Small businesses are attractive targets precisely because they’re small. Criminals know most don’t have an IT department, a security team or a plan for when things go wrong. And for a small business, a single attack, whether it’s ransomware, a hijacked email account or a fake invoice that gets paid, can mean days of lost work, lost money and lost customer trust.

The good news: you don’t need an enterprise budget to be a hard target. Many of the most effective protections cost nothing, and the rest are surprisingly affordable. The trick is doing the right things in the right order.

Start Here: Free Protections That Stop Most Attacks

1. Turn on two-factor authentication everywhere

If you do only one thing, do this. Two-factor authentication (2FA) means a stolen password alone isn’t enough to get into an account. Start with the accounts that matter most:

  1. Email (Microsoft 365, Google Workspace or Gmail). Whoever controls your email can reset every other password.
  2. Banking and payment accounts.
  3. Your website, domain and social media accounts.

Use an authenticator app (Microsoft Authenticator or Google Authenticator, both free) rather than text-message codes, which can be stolen through SIM swaps. Better still, use passkeys wherever they’re offered: they can’t be phished at all.

2. Keep everything updated

Most successful attacks use security holes that already have a fix available. Turn on automatic updates for Windows or macOS, browsers, Microsoft Office and phones. Don’t forget your router, which is often years out of date. And replace devices that no longer receive updates, such as computers still running Windows 10, whose free security updates ended in October 2025.

3. Use the protection you already have

  • Built-in antivirus and firewall. Make sure Microsoft Defender and the Windows or macOS firewall are switched on.
  • Device encryption. Turn on BitLocker (Windows Pro) or FileVault (Mac), so a stolen laptop doesn’t mean stolen data.
  • Screen locks. Every computer and phone should lock automatically and need a PIN, password or fingerprint to open.

4. Don’t work as an administrator

Staff should use standard user accounts day to day, not administrator accounts. If someone clicks something malicious, it can do far less damage without admin rights. Keep admin accounts for installing software and changing settings.

5. Secure your Wi-Fi

  • Change the router’s default admin password.
  • Use WPA2 or WPA3 encryption with a strong Wi-Fi password.
  • Put customers and visitors on a separate guest network, so they never share a network with your business computers.

Not sure what’s connected to your network? Our guide to free network scanners shows you how to find out.

6. Remove access when people leave

When a staff member or contractor leaves, disable their accounts, change any shared passwords and collect company devices the same day. Former employees’ accounts are a common, and entirely avoidable, way in.

Low-Cost Essentials Worth Paying For

A password manager

People reuse passwords because remembering dozens of unique ones is impossible. A password manager solves that: it creates and stores a strong, unique password for every account, and lets you share business logins with staff securely instead of by WhatsApp or sticky note.

Modern advice on passwords has also changed. Length beats complexity: a long passphrase like harbour-mango-lantern-seven is stronger and easier to type than P@ssw0rd!. And there’s no need to force regular password changes unless you suspect one has been exposed.

Backups that ransomware can’t touch

Backups are your last line of defence. If ransomware, a failed hard drive or a mistake wipes your files, a good backup turns a disaster into an inconvenience. Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site in the cloud.

Make sure at least one copy is immutable, meaning it can’t be changed or deleted, even by an attacker with your passwords. And test a restore every few months: a backup you’ve never restored from is a hope, not a plan. For the full picture, read why every small business needs a data backup plan and why immutable backups are now non-negotiable. We set this up with Backblaze, from a flat price per computer.

Business-grade endpoint protection

Built-in antivirus is a good baseline for home users, but a business with staff, customer data or remote workers benefits from protection that detects suspicious behaviour, can roll back ransomware damage, and lets you manage every device from one place. See The Future of Antivirus for what to look for, or our Bitdefender page for what we recommend.

Habits That Cost Nothing but Save Everything

Train your team, briefly and often

Your staff are your first line of defence. You don’t need formal courses: a 10-minute chat at a team meeting every month or two works well. Cover:

  • How to spot phishing: urgency, unexpected attachments, links that don’t match the sender, and requests for passwords or payments.
  • That AI now makes scams look and sound real, including cloned voices and deepfake video calls.
  • How to protect their WhatsApp accounts, especially if they use them for work.
  • That reporting a mistake quickly is always better than hiding it.

Verify every payment request

Fake invoices and “urgent” payment requests from a boss or supplier cost businesses more than almost any other scam. Make it a rule: any new payment, or any change to someone’s bank details, is confirmed by phone on a number you already have, never the one in the email or message.

Have a simple plan for when things go wrong

Write one page and keep it somewhere you can reach even if your computers are down:

  • Who to call first (your IT provider, your bank, your insurer).
  • How to disconnect an infected computer from the network.
  • Where your backups are and how to restore them.
  • Who needs to be told: staff, customers, and, for serious incidents, Trinidad and Tobago’s national cyber incident response team (TT-CSIRT).

Review once or twice a year

Spend an hour checking: Who has access to what? Are updates, backups and 2FA still working? Are there old accounts or devices to remove? An outside review every year or two is worth it too. A fresh pair of eyes spots gaps you’ve stopped noticing.

Your Budget Security Checklist

This week (free)

  • 2FA on email, banking and your domain
  • Automatic updates on for every device
  • Defender, firewall and screen locks switched on
  • Payment verification rule agreed with staff

This month (free)

  • Device encryption turned on
  • Staff using standard (non-admin) accounts
  • Router password changed and guest Wi-Fi set up
  • Old accounts and ex-staff access removed
  • One-page incident plan written

This quarter (low cost)

  • Password manager rolled out
  • Off-site, immutable backups running, and one restore tested
  • Business endpoint protection on every computer
  • First 10-minute security chat with the team

The Bottom Line

Good security for a small business isn’t about expensive tools. It’s about covering the basics consistently. Most attacks succeed through a stolen password, an unpatched computer or a convincing message, and the free steps above shut most of those doors.

If you’d rather have someone handle it for you, that’s what we do. Get in touch, and we’ll review your current setup and give you a practical, prioritised plan that fits your budget, with no overselling.