Small Business Security Hub

A reasonable security budget for a small business is 3–6% of revenue, though the actual number depends on your industry and data sensitivity. At minimum, budget for a password manager ($8/user/month), endpoint protection ($4/device/month), a VPN for remote workers, and basic cyber insurance. For physical security, a no-contract system like SimpliSafe starts around $15/month for monitoring. The cost of a single data breach averages $164,000 for small businesses — prevention is dramatically cheaper than recovery.

Phishing is the number one attack vector for small businesses, responsible for over 90% of successful breaches. Attackers send emails that impersonate vendors, banks, or even your own CEO to trick employees into clicking malicious links or sharing credentials. The fix: enable multi-factor authentication on every account, train employees to verify unexpected requests through a second channel, and configure SPF/DKIM/DMARC on your email domain to prevent spoofing.

Yes, if you store any customer data — names, emails, payment info, or health records. A cyber insurance policy typically costs $1,000–$3,000/year for small businesses and covers breach notification costs, legal fees, forensic investigation, and business interruption. Most general liability policies explicitly exclude cyber incidents. Look for policies that include incident response support, as having experts on call during a breach is often more valuable than the financial coverage itself.

Step 1: Disconnect affected systems from the network immediately — do not power them off (forensic evidence lives in memory). Step 2: Call your cyber insurance provider; they will assign an incident response team. Step 3: Reset all passwords and revoke active sessions company-wide. Step 4: Determine what data was accessed. Step 5: If customer data was compromised, you are legally required to notify affected individuals in most states (timelines vary from 30–90 days). Step 6: File a report with the FBI's IC3 at ic3.gov. Do not pay ransomware demands without consulting your incident response team and legal counsel first.