Small business cybersecurity comes down to 5 core practices: multi-factor authentication, password management, software patching, secure backups, and employee security awareness training. These are either free or inexpensive — MFA is built into Microsoft 365 and Google Workspace — yet 70.5% of all data breaches hit small and mid-sized businesses, with stolen credentials as the initial access vector in 22% of cases. The average cyberattack costs a small business $254,445, and 60% shut down within six months.

You have seventeen browser tabs open about cybersecurity, each one telling you a different thing to panic about. Zero-day exploits. Nation-state threat actors. AI-powered polymorphic malware. Supply chain attacks. And somewhere between reading about quantum computing threats and advanced persistent threats, you closed your laptop and went back to doing actual work — because none of it felt actionable and all of it felt overwhelming.

Here is the uncomfortable truth about small business cybersecurity in 2026: the threats that actually take down small businesses are not sophisticated. They are embarrassingly simple. Stolen passwords. Unpatched software. Employees clicking phishing links. Missing backups. No multi-factor authentication. That is the list. That is basically the whole list.

Small business cybersecurity comes down to five core practices that prevent the vast majority of breaches: multi-factor authentication (MFA), strong password management, regular software updates and patching, secure backups, and employee security awareness training. According to the 2025 Verizon Data Breach Investigations Report, small and mid-sized businesses accounted for 70.5% of all data breaches, with stolen credentials as the most common initial access vector in 22% of cases. The businesses that get these five fundamentals right are dramatically better protected than those chasing every new threat headline.

I am going to walk you through each of these five practices, explain why they matter more than anything else on your cybersecurity to-do list, and give you tools to implement each one today — including a PowerShell security audit script and an MFA setup guide for the two platforms most small businesses use.

The Numbers That Should Keep You Up at Night

Before we get into solutions, let me give you the context that makes these five priorities obvious. I am not trying to scare you into buying anything. I am trying to scare you into doing the free stuff that actually works. For related strategies, check out Vendor Risk Assessment for Small Businesses: A Template You Can Use Today.

46% of all cyber breaches impact businesses with fewer than 1,000 employees. This is not a big-company problem. Small businesses are the primary target because attackers know you probably do not have a dedicated security team, a SIEM, or even basic monitoring in place.

60% of small businesses that suffer a cyberattack shut down within six months. Not because the attack itself is catastrophic, but because the costs — forensic investigation, legal fees, customer notification, reputation damage, regulatory fines — pile up fast when you do not have enterprise-level reserves to absorb them.

The average cost of a cyberattack on a small business is $254,445. Some incidents hit $7 million. For a business pulling in $500K to $2M in annual revenue, a quarter-million-dollar hit can be terminal.

74% of small business owners self-manage their cybersecurity or rely on an untrained family member or friend. Only 15% have hired external IT staff or use a managed service provider. And a full third of businesses with 50 or fewer employees rely on free, consumer-grade security tools.

80% of all hacking incidents involve compromised credentials or passwords. Not zero-days. Not sophisticated exploits. Stolen, guessed, or reused passwords. This single statistic is why MFA is number one on our list.

These numbers are not from some vendor trying to sell you a firewall. They come from the Verizon DBIR, StrongDM’s 2026 analysis, and the FTC’s small business cybersecurity guidance. The pattern is consistent across every data source: small businesses are under-protected, over-targeted, and the fixes are simpler than anyone wants to admit.

Thing #1: Multi-Factor Authentication (MFA)

If you do nothing else after reading this article, turn on MFA everywhere. Today. Right now. I will wait.

MFA means that even if an attacker steals your password — and let me be clear, passwords get stolen constantly through phishing, data breaches, and credential stuffing — they still cannot get into your account without the second factor. That second factor is typically your phone (an authentication app or SMS code), a hardware security key, or a biometric like your fingerprint.

Here is how effective MFA is: Microsoft’s research consistently shows that MFA blocks over 99.9% of automated account compromise attacks. Google found similar numbers. The math is simple. An attacker who has your password but not your phone is locked out. An attacker who has your phone but not your password is also locked out. They need both, and that combination is orders of magnitude harder to achieve.

