The average cost of a small business breach is $140,000.[1] Most of that damage traces back to one of three failures: a system that wasn't patched, an asset nobody knew was exposed, or a backup that turned out not to be isolated. None of these required sophisticated attackers. None required a budget to prevent.
Three practices address all three. They cost nothing to implement. Once in place, they take about two hours per quarter to maintain.
1. Automate Your Patches
Unpatched systems are the entry point in 32% of ransomware incidents.[2] The reason is rarely negligence — it's that manual patching requires someone to remember, and in most small businesses, no one person owns that responsibility.
CVE-2025-33073 is a recent example. This actively exploited Windows vulnerability lets an attacker gain SYSTEM-level privileges over any unpatched host on the network. Microsoft released a fix in June 2025; CISA added it to its Known Exploited Vulnerabilities catalog shortly after. Businesses with automatic updates enabled closed this gap before it became a problem. Those waiting for their IT contractor to get to it did not.
Action: Enable automatic updates on every device and server. Set one rule in writing: critical CVEs get patched within 15 days.
2. Document Your Systems
You cannot secure what you do not know you have. Subdomains, vendor integrations, staging servers, forgotten VPN endpoints — these accumulate silently over years of normal business activity. Any of them can be an entry point.
Documentation doesn't mean a technical specification. It means: what systems does this business run, who has access to each one, and what does each connect to? A single page, updated whenever something changes, is enough. The goal is that any person at your company — not just the original developer — can answer those questions in under 30 minutes.
Action: Produce a list of your internet-facing systems. If it takes more than 30 minutes, that gap is the risk.
3. Review Quarterly
KISA's H1 2025 report found that 44.4% of Korean ransomware victims had their backups also encrypted.[3] In almost every case, the backups were network-accessible — reachable by the same ransomware that had already compromised the primary systems. Nobody had checked.
A quarterly review is not an audit. It is one hour asking: did we add any new systems or vendors this quarter? Is anything connected that shouldn't be? Does the backup restore when tested?
Action: Block one hour per quarter. Walk through the last 90 days of changes and ask whether any of them opened an exposure.
Discipline beats spending
These three practices cost nothing and take a few hours per year once established. The gap between a secure business and an exposed one is rarely budget. It is almost always one of these three disciplines, skipped.
Which of these three practices doesn't yet exist in your company?
References
- NinjaOne — 7 SMB Cybersecurity Statistics for 2026
- Upfort — SMB Vulnerability & Exposure Report 2025
- KISA — 2025 상반기 사이버 위협 동향 보고서
Instagram