Blog · SMB security basics
Cybersecurity basics for small businesses
You do not need a security department to close the gaps that most small businesses actually have. You need a short list, someone with the authority to change a record, and a way to check that it stayed changed.
Small businesses are not usually breached by something clever. They are breached by something ordinary that nobody owned: a mailbox that anyone could forge, a remote desktop port that was opened for a contractor in 2021, a subdomain still pointed at a closed hosting account.
The baseline guides here are written in that spirit. They assume one person wears five hats, budgets are real, and the goal is a defensible minimum rather than a perfect one.
Every post in this cluster ends with the same question: what would you do on Monday? Where a check can be run by hand, the command is in the post. Where it cannot, the post says so rather than implying a tool will handle it.
Reference article
For the specification-level detail behind these guides — mechanisms, edge cases and what the standard does not cover:
SMB cybersecurity: where small businesses are actually exposedWhat the tool checks
The controls this cluster maps to.
Pulled from the published 22-control catalog, with the weights that drive the posture score.
| Control | What is evaluated |
|---|---|
| External exposure | Which of your services answer the public internet, and whether that was a decision. |
| Email authenticity | Whether a stranger could send mail as your domain today. |
| Transport and web hygiene | Certificate and header configuration on your public endpoints. |
| DNS integrity | Whether the records that direct mail and traffic can be silently altered. |
Other clusters
Keep going elsewhere
Check this area on your own domain.
The assessment covers all five clusters, with the observation quoted behind every conclusive finding.