-Disk Encryption

On iPhone: it's automatic when you set a passcode. On Android: Settings → Security → Encryption. This means if your phone is stolen, the data can't be read without your PIN.

Setting 2: Use a Strong PIN or Biometric Lock

A 6-digit PIN is the minimum. A 12-digit PIN is better. Face ID and fingerprint are convenient and secure — use them, but also set a strong backup PIN.

Setting 3: Set Auto-Lock to 30 Seconds

The longer your screen stays on unattended, the longer the window for someone to grab it. Settings → Display → Screen Timeout → 30 seconds.

Setting 4: Enable Remote Wipe

iPhone: Find My iPhone → enable. Android: Find My Device → enable. If your phone is stolen, you can erase everything remotely from any browser.

Setting 5: Turn Off Lock Screen Notifications

If someone can read your text messages, emails, and app notifications without unlocking your phone — that's a problem. Settings → Notifications → Show Previews → When Unlocked.

Setting 6: Never Use Public WiFi Without a VPN

Coffee shop WiFi, hotel WiFi, airport WiFi — all of these are open networks where attackers can intercept your traffic. A VPN (Proton VPN is free, Mullvad is $5/month) encrypts everything you send.