Where to enable MFA first (in priority order):

1. Email accounts — your email is the recovery mechanism for everything else
2. Banking and financial accounts
3. Your domain registrar and hosting provider
4. Cloud storage (Google Drive, OneDrive, Dropbox)
5. Social media accounts used for business
6. Any SaaS platform that stores customer data

For Microsoft 365 businesses, here is a PowerShell script that checks MFA status across all your users and flags anyone who has not enrolled:

<#
.SYNOPSIS
    Check MFA enrollment status for all Microsoft 365 users
.DESCRIPTION
    Connects to Microsoft Graph and reports which users have MFA
    configured and which methods they use.
.NOTES
    Requires: Microsoft.Graph PowerShell module
    Install: Install-Module Microsoft.Graph -Scope CurrentUser
    Version: 1.0 | PowerShell 5.1+</p>
<h1>></h1>
<h1>Install module if needed</h1>
<p>if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Users)) {
    Install-Module Microsoft.Graph -Scope CurrentUser -Force
}</p>
<h1>Connect with the permissions we need</h1>
<p>Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All", "User.Read.All"</p>
<h1>Get all users</h1>
<p>$users = Get-MgUser -All -Property DisplayName, UserPrincipalName, AccountEnabled |
    Where-Object { $_.AccountEnabled -eq $true }</p>
<p>$report = @()</p>
<p>foreach ($user in $users) {
    $methods = Get-MgUserAuthenticationMethod -UserId $user.Id</p>
# Categorize authentication methods
$mfaMethods = $methods | Where-Object {
    $_.AdditionalProperties.'@odata.type' -ne '#microsoft.graph.passwordAuthenticationMethod'
}

$methodNames = $mfaMethods | ForEach-Object {
    switch ($_.AdditionalProperties.'@odata.type') {
        '#microsoft.graph.microsoftAuthenticatorAuthenticationMethod' { 'Authenticator App' }
        '#microsoft.graph.phoneAuthenticationMethod' { 'Phone/SMS' }
        '#microsoft.graph.fido2AuthenticationMethod' { 'FIDO2 Security Key' }
        '#microsoft.graph.windowsHelloForBusinessAuthenticationMethod' { 'Windows Hello' }
        '#microsoft.graph.emailAuthenticationMethod' { 'Email' }
        default { 'Other' }
    }
}

$report += [PSCustomObject]@{
    User        = $user.DisplayName
    Email       = $user.UserPrincipalName
    MFA_Enabled = if ($mfaMethods.Count -gt 0) { "YES" } else { "NO - AT RISK" }
    Methods     = ($methodNames -join ", ")
    MethodCount = $mfaMethods.Count
}

<p>}</p>

<h1>Display results</h1>

<p>Write-Host "<code>n=====================================" -ForegroundColor Green

Write-Host "  MFA Enrollment Status Report" -ForegroundColor Green

Write-Host "=====================================</code>n" -ForegroundColor Green</p>

<p>$enrolled = ($report | Where-Object { $<em>.MFA_Enabled -eq "YES" }).Count

$notEnrolled = ($report | Where-Object { $</em>.MFA_Enabled -match "NO" }).Count

$total = $report.Count</p>

<p>Write-Host "Total Active Users: $total" -ForegroundColor Cyan

Write-Host "MFA Enrolled: $enrolled" -ForegroundColor Green

Write-Host "NOT Enrolled: $notEnrolled" -ForegroundColor Red

Write-Host "Coverage: $([math]::Round(($enrolled / $total) * 100, 1))%`n" -ForegroundColor Yellow</p>

<h1>Show users without MFA (the ones you need to fix)</h1>

<p>$atRisk = $report | Where-Object { $_.MFA_Enabled -match "NO" }

if ($atRisk) {

    Write-Host "USERS WITHOUT MFA (action required):" -ForegroundColor Red

    $atRisk | Format-Table User, Email -AutoSize

}</p>

<h1>Export full report</h1>

<p>$reportPath = ".MFA-Status-$(Get-Date -Format 'yyyy-MM-dd').csv"

