Learning how to protect business networks from cyber attacks starts with an uncomfortable fact: most breaches do not involve clever hackers writing custom code.
They involve a stolen password, an unpatched server, or an employee clicking a link that looked exactly like an invoice from a supplier. The attacks that actually work are ordinary, and so are the defenses that stop them.
This guide covers the layers that matter, ranked roughly by how much protection they deliver per dollar and hour spent.
The Threat Picture Right Now
Small and midsize companies get targeted precisely because they hold valuable data without enterprise security budgets.
IBM's Cost of a Data Breach Report 2024 put the global average breach cost at $4.88 million, the highest figure the study has recorded, with the United States average sitting far above that.
The Verizon Data Breach Investigations Report has consistently found that the human element plays a role in the majority of breaches, through stolen credentials, phishing, and simple mistakes.
Ransomware remains the loudest threat, but credential theft causes more incidents. Attackers rarely break in anymore. They log in.
Layer 1: Fix Identity Before Anything Else
Passwords are the front door, and most organizations leave it unlocked.
Turn on multi-factor authentication everywhere. Email, VPN, cloud admin consoles, banking, remote desktop, and any tool holding customer data. MFA blocks the overwhelming majority of automated credential attacks.
Not all MFA is equal:
| Method | Strength | Notes |
|---|---|---|
| SMS codes | Weakest | Vulnerable to SIM swapping, still better than nothing |
| Authenticator apps | Good | TOTP codes work offline |
| Push notifications | Good | Add number matching to stop fatigue attacks |
| Hardware keys (FIDO2) | Strongest | Resists phishing entirely |
| Passkeys | Strongest | Phishing-resistant and easier for staff |
Kill shared accounts. When five people use one login, nobody owns the actions taken with it.
Apply least privilege. Give each person access to what their job needs and nothing more. Review access whenever someone changes roles, and remove it the day they leave.
Deploy a password manager across the company. Staff reuses passwords because remembering 40 unique ones is impossible, not because they are careless.
Layer 2: Patch Fast and Know What You Own
You cannot protect assets you have not counted. Most companies underestimate their attack surface by a wide margin, forgetting old test servers, forgotten subdomains, and the printer with a web interface exposed to the internet.
Build an asset inventory covering servers, workstations, mobile devices, network gear, cloud instances, SaaS applications, and anything with an IP address.
Then scan it continuously. Vulnerability scanning finds missing patches, weak configurations, exposed services, and default credentials before an attacker does. Tenable runs in this category, covering network scanning, cloud posture, web application testing, and external attack surface discovery from one console.
Licensing usually depends on asset count and which modules you need, so review the Tenable pricing plans against your actual device numbers rather than guessing.
Companies buying their first scanning license can trim the cost with a Tenable coupon code at checkout, which helps when security budget approval depends on hitting a specific number.
Set patch targets by severity:
- Actively exploited vulnerabilities: patch within 24 to 72 hours
- Critical-rated flaws: within two weeks
- High severity: within 30 days
- Everything else: on your regular cycle
CISA maintains a Known Exploited Vulnerabilities Catalog listing flaws attackers are using right now. Treat that list as your priority queue.
Layer 3: Segment the Network
Flat networks turn one compromised laptop into a company-wide incident. Segmentation contains the damage.
Separate these zones:
- Guest Wi-Fi, fully isolated from internal systems
- Employee workstations
- Servers and databases
- Payment systems, kept separate for PCI DSS reasons
- Building systems like cameras, HVAC, and door controllers
- Backup infrastructure, isolated from everything
Between zones, use firewall rules that deny by default and allow only the traffic each system genuinely needs.
Retire flat trust. A device inside the office should not automatically get more access than one connecting from a coffee shop. That principle sits at the center of zero trust architecture, described in NIST Special Publication 800-207.
Layer 4: Secure the Endpoints
Every laptop and phone is a doorway.
- Install EDR, not just antivirus. Endpoint detection and response tools spot behavior patterns rather than only matching known malware signatures.
