Every business
Cybersecurity for a small business with no IT person: the 10 things that matter
· PS ProTech · 4 min read
If you run a small business, IT is probably whoever is least busy. The owner, the office manager, a nephew who's good with computers. Nobody's job, everybody's problem.
You don't need to become an expert. Most attacks on small businesses get in through a short list of gaps, and closing them is more about habits than expensive software. Here are the ten that matter most, roughly in the order we'd do them.
1. Two-step sign-in on email, first
If you do one thing this week, do this. Your email resets every other account you have: the bank, the payroll system, your website, your social media. Two-step sign-in (also called multi-factor authentication) means a stolen password alone isn't enough to get in.
Turn it on for every mailbox, not just yours. Then do the bank, payroll, accounting software and anything that holds money. See multi-factor authentication explained.
2. A different password for everything
Criminals take passwords leaked from one website and try them everywhere else. If your email password is also your password for a shopping site that was breached years ago, it's already on a list. A password manager makes unique passwords painless. See passwords on the dark web.
3. Updates switched on, everywhere
Computers, phones, the router, the website. Most break-ins use flaws that already have a fix. Verizon's 2026 breach report found that exploiting software flaws is now how 31% of breaches start, and that a critical flaw takes a median of 43 days to fully fix (Verizon 2026). Turn on automatic updates and restart when asked. See why software updates matter.
4. Backups you've actually tested
A backup you've never restored from is a hope, not a backup. Keep a copy of your files and email somewhere separate from your everyday accounts, so ransomware or a deleted account can't take the backup too. Once a quarter, restore one file to prove it works. If you use Microsoft 365 or Google, read does Microsoft 365 back up your data? first.
5. Real protection on every computer
The antivirus that came with the computer catches known threats. Modern attacks often don't look like a known threat; they look like normal programs doing abnormal things. Endpoint detection and response (EDR) watches for that behavior and can stop ransomware mid-run. See antivirus vs EDR.
6. Nobody uses an admin account day to day
If the account you use for email and browsing can install software, so can anything that tricks you. Give everyone a standard account, and keep the admin login for when you genuinely need to install something.
7. One rule for money
Any change to bank details, any urgent payment request and any request to buy gift cards gets confirmed by phone, on a number you already have. Not the number in the email. This one rule stops the most expensive scam aimed at small businesses: in 2025 the average reported loss to email payment fraud was about $123,000 (FBI Internet Crime Report, 2025). Our payment change verification procedure is free to print.
8. Staff who know what a scam looks like
Most attacks start with a person: an email, a text or a call. Ten minutes a month of short, specific training does more than an hour a year. See security awareness training that works.
9. Access removed the day someone leaves
Email, shared files, the website, social media, the alarm code, the Wi-Fi password. Former employees, and former agencies, are a common way in. Our same-day offboarding checklist lists what to cover.
10. A plan for the bad day
Write down, on one page, who you call if something goes wrong: your IT help, your insurer, your bank, a lawyer. Print it, because a locked computer can't show you a document. Our free ransomware first-hour plan is a template.
Where to start this week
| Day | Do this | Time |
|---|---|---|
| Monday | Two-step sign-in on every email account | An hour or two |
| Tuesday | Turn on automatic updates on every computer and phone | 30 minutes |
| Wednesday | Tell staff the payment call-back rule, in writing | 15 minutes |
| Thursday | Check what's backed up, and restore one file | An hour |
| Friday | Remove accounts for anyone who has left | 30 minutes |
Want to know how you score? Our free 15-point security checklist takes you through the same ground with your team.
When doing it yourself stops making sense
This list is free to follow. What costs you is the time, and the parts that need watching rather than doing once: updates that fail quietly, an alert at 2 AM, a backup that stopped working in March.
| What it comes to | |
|---|---|
| Our Essentials plan for five people | $495 a month. Help desk, updates, backups, EDR and a 24/7 security team on every computer. |
| Our Business plan for five people | $870 a month. Adds email security, staff training and account monitoring. |
| Your own time | Two or three hours a week, and the stress of being the one who gets the call |
| One payment fraud | About $123,000 on average, by the FBI's 2025 figures |
Whether you do it yourself or hand it over, do the first item this week. Book a free Security Check if you'd like a second pair of eyes on the rest.
