Cybersecurity for SMEs: Where to Start When You Can't Do Everything
Every small IT team has a security list it will never finish. New tools, new policies, new audits, and the same two or three people to do all of it. The honest question is not "how do we secure everything?" It is "what do we do first?"
Verizon's 2025 Data Breach Investigations Report answers that better than any vendor checklist, because it is built from 12,195 confirmed breaches rather than opinion. One finding should set the tone: ransomware was part of 88% of breaches at small and mid-sized businesses, against 39% at larger organizations (Verizon 2025 DBIR, SMB Snapshot). Smaller companies are not being ignored. They are being hit harder.
The figures below are from the same report. Apart from that ransomware comparison, they cover organizations of all sizes.
1. Start with logins
Stolen credentials are still the most common way attackers get in. That makes access the cheapest place to reduce risk.
- Turn on multi-factor authentication for email, finance systems, remote access and admin accounts.
- Remove accounts for people who have left.
- Check who has admin rights and whether they still need them.
The report also found that 46% of compromised devices holding corporate logins were not managed by the company. If staff sign in to work systems from personal laptops, that belongs on this list too.
2. Patch what faces the internet
Exploited vulnerabilities were the way in for 20% of breaches, up 34% on the previous year. Edge devices and VPNs made up 22% of those targets, up from 3%. Only about 54% of those flaws were fully fixed during the year, and the median fix took 32 days.
You do not need to patch everything this week. You do need to know which devices face the internet, and patch those first.
3. Test a restore, not just a backup
Ransomware works when a company cannot recover without paying. The report notes that 64% of victims did not pay, and those are the companies that had another way back.
Having backups is not the test. Restoring from one is. Pick a system that matters, restore it, and time it. If that has never been done, it is your most useful afternoon this quarter.
4. Make reporting easy for your people
People were involved in around 60% of breaches. Annual training slides do little about that. Two habits do more:
- A simple way to report a suspicious email, with no blame attached.
- A rule that any change to payment details is confirmed by phone.
5. Review vendor access
Third parties were involved in 30% of breaches, double the year before. List every supplier that can reach your systems or holds your data. Remove access that is no longer needed, and ask the rest how they protect it.
What can wait
Advanced monitoring platforms, threat hunting and full certification programs all have value. They deliver far less if the five basics above are open. Sequence matters more than spend.
If you handle regulated data
Healthcare providers and their suppliers carry extra obligations under rules such as HIPAA. The order above still applies, but access controls and audit trails move from good practice to requirement. We cover the operational side on our healthcare page.
How TekGenio Helps
We work through the same order this post describes, starting with what is most exposed.
- Logins: identity and access management, including MFA and access reviews.
- Internet-facing systems: vulnerability scanning, prioritized fixes and penetration testing.
- People: email and phishing protection, plus security awareness training.
- Recovery: incident response and digital forensics if something does go wrong.
For healthcare teams and other regulated businesses, access controls and audit trails are part of the setup from the start. See our healthcare page. Not sure which of the five to tackle first?