Cybersecurity for Small Business: What Actually Protects You

Most small business owners assume they are too small to be worth a hacker’s time. That assumption is the single biggest reason small businesses get hit as often as they do. Almost none of it is personal, and almost none of it requires a sophisticated attacker. This guide covers the handful of things that actually move the needle, what a breach really costs at small-business scale, and the one habit that would have saved our own Instagram account.

How often do small businesses actually get attacked?

Small and mid-sized businesses saw roughly four times the breach volume of large organizations in Verizon’s 2025 Data Breach Investigations Report. Ransomware-style extortion showed up in 88% of small-business breaches, against 39% at large companies. Small businesses also catch malicious email at the highest rate of any size group, roughly 1 in every 323 messages.

Here is the part owners miss: almost none of this is personal. Most attacks are automated. A bot scans the internet for a weak spot, a reused password, an open port, software three updates behind, and it does not check your headcount first. It lands on a Fortune 500 company and a five-person landscaping crew the same way. The businesses that get burned worst are usually the ones that figured they were too small to bother with.

What does a cyberattack actually cost?

Depends who you ask, and the spread is huge. IBM’s 2023 Cost of a Data Breach Report found $3.31 million on average for organizations with fewer than 500 employees, but that figure is pulled way up by mid-sized firms with far more to lose. Hiscox, which surveys businesses specifically under 50 employees, found a much smaller median direct cost in its own 2023 report: $8,300.

So which is it? Honestly, both, because a five-person shop and a 400-person company are both “small” and their exposure is nothing alike. If you are closer to five people, use the smaller number. The million-dollar averages are describing somebody else’s business.

What’s the single most effective thing you can do?

Turn on multi-factor authentication. It is the highest-value move on this whole page, and it is free almost everywhere you already log in: email, bank, social, cloud storage. Microsoft’s own research says MFA can block more than 99% of automated account-takeover attempts. And yet a 2024 global survey from the Cyber Readiness Institute found nearly two-thirds of small and medium businesses still don’t use MFA at all.

I know the cost of skipping it, because we skipped it. Our Craftan Instagram got hacked, and since we had never turned on 2FA, we could not prove the account was ours once it was gone. Instagram sends the recovery code to the email or phone tied to the account. The attacker had already swapped both. We emailed support back and forth for weeks and got nowhere. In the end we started the account over from zero, no followers, no post history, no reviews, all of it gone. Every account I touch now, work or personal, has MFA on and set to the strongest option the platform gives me. It took about ten minutes each. It would have saved us a month.

How much should a small business budget for cybersecurity?

This is the number with the widest spread in the whole guide, because “cybersecurity” can mean a $20-a-month password manager or a full managed contract with a monitoring team. At the low end, 2025 MSP pricing puts the bare basics, antivirus, firewall, MFA, at $1,000 to $3,000 a year. A managed setup with monitoring and training for a 25 to 50 person team runs more like $12,000 to $30,000. One 2025 industry estimate pushes comprehensive coverage for a sub-50-employee business all the way to $50,000 to $150,000, though that is aimed at firms in regulated fields like healthcare or finance.

Ignore most of that if you are small. Those figures assume employees, servers, and compliance rules you probably do not have. For a five-person shop, MFA plus a password manager plus a tested backup runs a few hundred dollars a year, and it covers the bulk of your real risk. Spend up from there only when you actually have something specific to protect.

What is business email compromise, and why does it matter?

Business email compromise (BEC) is a scam where someone pretends to be a vendor, your boss, or your bank and talks a person into sending money or handing over data. There is usually no hacking involved at all. It is a convincing email and a fake deadline.

The money is real. The FBI’s Internet Crime Complaint Center logged $3.05 billion in BEC losses in 2025 across just under 25,000 complaints, second only to investment fraud among all cybercrime categories. About 86% of that moved by wire or ACH, which means it is usually gone within hours, well before anyone spots it. The defense is a habit, not a tool: if an email asks you to change payment details or send money, call and confirm first, using a number you already have, never the one in the email. Do not wire money off an email alone, however clean it looks. That one rule stops most of these cold.

Do I need cyber insurance?

Adoption is climbing fast. Hiscox’s 2025 Cyber Readiness Report found 71% of US small businesses now carry a standalone cyber insurance policy or cyber coverage bundled into another policy, up from 53% just two years earlier. That still leaves a real gap, and the businesses without coverage are often the ones who assumed a general liability or business owner’s policy already handled a breach. It usually doesn’t.

Insurers have also tightened up on what they will cover. Most now want MFA and tested backups in place before they will write a policy at all, and some will deny a ransomware claim outright if you cannot show basic protections were running when the attack hit.

The deciding question is what data you hold. If you keep customer card numbers, health records, or anything that legally forces you to notify people when it leaks, get a quote even if you end up passing on it. If you do not touch that kind of data, the basics in this guide already cover most of what would actually go wrong.

What’s a realistic starter checklist?

You do not have to do all of this at once. Work down the list in order, because it runs from “stops the most common attacks” to “nice once the rest is done”:

• Turn on MFA everywhere it is offered, starting with email, then banking, then any social account tied to the business
• Use a password manager instead of reusing passwords or keeping them in your head
• Back up your data automatically to two places, with at least one copy stored off your main system (a cloud backup counts)
• Sit your team down for 15 minutes once a quarter and show them what a phishing email looks like; almost every breach traces back to a person, not clever code
• Keep software and devices updated, and switch on automatic updates wherever you can
• Track who has access to what, and pull that access the day someone leaves
• Write down now who you call first if it goes wrong: your IT contact, your bank’s fraud line, your insurer

Most of this costs nothing but an afternoon.

FAQ

Sources

• Verizon, 2025 Data Breach Investigations Report, Small- and Medium-Sized Business Snapshot: https://www.verizon.com/business/resources/infographics/2025-dbir-smb-snapshot.pdf
• Microsoft, “One simple action you can take to prevent 99.9 percent of account attacks,” Microsoft Security Blog, 2019: https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/
• FBI Internet Crime Complaint Center (IC3), 2025 Internet Crime Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
• IBM Security, “Cost of a Data Breach Report” (2023 small-business segment, under 500 employees): https://newsroom.ibm.com/2023-07-24-IBM-Report-Half-of-Breached-Organizations-Unwilling-to-Increase-Security-Spend-Despite-Soaring-Breach-Costs
• Hiscox, “Cyber attacks cost US small businesses over $8,000 annually,” Cyber Readiness Report 2023: https://www.hiscox.com/articles/cyber-attacks-cost-us-small-businesses-over-8000-annually-reveals-hiscox-cyber-readiness
• Hiscox, Cyber Readiness Report 2025: https://www.hiscoxgroup.com/hiscox-cyber-readiness-report-2025
• Cyber Readiness Institute, Global Multifactor Authentication Survey, 2024: https://cyberreadinessinstitute.org/news-and-events/new-study-underscores-slow-adoption-of-multifactor-authenification/
• Sen. Tammy Baldwin & Wisconsin AG Josh Kaul, press release, 2023: https://www.baldwin.senate.gov/news/press-releases/senator-baldwin-and-ag-kaul-push-meta-to-answer-for-inadequate-customer-service-to-wisconsin-small-businesses
• FTC, “Cybersecurity for Small Business”: https://www.ftc.gov/business-guidance/small-businesses/cybersecurity