The cybersecurity stack a small business actually needs.

Small businesses are usually sold security in the wrong sequence, because the loudest products are not the highest-value ones. The realistic threat model is not a targeted adversary; it is credential reuse, phishing, commodity ransomware and an unpatched device.

Everything below is ordered by risk removed per pound and per hour of setup. Working down this list is more effective than buying an expensive platform at step five while step one remains unfinished.

If you do exactly one thing, enforce multi-factor authentication on email, the identity provider, finance systems and anything holding customer data. Phishing-resistant methods — passkeys or hardware keys — are stronger than app codes, and app codes are far stronger than SMS.

Pair it with a password manager for the whole team, not just the technical staff. The point is not memorability; it is that every account gets a unique credential, so one breached third-party service cannot cascade into your systems.

Then reduce standing privilege. Most small businesses have several accounts with administrative rights nobody needs day to day, and shared logins whose password left with a former employee.

Ransomware turns a security incident into a business-continuity event, and the deciding factor is always the backup. Three properties matter: it runs automatically, a copy is somewhere an attacker with your credentials cannot delete, and you have performed a restore recently enough to trust it.

The third is the one that fails. Teams discover during an incident that the backup covered the file server but not the SaaS data, or that nobody knows the restore procedure, or that the retention window was shorter than the time the attacker spent inside. Schedule a restore test and write down how long it took.

Endpoints need three things: reputable protection running and reporting, full-disk encryption enabled, and automatic operating system and browser updates. Patching promptly closes the known vulnerabilities that make up a large share of successful attacks, and it costs nothing but discipline.

Email is where most incidents begin. Turn on the filtering your provider already includes, publish SPF, DKIM and DMARC records so your domain is harder to spoof, and check the default sharing settings in your document platform — public link sharing is a routine cause of quiet data exposure.

A VPN belongs here rather than higher up. It is genuinely useful for staff working on untrusted networks and for reaching internal services, and it does nothing about weak passwords, unpatched laptops or a phished account. Buy it for what it does.

Testing is where small businesses tend to start when a customer questionnaire arrives, and it is the least efficient first purchase. Against an estate with no MFA and inconsistent patching, a test produces an expensive restatement of the obvious.

Once layers one to five are in place, continuous vulnerability assessment of your internet-facing surface is inexpensive and worthwhile, and a scoped penetration test of anything bespoke — a customer portal, an API, a payment flow — becomes genuinely informative.

This is also the point at which security spend starts paying commercially rather than only defensively: reports, retest records and a documented policy are what unblock enterprise procurement and insurance questions.

Two categories consistently arrive too early. Enterprise detection-and-response platforms assume someone is available to investigate alerts; without that person they generate noise and a licence cost. Security validation platforms assume you already own controls whose efficacy needs proving — which is not the case at this stage.

Compliance automation tools are a partial exception: if a customer or regulator is genuinely demanding a framework, they save real time. Bought speculatively, they document a programme you have not built yet.