$report | Export-Csv -Path $reportPath -NoTypeInformation

Write-Host "Full report saved to: $reportPath" -ForegroundColor Greentext

This script connects to Microsoft Graph, pulls every active user, checks their registered authentication methods, and tells you exactly who does not have MFA set up. The users flagged as “NO – AT RISK” are your immediate priority. Every one of those accounts is a single stolen password away from a breach.
For Google Workspace businesses, the process is simpler. Go to the Google Admin console, navigate to Security > Authentication > 2-Step Verification, and enforce it for your organization. Google Workspace lets you set a grace period for enrollment and sends automatic reminders to users who have not set it up yet.
The bottom line: MFA is the single highest-impact security control you can implement. It is free on nearly every platform. There is zero legitimate reason for any business account to not have it enabled in 2026.
Thing #2: Password Management
Here is the awkward conversation I have with small business owners at least twice a week: “Show me your password situation.” And then they show me a sticky note on their monitor, a shared Google Doc labeled “passwords” that three people have access to, or they tell me they use the same password across all their accounts because “it is a really good password.”
Eighty percent of hacking incidents involve compromised credentials. Not because hackers are cracking encryption algorithms — because people reuse passwords, choose weak ones, or store them where they can be found.
The fix is a password manager. I recommend Bitwarden for small businesses because it is open-source, independently audited, and the team plan costs $4 per user per month. Here is what a proper password management setup looks like:
Step 1: Set up Bitwarden for your team. Create a Bitwarden organization at bitwarden.com/pricing and select the Teams plan. Invite all employees. The admin dashboard shows you who has accepted their invite and who is still ignoring your emails.
Step 2: Import existing passwords. Every browser stores passwords. Have each employee export their browser passwords (Chrome: Settings > Passwords > Export) and import them into Bitwarden. Then delete the browser-stored versions. Having passwords in both places defeats the purpose.
Step 3: Enforce minimum password standards. In Bitwarden’s organization settings, set the master password policy to require at least 14 characters with uppercase, lowercase, numbers, and special characters. Yes, 14. The master password is the one password your employees still need to remember, and it protects everything else.
Step 4: Generate unique passwords for everything. Bitwarden’s password generator creates random 20+ character passwords for each account. Your employees never need to see or remember these passwords. Bitwarden auto-fills them. The result: every account has a unique, complex password, and nobody has to remember anything except their master password.
Step 5: Audit password health. Bitwarden’s Reports section shows you reused passwords, weak passwords, and passwords that have appeared in known data breaches. Run this audit monthly and require employees to fix any flagged items.
Here is a PowerShell script that audits your local Active Directory for common password policy issues:
<#
.SYNOPSIS
    Active Directory Password Policy Audit
.DESCRIPTION
    Checks AD password policy settings and identifies accounts
    with password-related security risks.
.NOTES
    Requires: ActiveDirectory PowerShell module
    Run on: Domain controller or machine with RSAT tools
    Version: 1.0 | PowerShell 5.1+</p>
<h1>></h1>
<p>Import-Module ActiveDirectory -ErrorAction Stop</p>
<p>Write-Host "<code>n===============================" -ForegroundColor Green
Write-Host "  AD Password Policy Audit" -ForegroundColor Green
Write-Host "===============================</code>n" -ForegroundColor Green</p>
<h1>Check domain password policy</h1>
<p>$policy = Get-ADDefaultDomainPasswordPolicy</p>
<p>Write-Host "DOMAIN PASSWORD POLICY:" -ForegroundColor Cyan
Write-Host "  Min Password Length:    $($policy.MinPasswordLength)" -ForegroundColor $(if ($policy.MinPasswordLength -ge 12) { 'Green' } else { 'Red' })
Write-Host "  Password History Count: $($policy.PasswordHistoryCount)" -ForegroundColor $(if ($policy.PasswordHistoryCount -ge 12) { 'Green' } else { 'Yellow' })
Write-Host "  Max Password Age:       $($policy.MaxPasswordAge.Days) days" -ForegroundColor $(if ($policy.MaxPasswordAge.Days -le 90 -and $policy.MaxPasswordAge.Days -gt 0) { 'Green' } else { 'Yellow' })
Write-Host "  Complexity Required:    $($policy.ComplexityEnabled)" -ForegroundColor $(if ($policy.ComplexityEnabled) { 'Green' } else { 'Red' })
Write-Host "  Lockout Threshold:      $($policy.LockoutThreshold)" -ForegroundColor $(if ($policy.LockoutThreshold -gt 0 -and $policy.LockoutThreshold -le 10) { 'Green' } else { 'Red' })
Write-Host ""</p>
<h1>Find risky accounts</h1>
<p>$allUsers = Get-ADUser -Filter {Enabled -eq $true} -Properties <code>PasswordLastSet, PasswordNeverExpires, PasswordNotRequired,</code>
    LastLogonDate, WhenCreated</p>
<p>$risks = @()</p>
<p>foreach ($user in $allUsers) {
    $issues = @()</p>
if ($user.PasswordNeverExpires) {
    $issues += "Password never expires"
}
if ($user.PasswordNotRequired) {
    $issues += "Password not required"
}
if ($user.PasswordLastSet -and $user.PasswordLastSet -lt (Get-Date).AddDays(-180)) {
    $daysSince = ((Get-Date) - $user.PasswordLastSet).Days
    $issues += "Password is $daysSince days old"
}
if (-not $user.PasswordLastSet) {
    $issues += "Password never set"
}
if ($user.LastLogonDate -and $user.LastLogonDate -lt (Get-Date).AddDays(-90)) {
    $issues += "Inactive for 90+ days (stale account)"
}

if ($issues.Count -gt 0) {
    $risks += [PSCustomObject]@{
        User     = $user.SamAccountName
        Name     = $user.Name
        Issues   = $issues -join "; "
        Priority = if ($issues -match "not required|never set") { "CRITICAL" }
                   elseif ($issues -match "never expires") { "HIGH" }
                   else { "MEDIUM" }
    }
}

