On this page
The most common reason small businesses skip cybersecurity is the belief that they are too small to matter. That belief is wrong, and the reason it is wrong has nothing to do with movie-villain hackers.
Almost all attacks on small businesses are automated. A script runs across the internet looking for unprotected email domains, exposed login pages, and unpatched software. It does not know how big you are. It does not care what industry you are in. It only cares whether your defences are weak enough to make the attempt worthwhile.
This guide answers the question most business owners actually have, which is not "what is cybersecurity" but "what is the smallest amount of work that meaningfully reduces our risk."
The short answer
Yes. Every small business that uses email, cloud software, or a website needs cybersecurity, because almost every attack at this scale is automated and indifferent to company size. The realistic version is not a full IT department. It is four specific layers (email authentication, multi-factor authentication, endpoint protection, and SaaS visibility) that together cover most of the threat surface for under a few hundred dollars a month.
The rest of this article walks through what each layer does, why it matters, and how to think about the cost.
Why small businesses get targeted
Three things make small businesses easier to attack than larger companies.
The defences are usually thinner. A 12-person company is unlikely to have DMARC enforcement, MFA on every account, or a managed endpoint protection tool. A 12,000-person company has all three by default. An automated script gets through the small business in seconds and bounces off the larger one.
The decision-makers are easier to reach. A targeted phishing email aimed at a small business owner has a higher hit rate than one aimed at a Fortune 500 executive who has been trained for years. The owner is also the IT department, the finance team, and the legal contact. One compromised inbox unlocks everything.
The recovery is slower. A small business that gets ransomwared often does not have offline backups, an incident response plan, or someone on retainer who knows the environment. The result is a longer outage and a higher chance of paying the ransom.
None of this requires the attacker to know who you are. The scripts are looking for cheap wins, and small businesses with weak defences are the cheapest wins on the internet.
The real threat picture
Most of what small businesses face falls into four categories. These are not theoretical. They are the categories every cyber insurance application asks about.
Email-based attacks. Phishing, business email compromise, and spoofing. The attacker either tricks an employee into clicking, or impersonates someone (you, a vendor, a client) to redirect a payment. This is by far the most common category.
Credential theft. Passwords reused across services get exposed in one breach and tried everywhere else. A password from a 2019 LinkedIn breach gets your accounting software in 2026. Without MFA, the attempt succeeds on the first try.
Endpoint compromise. A laptop or workstation gets malware, often through a downloaded attachment or a compromised website. The attacker then uses that endpoint as a foothold to reach email, files, and connected systems.
SaaS sprawl. Most growing businesses run on 30 to 80 cloud applications. Some have full admin access to email or files. Old logins from former employees, integrations no one remembers approving, and tools that haven't been touched in two years all create exposure that nobody is monitoring.
The pattern across all four: attacks start small, look reasonable for hours or days, and compound when undetected.
What you actually need (not what MSPs sell)
The traditional managed service provider sells tickets and tools. Buy this software, file a ticket when something breaks, get billed by the hour. That model works for larger companies with internal IT. It is the wrong fit for most small businesses.
Small businesses do not need help managing printers or running cable. They need someone accountable for the digital surface their business actually runs on: email, endpoints, cloud apps, and the website. That is closer to fractional CTO work than to traditional IT support.
The CorEthos position on this is simple. We do not manage hardware, networking, or physical IT. We secure digital operations. If you need someone to come on-site to plug in a router, we are not your firm. If you need someone to make sure your domain is authenticated, your team has MFA, your laptops are protected, and your SaaS stack is not leaking, that is the work.
The four layers every small business should have
If you do nothing else, these four layers cover the majority of realistic threats at this size.
Layer 1: Email authentication (SPF, DKIM, DMARC)
This is the floor. Without it, anyone on the internet can send email pretending to come from your domain. Clients, vendors, and your own team are exposed to spoofing. Email authentication management is a specific service for exactly this. The DNS records cost nothing. The monitoring is the part that needs ongoing attention.
Layer 2: Multi-factor authentication (MFA)
Every account that handles email, money, or customer data needs MFA. Not just the owner's account. Every account. The single most cost-effective security control available, and the one most commonly skipped on accounts that are "not important." Those are usually the accounts that get compromised.
Layer 3: Endpoint protection (EDR)
Modern endpoint protection (sometimes called EDR, for endpoint detection and response) does more than the antivirus software of a decade ago. It watches for suspicious behaviour, isolates compromised devices automatically, and gives someone visibility when something goes wrong. Free antivirus is no longer enough. Built-in tools like Microsoft Defender for Business are a reasonable starting point, but they need to be configured and watched.
