NetworkDefender
NetworkDefender
A plain-English guide to the controls that stop the attacks targeting businesses like yours
The average cyberattack on a small business cost $254,445 in 2024. That's the median, not the worst-case scenario. The Verizon Data Breach Investigations Report found that small businesses are victimized at four times the rate of large enterprises. Attackers go where the defenses are weakest. Under-resourced teams and informal IT setups make small businesses an easy mark.
What gets buried in those numbers: most breaches aren't sophisticated. Credential theft, phishing emails, and unpatched computers account for the overwhelming majority. These aren't nation-state attacks. They're opportunistic strikes on businesses that left a door unlocked.
Five controls close those doors. None require enterprise budgets or a full-time security team. They do require consistency — which is exactly where most small businesses fall short.
The fix starts with multi-factor authentication (MFA). Turn it on for every business account: email, banking, file storage, accounting software, everything. Microsoft's research found MFA blocks 99.9% of automated credential attacks. If someone steals your password but can't get past the second factor, they're locked out.
Pair MFA with a business password manager. Employees reusing the same password across work and personal accounts is one of the most common ways credentials end up for sale. A password manager generates unique, strong passwords and stores them securely. Your team stops making the tradeoffs that put you at risk.
The third piece is least privilege access: each person should only have access to what their specific job requires. If your bookkeeper's account gets compromised, it should not also have access to your entire customer database. And when someone leaves your company, revoke their access the same day. Former employees with active logins are a standing vulnerability most businesses don't think about until something goes wrong.
Your network connects everything: computers, phones, printers, payment terminals. When an attacker gets a foothold, poor network structure lets them move freely through every connected system.
Your guest network for customers or visitors should be completely separate from the network where you run operations. A compromised personal phone should not be able to reach your financial software or client files. If your network treats every device the same, one infected laptop can reach everything.
A business-grade firewall monitors traffic in and out and blocks what doesn't belong. Remote access should only go through a VPN, not through services that leave ports exposed to the internet. And your router firmware needs updates just like any other software. Most small businesses plug in a router and forget it exists. Manufacturers release security patches regularly; running old firmware means running known vulnerabilities that attackers actively exploit.
The same rule that applies to users applies to devices: access only to what's needed, nothing more.
Every device connected to your business is a potential entry point: laptops, desktops, phones, tablets.
Modern endpoint protection watches what software actually does rather than what it looks like. Endpoint Detection and Response (EDR) tools flag suspicious behavior: a process suddenly encrypting hundreds of files, a script contacting an unknown server, a legitimate program running in a way it shouldn't. For businesses without someone monitoring alerts in-house, Managed Detection and Response (MDR) services provide around-the-clock human review at a price that fits a small business.
Software updates are just as important. Unpatched software is how attackers get in before any detection tool fires. Enable automatic updates on your operating systems and every application running on company devices. It's the single highest-return security action that consistently gets skipped.
When ransomware hits, your backup determines whether you pay or recover for free. The median ransomware payment for small businesses in 2024 was $115,000. Paying doesn't guarantee your files come back intact.
The standard is the 3-2-1 rule, endorsed by CISA: three copies of your data, stored on two different media types, with one copy completely off-site or in a separate cloud account with immutable storage. Immutable means the backup can't be encrypted, modified, or deleted. Most cloud backup services offer this as a setting called object lock or write-once storage.
One rule that gets skipped until it's too late: test your restore. A backup you've never tested isn't a backup — it's a hope. Run a test restore quarterly to confirm you can actually recover your data at the speed your business requires. Most businesses discover their backup process is broken the day they actually need it.
AI is making this significantly worse. The typos and awkward phrasing that used to signal a fake email are mostly gone. Attackers generate personalized, convincing messages at scale. An email appearing to come from your bank, your accountant, or your CEO requesting a wire transfer can be nearly indistinguishable from the real thing.
Configure your email domain with SPF, DKIM, and DMARC. These settings prove your domain is legitimate and prevent attackers from sending emails that impersonate your address — the core tactic in most BEC attacks. Despite being available for years, only 4% of domains worldwide fully enforce DMARC. That means 96% are open to impersonation. Microsoft now requires DMARC alignment for high-volume senders, and it's becoming a baseline expectation across major email providers.
Then train your people. No filter catches everything. Employees who know how to pause on an unusual request — anything involving wire transfers, gift cards, or login credentials sent by email — stop attacks that technical controls miss entirely.
Most small business breaches are opportunistic. An attacker gets in through a reused password, a phishing email, or a laptop that hasn't been updated in months. These aren't exotic techniques. They're the same handful of moves used repeatedly against businesses that haven't closed the basics.
Get five things right: identity, network, endpoints, backups, and email. That won't make you invincible, but it makes you a far harder target than the business next door. In security, that's often enough.
NetworkDefender Security helps small businesses under 20 employees build and maintain exactly these defenses, from MFA and identity management to email authentication, endpoint protection, and backup. If you're not sure where you stand on any of the five pillars, reach out. We can help you figure it out quickly.