The small-business cybersecurity checklist for 2026

You don't need an enterprise budget to be a hard target. A handful of well-implemented basics stop the overwhelming majority of attacks aimed at small businesses.

The essential controls

• Multi-factor authentication (MFA) on email and every critical app.
• EDR (modern antivirus) on every computer.
• Automatic patching for Windows, macOS, and third-party apps.
• Tested backups, immutable, off-site, and restored on a schedule.
• Email filtering to catch phishing before it lands.
• Least-privilege access, people only get what they need.
• Security awareness training with simulated phishing.
• A written incident plan so a bad day isn't chaos.

Where most breaches start

Almost every small-business breach traces back to a stolen password or a clicked link. MFA and training alone close most of that gap. They're the highest-return investments you can make.

Start here

If you only do three things this quarter: turn on MFA everywhere, confirm your backups actually restore, and run one phishing test with your team.

Frequently asked questions

What cybersecurity basics does a small business need in 2026?

Eight controls stop the overwhelming majority of attacks: multi-factor authentication on email and critical apps, EDR on every computer, automatic patching, tested backups, email filtering, least-privilege access, security awareness training, and a written incident plan. None of them require an enterprise budget. Well-implemented basics make you a hard target.

Where should I start if I cannot do everything at once?

Do three things this quarter: turn on MFA everywhere, confirm your backups restore, and run one phishing test with your team. Stolen passwords and clicked links sit behind most small-business breaches. Those three steps close most of that gap at low cost.

Is MFA enough on its own?

MFA closes the biggest single gap, since most small-business breaches start with a stolen password or a clicked link. It is one layer of several. Pair it with EDR, automatic patching, email filtering, security training, and tested backups so an attacker who gets past one control runs into another.

Do I need EDR if I already have antivirus?

EDR is the modern replacement for traditional antivirus. It watches for attacker behavior on each computer rather than matching known virus signatures, so it catches threats that older tools miss. Every computer in the business needs it, including laptops that travel.

How much does managed cybersecurity cost for a small business?

37 Forge prices per device. Essentials is $37 per device per month plus $49 per month for network monitoring, with support billed hourly: $60 remote, $150 for the first on-site hour, then $100 per hour after that. Secure, the most popular plan, is $135 per device per month and includes Microsoft 365 Business Standard. Businesses with HIPAA, PCI, or SEC compliance requirements get a custom quote on the Guardian plan.