Small businesses are now the most-attacked segment online — because they're easier targets and the playbook works. The good news: you can close 90% of the risk with a small, affordable stack.
- Identity is the new perimeter — enforce SSO + MFA everywhere.
- Patch fast, back up often, test the restore.
- Train people; tools alone won't save you.
- Have an incident response plan before you need one.
Identity and access
If you do nothing else, do this. Centralize identity, require MFA, and remove access the moment someone leaves.
- Google Workspace / Microsoft 365 as the identity source
- Hardware MFA keys for admins
- Quarterly access reviews
- Password manager (1Password / Bitwarden) for everyone
Endpoints and patches
Most breaches come through an unpatched laptop or browser. MDM lets you enforce updates, disk encryption and remote wipe in minutes.
Backups and incident response
Back up everything that matters, automatically, with a tested restore. Write a one-page incident response plan now — who to call, what to say, what to disconnect — and you'll thank yourself the day something happens.
Security for a small business isn't about a fortress. It's about removing the easy wins from an attacker's checklist. Do these basics well and you're already ahead of most of your peers.
12+ years shipping production web platforms. Writes about pragmatic architecture, edge runtimes and developer ergonomics.
