Quick answer: In 2026, the minimum cybersecurity a small business needs is: multifactor authentication on every account, endpoint detection and response on every device, isolated and tested backups, email security that catches impersonation, automatic patching, security awareness training, a written incident response plan, and someone monitoring for threats around the clock. Those eight controls stop the large majority of attacks on small businesses, satisfy most cyber insurance applications, and form the floor regulators expect. Businesses in regulated industries add identity risk detection, data loss prevention, and compliance documentation on top.
Cybersecurity advice for small businesses tends to fail in one of two directions: so basic it is useless (“use strong passwords”) or so enterprise-grade that nobody with a 40-person company can act on it. This is the middle: the specific controls that matter, why each one earns its place, and what you can skip until you are bigger.
Why the baseline matters more in 2026
The FBI’s Internet Crime Complaint Center logged $20.877 billion in reported cybercrime losses for 2025, a 26 percent increase over 2024 and the first year above $20 billion, across more than a million complaints. Business email compromise alone accounted for $3.05 billion across 24,768 complaints, and 86 percent of those fraudulent payments moved by wire or ACH. For the first time the FBI tracked AI-enabled crime separately: $893 million in 2025 losses, including voice cloning and AI-written impersonation emails.
The important pattern inside those numbers is that the money is lost to fraud and account takeover, not exotic hacking. Attackers log in with stolen credentials, impersonate people your staff trust, and redirect payments. That is good news for a small business, because the defenses against those attacks are known, affordable, and mostly a matter of actually turning them on.
The eight controls every small business needs
| Control | What it stops | Why it is non-negotiable |
|---|---|---|
| Multifactor authentication on every account | Account takeover with a stolen password | Most breaches start with a login; MFA makes a stolen password useless |
| Endpoint detection and response (EDR) | Ransomware and malware, including unknown variants | Traditional antivirus misses new attacks; EDR stops them by behavior |
| Isolated, tested backups | Ransomware, deletion, insider damage | A backup ransomware can reach, or that has never been restored, is not a backup |
| Email security with impersonation protection | Phishing, CEO fraud, vendor invoice fraud | $3.05 billion in BEC losses in 2025, none of it stopped by basic spam filtering |
| Automatic patching | Exploits of known vulnerabilities | Attackers scan the internet for whoever has not applied the fix |
| Security awareness training with phishing simulations | The click that starts most incidents | AI-written lures have no typos; trained instincts are the remaining defense |
| Written, rehearsed incident response plan | Chaos and delay when something gets through | Speed decides whether a wire gets recovered and whether a breach stays small |
| 24/7 monitoring by people | Attacks that happen at 2 a.m. on a Saturday | Alerts nobody sees are not protection; attackers deliberately work off-hours |
A few notes on the ones businesses most often get wrong.
MFA has to be everywhere, enforced by policy. Email, remote access, admin accounts, line-of-business apps, and the owner’s account most of all. “Most people have it turned on” is the sentence that precedes most account-takeover stories. On Microsoft 365, enforcement happens through Conditional Access, which is included in Business Premium and E3, as we explain in our Entra ID P1 vs P2 guide.
Backups must be isolated and restored on a schedule. Microsoft 365 and Google Workspace do not back up your data in any way you can recover from after ransomware or a malicious deletion; see why Microsoft 365 does not back up your data. A quarterly test restore is the control, not the existence of a backup job.
The incident response plan can be two pages. Who to call, how to isolate a device, how to freeze a fraudulent wire with your bank, who notifies clients and when. Rehearse it once a year. The FBI’s Recovery Asset Team has frozen a majority of fraudulent transfers when victims report within hours, which is only possible if someone knows the plan.
Monitoring is the control small businesses skip, and the one that separates a contained incident from a catastrophe. Every other control on the list generates alerts. Without a person watching them, you have a very detailed record of how you were breached. This is where a provider with a real security operations center earns its fee; our EDR vs MDR vs XDR explainer covers the layers.
What regulated businesses add
If you are in healthcare, legal, financial services, or defense contracting, or you want cyber insurance at a sane premium, the baseline is the floor and these come next: risk-based identity protection that reacts to suspicious sign-ins automatically, data loss prevention and sensitivity labels so regulated data cannot leave quietly, privileged access controls so admin rights are limited and logged, vulnerability scanning on a continuous cycle with periodic penetration testing, and the documentation trail (policies, risk assessments, training records, evidence of controls) that auditors, carriers, and frameworks such as HIPAA, NIST 800-171, and SOC 2 expect. Our cyber insurance controls guide maps these to what carriers ask on the application.
What you can skip for now
Honesty cuts both ways. A 40-person company does not need a dedicated security information and event management platform it will never tune, a full-time security analyst, a web application firewall for a brochure website, or a dozen overlapping point products. Buy the baseline, configure it properly, and get someone to operate it. Spend on operation before you spend on more tools.
How CyberDuo delivers the baseline
The eight controls above are the standard foundation every CyberDuo client runs on, delivered as part of managed IT rather than sold as add-ons: SentinelOne for endpoint detection and response, Check Point Avanan for email security, Dropsuite for isolated backups, KnowBe4 for training and phishing simulations, NinjaOne for automated weekly patching, enforced multifactor authentication through Conditional Access, and our own in-house 24/7 security operations center with Blackpoint Cyber managed detection and response watching every environment. We publish the full list in our security stack, explained.
CyberDuo is a cybersecurity-focused managed IT provider founded in 2016, headquartered in Glendale, California, SOC 2 Type II attested, and a Microsoft Solutions Partner, serving regulated businesses of 50 to 200 users across Los Angeles, Orange County, and San Diego.
Frequently asked questions
What is the most important cybersecurity control for a small business? Multifactor authentication enforced on every account. Most breaches begin with a stolen password, and MFA makes a stolen password useless.
How much should a small business spend on cybersecurity? Through a security-focused managed IT provider, the baseline is typically included in a per-user fee of roughly $150 to $250 per month in 2026, which covers both IT support and the eight controls above. Standalone security tooling without someone operating it is usually wasted spend.
Do small businesses really get targeted? Yes, deliberately. Small businesses hold money, identities, and trusted email accounts behind weaker defenses, and most attacks are automated scans that find whoever is easiest. See why hackers love small businesses.
Is antivirus enough? No. Traditional antivirus only recognizes known threats. Endpoint detection and response stops attacks by their behavior, which is how it catches new ransomware.
Does cyber insurance require these controls? Nearly all carriers now require MFA, endpoint detection and response, tested backups, email security, and training as conditions of coverage, and misrepresenting them on the application can void a claim.
What should a business do first if it has none of this? Turn on MFA everywhere this week, deploy endpoint detection and response, and verify your backups actually restore. Then address email security, training, and monitoring. A security-focused provider can deliver all eight in a single onboarding.
If you are not sure which of the eight you have, we will tell you in one conversation.
