Cybersecurity for small businesses: the 2026 field guide

Ask a small business owner what cybersecurity means and you usually get one of two answers: "we have antivirus" or "we are too small to be targeted". Both are reasonable, and both miss what actually happens. Attacks on small businesses are rarely targeted in the cinematic sense. They are opportunistic, automated, and shaped around the fact that a five-person company has no one whose full-time job is noticing.

This guide is the condensed version: what reaches you, what to fix first, what to spend money on once the free work is done, and how to check that it held. It is reviewed annually; this revision is from October 2026.

The threat model that actually applies

Five patterns cover most of what a small business experiences. Knowing them changes what you prioritise.

1. Invoice and payment fraud. Someone impersonates a supplier, or takes over a real mailbox and replies inside an existing thread. The tell is rarely a bad email address these days; it is a changed bank detail and a sense of urgency.
2. Account takeover by password reuse. A password from an old breach is tried against your email, your hosting, your accounting platform. If your email is compromised, every password reset for everything else lands in the attacker's lap.
3. Exposed remote access. A remote desktop port opened for a contractor, a NAS admin panel, a database with a weak password — reachable from the internet and scanned continuously by automated tools that do not care who you are.
4. Phishing that leads to ransomware. A document, an attachment, a fake login page, then encryption of the file share because the user had write access to all of it.
5. A compromised supplier. Your data is fine; theirs is not. Their mailbox sends you an invoice with new bank details, and the request is fluent because it was written by someone who has read your correspondence.

Where a small business is actually exposed

From the outside, the picture is narrower than the fear. The things that can be observed about a typical small business are its DNS records, its mail authentication, its certificate and headers, and which services answer the public internet. In practice, the same handful of gaps appear again and again: no DMARC enforcement, so anyone can forge the domain; a remote desktop or file-sharing port exposed because it was convenient once; a subdomain still pointed at a closed hosting account; a certificate that renews automatically but a header set that nobody owns.

The reason to start here is not that these are the only risks. It is that they are the ones you can find and fix this week without buying anything.

The five controls that carry the most weight

None of these is a project. Each is a decision plus an owner. The failure mode in a small business is almost never ignorance of the control; it is that nobody was named as responsible for it.

A 30-day starting plan

That is four weeks and no new software, apart from whatever MFA you already have. If it feels slow, consider the alternative: a programme that starts with a tool purchase and ends with a renewal invoice and no change in posture.

What to spend money on, in order

1. Free first. DNS records, MFA, closing exposed ports, deleting stale subdomains. This is the majority of the improvement available to most small businesses.
2. Backup that is off the main network. Immutable or offline copies, tested. Worth paying for; worthless if untested.
3. Endpoint protection with central visibility, if you have more than a handful of machines. The visibility matters more than the brand.
4. Someone to call. A retainer or an incident response agreement with a local provider, so the first hour of a bad day is not spent looking for a phone number.
5. Insurance, after the controls above. A policy cannot substitute for MFA, and insurers increasingly ask about exactly these basics before quoting.

How to tell whether it is working

Security work in a small business tends to be invisible until it fails, which makes it easy to stop funding. Three habits keep it honest. Keep a written list of what you changed and when, so a new person can inherit the reasoning. Re-check the external surface quarterly — the same checks, compared against last quarter's answers. And run one restore and one "what if the main mailbox is compromised" drill a year, because the recovery path is the part that is never practised and always needed.

A posture score is a reasonable way to express the external part of that in one number, provided you remember what it measures. Ours is a weighted summary of 22 publicly observable controls, with the observation behind every conclusive finding; it says nothing about your application code or your internal network. The assessment explainer is explicit about the boundary.

Advice that does not survive contact with reality

• "Use a password manager and you are fine." Useful, insufficient. A password manager does not stop a forged invoice or an exposed RDP port.
• "Compliance means secure." A questionnaire attests to a control existing on a date. It does not measure whether it still works.
• "Buy the enterprise stack." Tools you do not operate are a subscription, not a control. Fix the records first.
• "We are too small to be a target." You are probably not a target. You are a population: automated scanning does not distinguish between you and a larger company.

The useful question is not "are we a target" but "if someone tried the cheapest possible attack against us today, would it work?" For a domain without DMARC and a remote desktop port open to the world, the answer is often yes — and both are fixable before Friday.

What SMB Scanner Lite checks here

These are the controls from this area that the assessment evaluates from outside, without credentials and without touching anything private. Each one returns a status and, for every conclusive result, the record, header or handshake that produced it.

Only assess domains you own or are authorised to test — see responsible use. The published recorded assessment shows how a result and its evidence appear in a report, and the control catalog lists all 22 controls with their weights. Reference detail for this topic lives in SMB cybersecurity: where small businesses are actually exposed.