Small business data security comes down to ten habits. Know what data and devices you have. Turn on multi-factor authentication. Use long passphrases and a password manager. Patch fast. Back up with an offline copy and test it. Encrypt laptops and phones. Train people to spot phishing. Limit who can see what. Write a one-page plan for the day something goes wrong. And wipe or destroy old equipment before it leaves your hands. None of it takes a big budget. It takes someone who owns it.
Why Small Businesses Get Targeted
There’s a persistent idea that attackers only chase big companies. The data says otherwise.
In Verizon’s 2026 Data Breach Investigations Report, ransomware showed up in 48% of all breaches, up from 44% the year before. Keepnet’s breakdown of that report adds that 96% of ransomware victims with a known size were small or midsize businesses. One caution on that number: Secureframe’s roundup notes that Verizon counts any organization with fewer than 1,000 employees as an SMB, which is broader than most people’s idea of “small.” Verizon’s 2025 SMB snapshot found ransomware in 88% of SMB breaches, compared with 39% at large organizations.
Why do attackers like small targets? They’re not smarter targets. They’re easier ones. Fewer people, thinner budgets, and nobody whose full-time job is security. Keepnet’s breakdown also shows that exploiting unpatched software is now the most common way breaches begin, at 31%. And Verizon’s 2026 report found the human element, meaning mistakes, phishing, and stolen credentials, in 62% of breaches.
The cost side is harder to size for a small firm. According to Baker Donelson’s summary of IBM’s 2026 Cost of a Data Breach Report, the global average reached a record $4.99 million, and $11.5 million in the United States. Those averages skew toward larger organizations, so don’t treat them as your number. But for a business with ten or fifty employees, even a fraction of that can be the end of the road.
What You’re Actually Up Against
The old version of this post listed eight threats, including SQL injection and denial-of-service attacks. Those exist, but they’re not what usually hurts a small business. Here’s the shorter, more realistic list:
- Ransomware. Attackers lock your files and demand payment. The scariest part isn’t the ransom. It’s the days of downtime.
- Phishing and fake-boss emails. A message that looks like it’s from the owner, a vendor, or the bank. Imagine a bookkeeper getting a convincing “urgent wire” request while the owner is traveling.
- Stolen or reused passwords. One breached account on an unrelated site can unlock your email.
- Unpatched software. Especially anything facing the internet, like firewalls, VPNs, and websites.
- Lost or stolen devices. A laptop left in a car is a data breach waiting to happen.
- Mistakes and insiders. Most are honest errors, such as sending a file to the wrong person.
- Vendors. Your accountant, your IT contractor, and your payroll tool all hold your data too.
- Old equipment. The retired laptop in the closet that still has everything on it.
If you run a website or customer portal, keep the platform and its plugins updated. Old plugins are still a common way in.
Ten Steps That Matter
1. Know What You Have
You can’t protect what you haven’t counted. List your devices, your accounts, and the data you hold: customer records, payroll, financials, contracts. Note where each one lives. It doesn’t need software. A spreadsheet and an afternoon will do. Our guide to IT asset management shows what to track.
2. Turn on Multi-Factor Authentication
If you do only one thing from this list, do this one. Turn on MFA for email first, then banking, then admin accounts and anything remote. Use an authenticator app or a hardware key where you can, and treat text-message codes as better than nothing but not great.
3. Use a Password Manager and Long Passphrases
Here’s where the old advice has aged badly. The original post said to change passwords regularly. NIST’s current digital identity guidelines say the opposite: systems shall not require periodic password changes, and passwords used alone should be at least 15 characters. Forced resets push people toward predictable patterns.
Our view: retire the 90-day reset. Give everyone a password manager, ask for long passphrases, and change a password when you have a reason to, such as a breach or a departing employee.
4. Patch Fast
Updates are boring and they matter. Turn on automatic updates for laptops and phones. Put a named person in charge of servers, routers, and firewalls, because those are the devices attackers love. And replace equipment that no longer gets security updates. Our guide to replacing networking gear explains how to track support dates.
5. Back Up, Then Test It
A good rule is 3-2-1: three copies, on two kinds of media, with one kept offline or off-site. The offline copy is the one ransomware can’t reach. And a backup you’ve never restored is a guess. Pick a file every quarter and restore it, just to confirm it works.
6. Encrypt Laptops, Phones, and Drives
Turn on built-in disk encryption, such as BitLocker on Windows and FileVault on Mac. If a device walks out the door, encryption is the difference between an annoying loss and a reportable breach. It also makes retirement safer later, because cryptographic erase becomes an option.
