Small organizations are not attacked less often than large ones. They are attacked with less preparation on the other side. The 2026 Verizon Data Breach Investigations Report (DBIR) counted 7,152 confirmed breaches in its small- and midsize-business dataset alone, and found that small organizations are disproportionately affected by ransomware. This guide covers the controls that prevent the most damage, what a breach actually costs, and the order to fix things in.
Why Small Businesses Are Targeted
The DBIR’s small-business dataset is unusually blunt: 100% of the breaches in it involved external actors, and 100% had a financial motive. Nobody is targeting you for espionage or ideology. Somebody is targeting you because you have credentials, invoices, and a network that is cheaper to break than a bank’s.
The same report found that exploitation of vulnerabilities is now the most common way attackers get in, at 26% of small-business breaches, followed by credential abuse at 13% and phishing at 9%. Third parties were involved in 55%, and the human element in 45%. In other words: unpatched internet-facing systems, reused passwords, one convincing email, and a vendor with weaker security than yours.
Losses are rising across the board. The FBI’s Internet Crime Complaint Center (IC3) recorded $20.877 billion in reported losses for 2025, a 26% increase over 2024, across more than a million complaints (2025 IC3 Internet Crime Report). Reported losses understate real losses, because most small-business fraud and extortion never reaches a federal complaint.
The 10 Controls That Matter Most
No small organization can do everything. These ten controls stop the majority of the attacks that actually reach small businesses, and each one can be verified without buying a product first.
| Control | First step | How to verify | What it prevents |
|---|---|---|---|
| 1. MFA on email and admin accounts | Turn on app-based or hardware MFA for every account that can read mail or change settings. | Pull the admin console’s MFA enforcement report and read the exceptions. | Password reuse, credential stuffing, business email compromise. |
| 2. Patching | Patch operating systems, browsers, and anything reachable from the internet within 14 days; known-exploited flaws immediately. | Compare your inventory against the CISA Known Exploited Vulnerabilities catalog monthly. | The most common initial access route in the 2026 DBIR. |
| 3. Backups and restore tests | Daily encrypted backups with at least one copy that ransomware cannot rewrite. | Do a full restore of one system and record how long it took. | Paying a ransom, and losing the business while you rebuild. |
| 4. Endpoint protection or EDR | Cover every laptop and server, including remote and contractor devices. | Check the console for agents that stopped reporting. | Ransomware execution, commodity malware, credential theft. |
| 5. Email authentication | Publish SPF, DKIM, and a DMARC policy; monitor before enforcing. | Read the DMARC aggregate reports for senders you did not authorize. | Someone emailing your clients as you. |
| 6. Least privilege | Remove standing admin rights; give them out per task and take them back. | Review the admin group every quarter and delete what nobody can justify. | One compromised laptop becoming a compromised domain. |
| 7. Network segmentation | Separate guest Wi-Fi, workstations, servers, and anything holding card or patient data. | Confirm the rules with a port scan from the workstation segment. | Lateral movement and a larger compliance scope. |
| 8. Logging and alerting | Centralize authentication, endpoint, and firewall logs; alert on impossible travel and new admin accounts. | Ask for last month’s alerts and what was done about each one. | Months of undetected access, and no evidence for the insurer. |
| 9. Security awareness training | Role-based training and a phishing simulation at least once a year. | Completion records, plus the click and report rates from the simulation. | The 45% of small-business breaches the DBIR attributes to the human element. |
| 10. Written incident response plan | One page: who calls whom, what to preserve, who talks to counsel and the insurer. | Run the contact tree twice a year and time it. | Destroyed evidence, missed notice deadlines, and a disputed claim. |
What a Breach Actually Costs
Published averages describe large organizations, not yours. IBM’s 2026 Cost of a Data Breach report puts the global average at $4.99 million, up 12% from the year before, and finds that one in four malicious breaches now involves AI (IBM Cost of a Data Breach 2026). Treat that number as a warning about direction, not as your expected loss. A twelve-person professional firm does not spend $4.99 million recovering from ransomware; it spends something smaller and still painful.
Split the costs honestly. Hard costs are invoices: forensics, outside counsel, notification and call-center work, credit monitoring, overtime, replacement hardware, ransom if it is paid, and lost revenue while systems are down. Soft costs are the ones that outlast the incident: clients who leave quietly, referrals that stop, staff time spent rebuilding, delayed projects, and the price of insurance at renewal.
Cyber insurance helps and does not solve it. Coverage varies widely, limits are finite, deductibles are real, and exclusions for missing controls are common. Insurers increasingly ask whether you have MFA, tested backups, and a documented response plan before they pay anything. Treat the policy as one layer, not as the plan.
How to Assess Your Baseline
A self-assessment is a structured look in the mirror. It is fast, free, and useful for deciding what to fix first. It is also limited by what you know about your own environment and by the fact that whoever fills it in has an interest in the answer.
An independent assessment is different. Someone with no stake in the existing setup inspects configurations and evidence, tests assumptions, and reports what is actually exposed. It costs money and takes longer, and it is the only version that survives a client questionnaire, an insurer’s review, or a regulator’s question.
Start with the self-assessment. If the score is low, or the answers were hard to agree on, that is the signal to book an independent assessment.
A 90-Day Plan
| Window | Work | Owner | Evidence |
|---|---|---|---|
| Days 1–14 | Enforce MFA on email and admin accounts. Inventory internet-facing systems. Confirm backups run and are encrypted. | IT lead or provider | MFA enforcement report; asset list; backup job log |
| Days 15–45 | Patch the known-exploited list. Deploy or fix endpoint protection. Publish SPF, DKIM, and DMARC in monitor mode. Remove shared admin accounts. | IT lead | Patch report; endpoint console export; DMARC record; admin group review |
| Days 46–90 | Test a full restore. Run phishing training and a simulation. Write the one-page response plan and test the contact tree. Segment guest and server networks. | Owner plus IT lead | Restore time recorded; training completion; plan dated and distributed; firewall rules documented |
The work is deliberately boring. It is also what removes most of the exposure a small business actually carries.
Where Envescent Fits
We do four things for organizations this size: assessments, incident response and digital forensics, training, and compliance support. We work alongside internal IT staff and with managed service providers; we do not require you to replace them.
Rates are published: $200 per hour during regular hours, $275 per hour after hours or in an emergency, with no monthly managed-services contract. The first consultation is free for up to an hour, and you get a written scope and estimate before any billable work begins. We serve Arlington, Alexandria, Washington DC, Maryland, and clients worldwide.
Two related reads if you are working through this in order: the incident response plan template and why MFA comes first.
Schedule a free consultation Run the self-assessment