<p>}</p>

<p>Write-Host "ACCOUNTS WITH PASSWORD RISKS:" -ForegroundColor Yellow

$risks | Sort-Object Priority | Format-Table -AutoSize -Wrap</p>

<p>Write-Host "`nSummary:" -ForegroundColor Cyan

Write-Host "  Total Active Users:     $($allUsers.Count)"

Write-Host "  Users with Risks:       $($risks.Count)" -ForegroundColor $(if ($risks.Count -gt 0) { 'Red' } else { 'Green' })

Write-Host "  Critical Issues:        $(($risks | Where-Object Priority -eq 'CRITICAL').Count)" -ForegroundColor Red

Write-Host "  High Issues:            $(($risks | Where-Object Priority -eq 'HIGH').Count)" -ForegroundColor Yellow</p>

<h1>Export</h1>

<p>$reportPath = ".AD-Password-Audit-$(Get-Date -Format 'yyyy-MM-dd').csv"

$risks | Export-Csv -Path $reportPath -NoTypeInformation

Write-Host "`nReport saved to: $reportPath" -ForegroundColor Greentext

Run this on your domain controller or any machine with the Active Directory PowerShell module installed. It checks your domain password policy against current best practices and then scans every active user account for password-related risks: passwords that never expire, accounts that do not require passwords (yes, this happens more than you think), ancient passwords, and stale accounts that nobody uses but nobody disabled.
The “CRITICAL” flagged accounts — the ones where a password is not required or has never been set — need to be fixed today. Not next week. Today.
Thing #3: Software Updates and Patching
I know. Updates are annoying. They pop up at the worst possible time, they restart your computer when you have fourteen unsaved documents open, and sometimes they break things. I get it.
But here is what unpatched software actually is: it is a published list of exactly how to break into your system. When Microsoft, Adobe, or any other vendor releases a security patch, they also publish a description of the vulnerability it fixes. Attackers read those descriptions, write exploit code for the vulnerability, and then go looking for systems that have not applied the patch yet. The window between “patch released” and “exploit in the wild” has shrunk to days, sometimes hours.
What to update and how often:
Operating systems: Enable automatic updates on every Windows, Mac, and Linux machine in your business. On Windows, go to Settings > Windows Update > Advanced Options and set everything to automatic. Yes, this means occasional restarts during off-hours. That is infinitely better than a ransomware attack during business hours.
Business applications: Your POS system, accounting software, CRM, and any other business-critical application should be on the latest supported version. Check vendor release notes monthly. If your POS vendor has not released a security update in over six months, ask them why.
Web browsers: Chrome, Firefox, and Edge all auto-update by default. Do not disable this. Do not override this. Do not let employees run browsers from 2024 because “the old version works fine.”
Firmware: Your router, firewall, POS terminal, and any network-connected device has firmware. Log into each device’s management interface quarterly and check for updates. This is the one most businesses skip entirely, and it is the one attackers love to exploit because they know you are not watching.
Plugins and extensions: WordPress plugins, browser extensions, POS add-ons — anything that extends another piece of software needs to be updated when patches are available. Outdated WordPress plugins are the number one way WordPress sites get compromised, and it is not even close.
Here is my practical recommendation: pick one day per month as “Patch Day.” Block off two hours. Update everything. Test that everything still works. Document what you updated. It is boring. It is repetitive. It saves businesses.
Thing #4: Secure Backups
When a ransomware attack hits — and I say “when” deliberately, not “if,” because 88% of breaches involving small businesses include ransomware — your backups determine whether it is a bad day or a business-ending event. According to the data, 64% of ransomware victims refused to pay the ransom. But that is only possible when reliable backups exist.
The backup rule to follow is 3-2-1: three copies of your data, on two different types of storage, with one copy offsite.
Copy 1: Your live data on your production systems. This is not a backup; this is what you are backing up from.
Copy 2: A local backup on a separate device — an external hard drive, a NAS (network-attached storage), or a dedicated backup server. This gives you fast recovery for everyday issues like accidental file deletion or hardware failure.
Copy 3: An offsite or cloud backup that is physically separate from your business location. This is your disaster recovery option. If your office floods, burns, or gets ransomwared, your offsite backup survives.
Critical backup rules:
Test your restores. A backup that has never been tested is not a backup. It is a hope. Once a month, pick a random file or folder from your backup and restore it. Verify the data is intact. If you cannot successfully restore, your backup system is broken and you just do not know it yet.
Keep backups offline or air-gapped. Ransomware specifically looks for connected backup drives and encrypts them too. Your backup drive should not be permanently connected to your network. Either disconnect it after each backup cycle or use a cloud backup solution with versioning that prevents ransomware from overwriting previous versions.
Retain multiple versions. If ransomware encrypts your files on Monday and your backup runs Tuesday night, your “backup” now contains encrypted files. Keep at least 30 days of backup history so you can restore from before the infection.
Back up configurations, not just data. Your server settings, firewall rules, application configurations — if these are not backed up, a recovery that should take hours takes days while you reconfigure everything from scratch.
Here is a straightforward PowerShell script for automated local backups with rotation:
<#
.SYNOPSIS
    Automated Business Backup Script with Rotation
.DESCRIPTION
    Backs up specified directories with date-stamped folders,
    maintains 30-day retention, and logs results.
.NOTES
    Schedule via Task Scheduler for daily execution.
    Version: 1.0 | PowerShell 5.1+</p>
<h1>></h1>
<h1>Configuration - EDIT THESE</h1>
<p>$sourcePaths = @(
    "C:BusinessData",
    "C:UsersSharedDocuments",
    "C:POSData"
)
$backupRoot    = "D:Backups"  # Use a separate drive
$retentionDays = 30
$logFile       = "$backupRootbackup-log.txt"</p>
<h1>Create dated backup folder</h1>
<p>$datestamp = Get-Date -Format "yyyy-MM-dd_HHmm"
$backupDir = Join-Path $backupRoot $datestamp</p>
<p>try {
    New-Item -Path $backupDir -ItemType Directory -Force | Out-Null</p>
$totalFiles = 0
$totalSize  = 0