7. Train People, Briefly and Often
Since Verizon’s 2026 report found the human element in 62% of breaches, training isn’t a nice extra. Skip the annual two-hour slideshow. Do short, frequent lessons: how to spot a fake invoice, why you verify wire requests by phone, and what to do when someone clicks something they shouldn’t. Make reporting easy and blame-free. People who fear punishment hide mistakes.
8. Limit Who Can See What
Give people access to what their job needs and nothing more. Remove accounts the day someone leaves, and collect their devices. Most small businesses I’d call “secure on paper” fall down here, because offboarding is informal.
9. Vet Your Vendors and Write a One-Page Incident Plan
Ask any vendor that touches your data how they protect it, and what happens if they’re breached. Third parties show up in a large share of breaches. Secureframe’s roundup of Verizon’s 2026 data puts third-party involvement at 48%, though figures vary by how it’s counted.
Then write down the plan before you need it. One page is enough:
- Who makes the call, and who’s the backup
- Who to phone: your IT contact, your insurer, your lawyer
- How to isolate an affected computer
- How you’ll tell customers and employees
10. Retire Old Equipment Safely
This is the step most guides skip, and it’s the one we know best. Retired laptops, servers, and drives still hold data, and a delete or a factory reset doesn’t reliably remove it.
The research is blunt. i-SIGMA’s press release on NAID’s 2017 study reports that NAID examined more than 250 devices bought through public resale channels and found personally identifiable information on 40% of them, using only basic recovery methods. WeLiveSecurity reported on a 2019 University of Hertfordshire study, commissioned by Comparitech, that bought 200 used hard drives and found that 59% still held data from previous owners. And Fortune covered a 2016 study by Blancco, a data erasure vendor, that recovered data from 78% of 200 used drives. Some of those groups sell or promote erasure, so weigh that, but they all point the same way.
Here’s what to do instead:
- Inventory every device by serial number.
- Wipe or destroy the data following NIST SP 800-88 Revision 2, published September 26, 2025.
- Keep proof. Ask for a Certificate of Data Destruction with serial numbers.
- Sell or recycle through a provider you can verify.
Our guides on secure IT equipment disposal, hard drive disposal, and what happens when you dispose of an IT asset walk through each option. For a policy you can copy, see our ITAD best practices for small and medium-sized businesses.
A 30-Day Plan
Week 1: See and lock. Inventory your devices and accounts. Turn on MFA for email and banking.
Week 2: Protect. Set up a password manager, turn on updates, and fix your backups. Restore one file to prove they work.
Week 3: People. Run your first short training session, and clean up access. Remove old accounts.
Week 4: Plan. Write your one-page incident plan, and set up a process for retiring old equipment. Start with the closet.
What We Do
We help with the end of the equipment lifecycle:
- Data security. We follow NIST SP 800-88 practices through our Phoenix Certified process. Our partner DES Technologies handles chain of custody and certified destruction.
- Value recovery. We buy laptops, servers, storage and drives, and networking equipment.
- Simple logistics. Send us your list, get a quote, and we cover secure shipping.
Frequently Asked Questions
Where should a small business start with data security?
Start by knowing what you have: devices, accounts, and data. Then turn on multi-factor authentication for email and banking. Those two steps cover a lot of ground.
Do small businesses really get attacked?
Yes. According to Keepnet’s breakdown of Verizon’s 2026 report, 96% of ransomware victims with a known size were small or midsize businesses, though Verizon defines that as any organization with fewer than 1,000 employees.
Is antivirus enough?
No. Antivirus helps, but most breaches start with phishing, stolen credentials, or unpatched software. You also need MFA, updates, backups, and trained people.
How often should we change passwords?
Not on a schedule. NIST’s current guidance says systems shouldn’t require periodic password changes. Use long passphrases and a password manager, and change a password when there’s a reason, such as a breach.
What should we do with old computers and drives?
Don’t toss them or hand them off as-is. Wipe or destroy the data following NIST SP 800-88 Revision 2, keep a Certificate of Data Destruction, and check whether the equipment has resale value before you recycle it.
What should we do if we think we’ve been breached?
Isolate the affected device, preserve evidence, and call your IT contact, your insurer, and your lawyer. Follow your incident plan. If you don’t have one yet, write it this week.
Ready to Clear Out the Closet?
Get a free quote and find out what your retired equipment is worth, and how we’ll protect your data. Our FAQ covers the process. And for more on securing your network, read How Data Security Can Be Applied to the Network System and our guide to network security protection.