- Encrypt every disk with BitLocker or FileVault so a stolen laptop stays useless.
- Enforce automatic OS updates through device management rather than trusting people to click reboot.
- Block USB storage or restrict it to encrypted approved devices.
- Require screen locks after a short idle period.
- Manage mobile devices with the ability to wipe company data remotely.
Layer 5: Harden Email and Web Traffic
Email delivers most attacks, so filtering earns its keep.
Configure email authentication. Publish SPF, DKIM, and DMARC records for your domain. Set DMARC to reject once you have verified legitimate senders. This stops criminals spoofing your domain to bill your customers.
Add a filtering gateway that scans attachments in a sandbox and rewrites links so they get checked at click time, not just on delivery.
Flag external mail with a banner so staff notices when a message claiming to come from the CEO actually arrived from outside.
Filter DNS through a service that blocks known malicious domains before a connection completes.
Layer 6: Back Up in a Way Ransomware Cannot Touch
Backups are what turn a catastrophe into an expensive Tuesday.
Follow the 3-2-1-1-0 rule:
- 3 copies of your data
- 2 different storage types
- 1 copy stored offsite
- 1 copy immutable or air-gapped
- 0 errors, verified by testing restores
Immutability matters most. Modern ransomware crews specifically hunt backup systems before triggering encryption. A backup they can delete is not a backup.
Test restores quarterly. An untested backup is a theory. Restore a real file, a real database, and a real server, and time how long it takes.
Layer 7: Train People Without Boring Them
Security awareness training gets mocked because most of it deserves mocking. Annual slideshows change nothing.
What works better:
- Short monthly sessions of five to ten minutes
- Simulated phishing with immediate coaching instead of punishment
- Real examples from your own industry
- A clear, blame-free way to report suspicious messages
- Specific training on payment fraud for finance staff, since business email compromise targets them directly
Make reporting a win. Someone who forwards a suspicious email and turns out to be wrong should get thanked, not teased.
Layer 8: Plan for the Incident You Will Eventually Have
Prevention fails sometimes. Preparation decides how badly.
Your incident response plan should name:
- Who leads the response and who can authorize shutting systems down
- Contact details for your insurer, legal counsel, and forensic provider
- Notification obligations and deadlines under applicable law
- Steps for isolating affected systems without destroying evidence
- Communication templates for staff, customers, and regulators
- Recovery order, showing which systems come back first
Print it. A response plan stored only on the network you just lost helps nobody.
Run a tabletop exercise annually. Walk the team through a ransomware scenario for 90 minutes and watch the gaps appear.
A Realistic Starting Sequence
| Priority | Action | Time to deploy |
|---|---|---|
| 1 | MFA on email, VPN, and admin accounts | Days |
| 2 | Verified offline and immutable backups | One to two weeks |
| 3 | Asset inventory and vulnerability scanning | Two to four weeks |
| 4 | Patch schedule with severity targets | Ongoing |
| 5 | EDR on every endpoint | Two weeks |
| 6 | Email authentication and filtering | One week |
| 7 | Network segmentation | One to three months |
| 8 | Awareness training program | Ongoing monthly |
| 9 | Incident response plan and tabletop | One month |
Work top to bottom. The first three stop the attacks that actually happen to businesses your size.
Frequently Asked Questions
How much should a small business spend on security?
Common guidance places security somewhere between 6% and 15% of the IT budget, though the honest answer depends on what data you hold and what a week of downtime would cost you.
Is cyber insurance worth buying?
Yes for most businesses, though insurers now require MFA, tested backups, and EDR before issuing a policy. Getting insurable and getting secure have become the same project.
Do we need a full-time security person?
Under roughly 100 employees, a managed security provider usually delivers better coverage per dollar than a single hire who cannot monitor around the clock.
How often should we scan for vulnerabilities?
Continuously for internet-facing assets, and at least weekly internally. Monthly scanning leaves too wide a window when exploits appear within days of disclosure.