foreach ($source in $sourcePaths) {
    if (Test-Path $source) {
        $destName = Split-Path $source -Leaf
        $dest     = Join-Path $backupDir $destName

        # Robocopy with logging: mirror mode, retry 2 times, wait 5 sec
        $robocopyArgs = @($source, $dest, "/MIR", "/R:2", "/W:5",
                         "/NP", "/NDL", "/NFL", "/LOG+:$logFile")
        & robocopy @robocopyArgs

        $copied = (Get-ChildItem $dest -Recurse -File -ErrorAction SilentlyContinue)
        $totalFiles += $copied.Count
        $totalSize  += ($copied | Measure-Object -Property Length -Sum).Sum
    } else {
        Add-Content $logFile "WARNING: Source path not found: $source"
    }
}

$sizeGB = [math]::Round($totalSize / 1GB, 2)
$summary = "$(Get-Date) | Backup complete: $totalFiles files, ${sizeGB}GB to $backupDir"
Add-Content $logFile $summary
Write-Host $summary -ForegroundColor Green

# Cleanup old backups beyond retention period
$cutoff = (Get-Date).AddDays(-$retentionDays)
$oldBackups = Get-ChildItem $backupRoot -Directory |
    Where-Object { $_.CreationTime -lt $cutoff -and $_.Name -match '^d{4}-d{2}-d{2}' }

foreach ($old in $oldBackups) {
    Remove-Item $old.FullName -Recurse -Force
    Add-Content $logFile "$(Get-Date) | Removed old backup: $($old.Name)"
}

Write-Host "Retention cleanup: removed $($oldBackups.Count) backup(s) older than $retentionDays days" -ForegroundColor Yellow

<p>} catch {

    $errorMsg = "$(Get-Date) | BACKUP FAILED: $($_.Exception.Message)"

    Add-Content $logFile $errorMsg

    Write-Host $errorMsg -ForegroundColor Red</p>
# Send alert email (configure SMTP settings)
# Send-MailMessage -To "[email protected]" -Subject "BACKUP FAILED" -Body $errorMsg -SmtpServer "smtp.yourprovider.com"

<p>}

<code>``text

Schedule this with Windows Task Scheduler to run nightly. Edit the **</code>$sourcePaths<code>** array to include your critical business directories. Set **</code>$backupRoot`** to a separate physical drive — not another partition on the same disk. The script creates date-stamped folders, copies everything using robocopy (which handles large files and network paths gracefully), and automatically removes backups older than 30 days.</p>

<p>This handles Copy 2 of your 3-2-1 strategy. For Copy 3, set up a cloud backup service like Backblaze B2 ($6/TB per month), Wasabi ($7/TB per month), or if you are already in the Microsoft ecosystem, Azure Blob Storage with immutable retention policies that prevent ransomware from deleting your cloud backups.</p>

<h2>Thing #5: Employee Security Awareness Training</h2>

<p>I have saved this for last because it is simultaneously the most important and the most neglected. You can have perfect technology — MFA everywhere, strong passwords, patched systems, tested backups — and one employee clicking one phishing link can bypass all of it.</p>