Layer 4: SaaS visibility
This is the one most small businesses miss entirely. You probably do not know how many cloud applications your team is using. You almost certainly do not know which of them have admin-level access to your email or files. A SaaS posture management tool answers both questions, and surfaces the ones that need attention. This is the work that prevents most small business breaches that come through a forgotten integration.
How to think about budget
The wrong way to budget for cybersecurity is "how much can we afford to spend." The right question is "what does an incident cost us, and what reduces that probability."
For a typical small business, an incident that takes the team offline for three to five days costs more in lost revenue and recovery hours than 12 to 18 months of basic security spend. Insurance premiums alone are noticeably higher for businesses without documented authentication and MFA.
Realistic ranges for a 10 to 50 person business:
- Email authentication monitoring: $50 to $150 per month
- MFA: usually included in Microsoft 365 or Google Workspace business plans
- Endpoint protection (managed): $5 to $15 per device per month
- SaaS visibility: $50 to $300 per month depending on team size and stack
The total at the small end is under $300 per month. That is meaningfully less than one ransomware incident, one spoofed payment, or one cyber insurance claim denial.
Where to start: first three things
If you are starting from zero, the right sequence is:
- Get a domain authentication scan. Find out if you have SPF, DKIM, and DMARC. This is free and takes five minutes.
- Audit MFA across your team. Open your Microsoft or Google admin console and confirm every user has MFA enabled. Not just the executives. Everyone.
- Inventory your SaaS stack. List every cloud application someone on the team is using. Note which ones have admin access to email or files. This is the worst hour you will spend, and the most valuable.
After those three, you have enough information to know where the gaps are. The work after that is fixing what the inventory revealed.
FAQ
Are we too small to be a target?
No. Almost every attack on a small business is automated. The scripts that run across the internet looking for weak defences do not know how big you are. They only know whether your authentication, MFA, and endpoint protection are in place. A 5-person business with weak defences is a higher-probability target than a 5,000-person business with strong ones.
Do we need to hire a full IT team?
No. Most small businesses do not need a full IT department, and traditional managed service providers are often the wrong fit for this size. The right model is closer to a fractional CTO: someone accountable for digital security and infrastructure who works with you on a retainer rather than a ticket basis.
What is the difference between cybersecurity and IT support?
IT support is responsive: something breaks, someone fixes it. Cybersecurity is proactive: configure systems so the breakage is less likely to happen, and detect it early when it does. Many MSPs sell both as a single bundle, but they require different skills and different cadences of work.
What is the single most important thing to do first?
Enable MFA on every account that touches email, money, or customer data. It is free or close to free, it takes a day or two to roll out, and it prevents the largest single category of small business breaches. Email authentication is a close second.
Glossary
- Cybersecurity
- The practice of protecting digital systems, accounts, and data from unauthorized access and disruption. For small businesses, this usually means email, cloud accounts, devices, and websites.
- MFA (Multi-Factor Authentication)
- A login method that requires two or more pieces of evidence (a password plus a code from a phone, for example). Prevents most password-only attacks.
- EDR (Endpoint Detection and Response)
- Modern endpoint protection software that watches for suspicious behaviour on laptops and workstations, isolates compromised devices automatically, and gives administrators visibility when something goes wrong.
- Phishing
- A social engineering attack delivered by email, text, or chat that tries to trick the recipient into revealing credentials, paying a fake invoice, or downloading malware.
- Business email compromise
- A specific type of phishing where the attacker impersonates an executive, vendor, or client to redirect a wire transfer or steal credentials. Often involves a compromised inbox.
- SaaS posture management
- The practice of monitoring which cloud applications your team uses, what access they have, and where the risk lives. Closes the visibility gap created by SaaS sprawl.
- Ransomware
- Malware that encrypts business files and demands payment for the decryption key. The leading cause of multi-day outages for small businesses.
- Managed Service Provider (MSP)
- A traditional IT outsourcing model that bundles helpdesk support, hardware management, and basic security under a single contract. Often sold per-device or per-ticket.
- Fractional CTO
- A part-time technical leader engaged on a retainer to set strategy, oversee digital security, and coordinate the tech stack. Common for businesses too small to justify a full-time CTO but too large to ignore the role.
- Cyber insurance
- An insurance product that covers some of the financial impact of a security incident. Increasingly requires documented MFA, email authentication, and endpoint protection as a condition of coverage.
If you want to know specifically where your business is exposed, book a 15-minute review. We start with the four layers above and tell you which ones are in place and which ones are not. There is no follow-up unless you ask for one.
