Small and medium businesses are attractive targets precisely because they often lack a dedicated security team. The good news: a few practical steps address most of the risk.

Where to focus

Phishing, weak passwords, missing MFA, unpatched systems, poor backups, over-shared access, and untrained staff account for the majority of incidents. Tackle them in that order and you close most of the door.

Start with a simple checklist and improve one item a week.