<p>Human error is not just a factor in breaches. It is the factor. Phishing is the initial vector in the majority of small business breaches because it works. Not because employees are stupid. Because phishing emails in 2026 are genuinely good. AI-generated phishing can mimic your CEO's writing style, reference real projects your company is working on, and create convincing urgency that makes even careful people click before they think.</p>

<p><strong>What effective security training looks like (and does not look like):</strong></p>

<p>It does not look like a once-a-year compliance video that everyone clicks through at 2x speed while eating lunch. That checks a box but changes zero behavior.</p>

<p>Effective training is short, frequent, and practical. Here is the framework I use with clients:</p>

<p><strong>Monthly micro-training (5-10 minutes).</strong> One specific topic per month. How to spot a phishing email. What to do if you accidentally click a suspicious link. How to verify a wire transfer request. Why you should not plug in a USB drive you found in the parking lot. Short, practical, real-world.</p>

<p><strong>Quarterly phishing simulations.</strong> Send simulated phishing emails to your team and track who clicks. This is not about punishing people — it is about identifying who needs more training and keeping everyone's radar calibrated. Our post on <a href="/blog/phishing-training-team-automate-free-n8n-workflow/">automating phishing training with n8n</a> shows you how to set this up for free.</p>

<p><strong>Immediate reporting culture.</strong> The single most important thing you can train into your team is this: "If you think you clicked something bad, tell someone immediately. You will not get in trouble." The damage from a phishing click that gets reported in five minutes is dramatically less than one that gets hidden for five days because the employee was afraid of getting fired.</p>

<p><strong>New hire onboarding.</strong> Every new employee gets security training during their first week. Not their first month. Their first week. Temporary and seasonal staff — extremely common in Daytona Beach's tourism-driven economy — get an abbreviated version covering the essentials before they touch any company system.</p>

<p><strong>Real consequences for real incidents.</strong> Not punishment, but process. If someone fails a phishing simulation, they get additional training. If the same person fails three simulations in a row, there is a conversation about whether they should have access to sensitive systems. Security is not optional.</p>

<h2>Putting It All Together: The Security Audit Script</h2>

<p>I have given you individual scripts for MFA checking, password auditing, and backup automation. Here is a comprehensive security audit script that checks all five areas and gives you a single report card:</p>

<p>powershell

<#

.SYNOPSIS

    Small Business Cybersecurity Audit – The 5 Essentials

.DESCRIPTION

    Quick audit script checking the 5 critical cybersecurity

    controls for small businesses. Run as Administrator.

.NOTES

    Version: 1.0 | PowerShell 5.1+ | Run as: Administrator
>
$audit = @()
Write-Host “n========================================" -ForegroundColor Cyan

Write-Host "  Small Business Security Audit" -ForegroundColor Cyan

Write-Host "  The 5 Things That Actually Matter" -ForegroundColor Cyan

Write-Host "========================================n” -ForegroundColor Cyan
— 1. MFA CHECK (local system) —
Write-Host “[1/5] Checking authentication configuration…” -ForegroundColor Yellow

$credential = Get-ItemProperty “HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem” -ErrorAction SilentlyContinue

$audit += [PSCustomObject]@{

    Category = “1. MFA/Authentication”

    Check    = “Windows Hello or biometric available”

    Status   = if (Get-WmiObject -Class Win32_PnPEntity | Where-Object { $_.Name -match “fingerprint|biometric|camera” }) { “AVAILABLE” } else { “NOT DETECTED” }

    Action   = “Enable MFA on all cloud accounts (M365, Google, banking)”

}
— 2. PASSWORD POLICY —
Write-Host “[2/5] Checking password policy…” -ForegroundColor Yellow

$netAccounts = net accounts 2>$null

$minLen = int -replace ‘D’, ”)

$lockout = int -replace ‘D’, ”)
$audit += [PSCustomObject]@{

    Category = “2. Password Management”

    Check    = “Minimum password length >= 12”

    Status   = if ($minLen -ge 12) { “PASS ($minLen)” } else { “FAIL ($minLen)” }

    Action   = “Set minimum to 12+ characters via Group Policy or net accounts”

}

$audit += [PSCustomObject]@{

    Category = “2. Password Management”

    Check    = “Account lockout configured”

    Status   = if ($lockout -gt 0 -and $lockout -le 10) { “PASS ($lockout attempts)” } else { “FAIL” }

    Action   = “Set lockout threshold to 5-10 attempts”

}
— 3. UPDATES AND PATCHING —
Write-Host “[3/5] Checking update status…” -ForegroundColor Yellow

