Small businesses now account for a majority of cyberattack targets in the United States. That’s not a coincidence — it’s a business decision by attackers. Enterprise companies have dedicated security teams, intrusion detection systems, and incident response plans. Local businesses typically have none of those things, which makes them far easier and often more rewarding targets. A ransomware attack that shuts down a regional chain’s operations for six hours is a minor incident. The same attack shutting down your point-of-sale system for six hours during your busiest weekend could be catastrophic.
The SBA’s cybersecurity guide for small businesses is explicit: small operators are disproportionately vulnerable precisely because they lack the layered defenses larger companies take for granted. The good news is that the vast majority of successful attacks against small businesses exploit a handful of well-known vulnerabilities — and eliminating those vulnerabilities doesn’t require expertise or large budgets. Here are the five steps that matter most.
Step 1: Enable Multi-Factor Authentication on Everything
Time required: 30–60 minutes Cost: Free
Multi-factor authentication (MFA) requires a second form of verification — usually a code texted to your phone or generated by an app — in addition to your password. It is the single highest-impact security measure available, and it’s free on virtually every platform.
Enable MFA on:
- Your email account (Gmail, Outlook, or whatever you use)
- Your bank and payment processor accounts
- Your accounting software (QuickBooks, FreshBooks, etc.)
- Your payroll platform
- Your point-of-sale system
- Any cloud storage (Google Drive, Dropbox)
- Your domain registrar
The practical protection MFA provides is enormous: Microsoft’s research found that MFA blocks over 99% of automated account compromise attacks. Most attacks targeting small businesses involve credential stuffing — using stolen passwords to access accounts. MFA stops those attacks cold.
Use an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator) rather than SMS codes when possible — it’s marginally more secure and works even without cell service.
Step 2: Use a Password Manager
Time required: 2–3 hours initial setup Cost: $3–$5/month per user, or free with Bitwarden
Weak and reused passwords are the root cause of an enormous share of business account compromises. Using “Restaurant2024” for your email, QuickBooks, and vendor portal means that if any one of those services is breached, attackers have access to everything.
A password manager generates and stores complex, unique passwords for every account. You remember one master password; the manager handles everything else.
Bitwarden is free for individuals and low-cost for teams, open-source, and well-regarded by security professionals. 1Password Business ($8/user/month) is a more polished option if you have staff who need shared access to business credentials.
When setting up, prioritize the accounts listed in Step 1. Change every shared business password to something unique and complex. Store the master password somewhere physically secure (written down and locked away) as a backup.
Step 3: Keep Your POS and Payment Systems Updated
Time required: 15 minutes per update (set to automatic where possible) Cost: Free
Point-of-sale systems and payment terminals are high-value targets because they process card data. Most PCI-DSS compliance requirements (the payment card industry standards) include keeping software current — but beyond compliance, software updates almost always include patches for known security vulnerabilities.
Enable automatic updates on:
- Your POS software (Square, Toast, Clover, Lightspeed)
- Your payment terminal firmware — check your provider’s dashboard for pending updates
- Your router firmware — this is the most commonly neglected, and routers with outdated firmware are a common entry point for attackers
Also review what’s connected to your business network. If your POS system is on the same network as your public customer Wi-Fi, separate them. Most modern routers support a “guest network” feature — put customer Wi-Fi on the guest network and keep your business systems on a separate, private network.
Step 4: Train Staff to Recognize Phishing
Time required: 1 hour for initial training Cost: Free
The most sophisticated technical security is defeated if an employee clicks a malicious link. Phishing — emails or texts designed to trick people into clicking a link, entering credentials, or downloading malware — is the most common attack vector against small businesses by a wide margin.
Staff training doesn’t need to be complex. Cover these three rules:
- Never click links in unexpected emails. If a vendor, bank, or software company sends an urgent request, go directly to their website by typing the address rather than clicking.
- Verify wire transfer and payment requests by phone. “Business email compromise” attacks impersonate your accountant, vendor, or boss asking for a payment — always verify unexpected payment requests with a live phone call to a known number.
- Treat urgency as a red flag. Legitimate companies don’t send emails saying your account will be deleted in 24 hours unless you click now. That’s a manipulation tactic.
The FTC’s phishing guidance has free examples you can share with staff. A 30-minute discussion reviewing a few real-world examples is more effective than any written policy.
Step 5: Set Up Automated Backups
Time required: 1–2 hours to configure Cost: $2–$10/month for cloud storage
Ransomware attacks encrypt your files and demand payment to restore them. The defense is simple: maintain backups that aren’t connected to your primary system. If an attacker encrypts everything on your computers, you restore from backup and decline to pay.
Follow the 3-2-1 rule: three copies of your data, on two different media types, with one copy offsite (in the cloud).
In practice for a small business:
- Enable automatic backup of your accounting files, customer records, and business documents to Google Drive or Microsoft OneDrive (both offer free tiers with paid upgrades)
- If you run any local servers or network-attached storage, add a second backup destination (a separate cloud service or a physically separate external drive kept offsite)
- Test the restore process at least once — a backup you’ve never tested isn’t a backup you can count on
Most accounting and POS software has cloud sync or backup built in — check that it’s enabled and that backups are current.
Your One-Week Plan
These five steps don’t need to happen all at once. A realistic one-week rollout:
- Day 1: Enable MFA on email and banking accounts
- Day 2: Enable MFA on POS, payroll, and other business accounts
- Day 3: Set up Bitwarden; change shared passwords to unique ones
- Day 4: Check and apply POS/router updates; separate guest Wi-Fi
- Day 5: Train staff on phishing (30-minute conversation)
- Day 6–7: Configure automated backups; verify they’re running
Most attacks succeed because of one thing left undone. Running through this list eliminates the vulnerabilities that account for the vast majority of small business breaches — no IT department required.