$hotfixes = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1

$daysSinceUpdate = if ($hotfixes.InstalledOn) { ((Get-Date) – $hotfixes.InstalledOn).Days } else { 999 }
$audit += [PSCustomObject]@{

    Category = “3. Software Updates”

    Check    = “Last Windows update within 30 days”

    Status   = if ($daysSinceUpdate -le 30) { “PASS ($daysSinceUpdate days ago)” } else { “FAIL ($daysSinceUpdate days ago)” }

    Action   = “Enable automatic updates: Settings > Windows Update > Advanced”

}
$autoUpdate = (Get-ItemProperty “HKLM:SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto Update” -ErrorAction SilentlyContinue).AUOptions

$audit += [PSCustomObject]@{

    Category = “3. Software Updates”

    Check    = “Automatic updates enabled”

    Status   = if ($autoUpdate -ge 3) { “PASS” } else { “REVIEW – May not be automatic” }

    Action   = “Ensure Windows Update is set to automatic”

}
— 4. BACKUP VERIFICATION —
Write-Host “[4/5] Checking backup status…” -ForegroundColor Yellow

$shadowCopies = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue

$audit += [PSCustomObject]@{

    Category = “4. Backups”

    Check    = “Volume Shadow Copies exist”

    Status   = if ($shadowCopies) { “PASS ($($shadowCopies.Count) snapshots)” } else { “FAIL – No shadow copies found” }

    Action   = “Configure Windows Backup or third-party backup solution”

}
Check for common backup software
$backupSoftware = @(‘Veeam’, ‘Acronis’, ‘Carbonite’, ‘Backblaze’, ‘CrashPlan’)

$found = Get-WmiObject Win32_Product -ErrorAction SilentlyContinue |

    Where-Object { $backupSoftware | ForEach-Object { $ } | Where-Object { $using:.Name -match $_ } }

$audit += [PSCustomObject]@{

    Category = “4. Backups”

    Check    = “Backup software installed”

    Status   = if ($found) { “PASS ($($found.Name -join ‘, ‘))” } else { “REVIEW – No recognized backup software detected” }

    Action   = “Install and configure 3-2-1 backup strategy”

}
— 5. FIREWALL AND BASIC PROTECTION —
Write-Host “[5/5] Checking security software…” -ForegroundColor Yellow

$firewall = Get-NetFirewallProfile -ErrorAction SilentlyContinue

$fwDisabled = $firewall | Where-Object { -not $_.Enabled }
$audit += [PSCustomObject]@{

    Category = “5. Security Basics”

    Check    = “Windows Firewall enabled (all profiles)”

    Status   = if ($fwDisabled.Count -eq 0) { “PASS” } else { “FAIL – $($fwDisabled.Name -join ‘, ‘) disabled” }

    Action   = “Enable all firewall profiles immediately”

}
$avStatus = Get-MpComputerStatus -ErrorAction SilentlyContinue

$audit += [PSCustomObject]@{

    Category = “5. Security Basics”

    Check    = “Windows Defender real-time protection”

    Status   = if ($avStatus.RealTimeProtectionEnabled) { “PASS” } else { “FAIL” }

    Action   = “Enable real-time protection in Windows Security”

}

$audit += [PSCustomObject]@{

    Category = “5. Security Basics”

    Check    = “Antivirus definitions current (within 3 days)”

    Status   = if ($avStatus.AntivirusSignatureAge -le 3) { “PASS ($($avStatus.AntivirusSignatureAge) days old)” } else { “FAIL ($($avStatus.AntivirusSignatureAge) days old)” }

    Action   = “Update Windows Defender definitions”

}
— RESULTS —
Write-Host “n========================================" -ForegroundColor Green

Write-Host "  AUDIT RESULTS" -ForegroundColor Green

Write-Host "========================================n” -ForegroundColor Green
$passCount = ($audit | Where-Object { $.Status -match “^PASS” }).Count

$failCount = ($audit | Where-Object { $.Status -match “^FAIL” }).Count

$reviewCount = ($audit | Where-Object { $_.Status -match “^REVIEW|^NOT|^AVAILABLE” }).Count

$total = $audit.Count
Write-Host “PASS: $passCount / $total” -ForegroundColor Green

Write-Host “FAIL: $failCount / $total” -ForegroundColor $(if ($failCount -gt 0) { ‘Red’ } else { ‘Green’ })

Write-Host “REVIEW: $reviewCount / $total`n” -ForegroundColor Yellow
$audit | Format-Table Category, Check, Status, Action -AutoSize -Wrap
$reportPath = “.Security-Audit-$(Get-Date -Format ‘yyyy-MM-dd’).csv”

$audit | Export-Csv -Path $reportPath -NoTypeInformation

Write-Host “Report saved to: $reportPath” -ForegroundColor Green
Run this as Administrator on every workstation and server in your business. The output gives you a clear pass/fail on each of the five essential areas, along with specific action items for anything that fails. Export the CSV, fix the failures, run it again next month.

What You Can Skip (Seriously)

I want to be explicitly clear about what does not belong on a small business cybersecurity priority list in 2026. Not because these things are bad — but because they are a distraction when you have not nailed the five essentials.

You can skip the $50,000 SIEM. If you do not have MFA turned on, a security information and event management system is like buying a home theater system when your house does not have a roof.

You can skip penetration testing. A pen test will tell you that your passwords are weak and you are not patching. You already know that. Fix the basics first.

You can skip the zero-trust architecture redesign. Zero trust is a great framework for organizations with mature security programs. If you are still using sticky notes for passwords, zero trust is three steps ahead of where you need to be.

You can skip cyber insurance for now (but not forever). Cyber insurance is important, but many policies will not pay out if you lack basic controls. Get MFA, backups, and patching in place first — then the insurance policy you buy will actually cover you.

Focus on the five things. Get them right. Then layer on additional controls as your security maturity grows.

Your First 30-Day Action Plan

Do not try to do everything at once. Here is a realistic 30-day roadmap:

Week 1: Enable MFA on all email accounts and financial accounts. Run the MFA status script to identify any gaps.

Week 2: Deploy Bitwarden (or another password manager) to your team. Run the password audit script and fix critical findings.

Week 3: Enable automatic updates on all devices. Audit your POS, router, and firewall firmware versions. Apply any pending patches.

Week 4: Set up the automated backup script. Verify your first backup works by restoring a test file. Schedule the first employee security awareness micro-training.

After 30 days, you will have addressed the five controls that prevent the overwhelming majority of small business breaches. You will have documentation from the scripts you ran. And you will have a foundation to build on.

If you want help implementing any of this, our security services include hands-on deployment of all five controls. We also provide ongoing security management for businesses across Volusia County, including IT consulting in Port Orange and throughout the Daytona Beach metro area.

Ready to go deeper? Our security audit checklist gives you a comprehensive self-assessment framework that builds on the five essentials covered here.

Frequently Asked Questions

What is the most important cybersecurity measure for a small business?

Multi-factor authentication (MFA). It blocks over 99.9% of automated account compromise attacks according to Microsoft's research. Since 80% of hacking incidents involve compromised credentials, MFA is the single highest-impact control you can implement — and it is free on virtually every platform.

How much should a small business spend on cybersecurity?

Most small businesses should start by maximizing free and low-cost controls: MFA (free), Windows Defender (free with Windows), automatic updates (free), password manager ($4-6/user/month), and cloud backups ($6-7/TB/month). A solid baseline costs under $200/month for a 10-person business. Add professional security management ($500-2,000/month) once the basics are in place.

What are the most common cyber threats to small businesses in 2026?

Phishing (initial vector in the majority of SMB breaches), ransomware (present in 88% of SMB breaches per the 2025 Verizon DBIR), credential theft (80% of hacking incidents), and unpatched software exploits. These four categories account for the vast majority of successful attacks against small businesses.

Do I need a dedicated IT security person for my small business?

Not necessarily. A business with fewer than 50 employees can manage the five essential controls internally with 2-4 hours per month of dedicated effort. Above 50 employees or if you handle sensitive data (healthcare, financial, legal), consider a managed security service provider (MSSP) or a part-time virtual CISO.

How do I know if my business has already been breached?

Warning signs include: unexpected password reset emails, unfamiliar accounts in your admin panels, abnormally slow network performance, employees reporting suspicious emails "from" colleagues, unknown software installed on workstations, and unusual outbound network traffic. Run the audit script in this article to check for basic indicators. For a comprehensive assessment, a professional penetration test or security assessment is recommended.

Is cyber insurance worth it for a small business?

Yes, but only after you have basic controls in place. Most cyber insurance policies have exclusions for businesses that lack MFA, regular backups, or basic security hygiene. Implement the five essentials first, then purchase a policy. Typical premiums for small businesses range from $1,000 to $3,000 annually for $1M in coverage.

These five things are not the only things that matter. But they are the five things that matter most. Get them right, and you have blocked the vast majority of attacks that take down small businesses. Everything else is a bonus.


Automate & Deploy works with insurance agencies in Volusia County
If this sounds familiar, we offer a free discovery call to map your workflow and identify the fastest wins. Most offices find 2–3 fixable bottlenecks in the first conversation.

    See our solutions

      ·  

    Learn about M365 & Workspace Security

      ·  

    Request a free security review for your agency