It's budget season, which means someone is about to try to sell you security software. Here's the order I'd spend in, and the honest note that most of the top of the list is free.
The Big Story: the order that actually matters
Free, and do these first. If any of these aren't done, nothing you buy will matter more than finishing them.
Multi-factor authentication turned on and enforced for everyone, not merely available. Use an authenticator app or a passkey rather than text-message codes.
Individual logins instead of shared ones, everywhere the platform allows it.
Automatic updates on, and machines that actually get restarted.
A written offboarding checklist, so nobody's access outlives their employment.
Email authentication records on your domain, so criminals can't send mail that looks like it's from you.
Cheap, and worth it for most. Roughly the cost of a couple of coffees per person per month:
A password manager for the whole company, with a shared vault for the credentials that genuinely have to be shared.
Backups that are actually tested. Untested backups are a feeling, not a control.
Real money, and only after the above. Managed detection on your computers — software that watches for intrusion with actual humans responding, day and night. This is the first line item where you're buying expertise rather than configuration. It's worth it, and it's worth it second.
Skip, at your size. Data loss prevention suites, security awareness platforms with quarterly phishing campaigns, anything sold as "enterprise-grade" to a company of twenty people, and any tool whose pitch starts with a statistic about how often businesses get attacked. If a vendor leads with fear and follows with a multi-year contract, you've learned what you need to know.
We'd Tell You If You Needed Us
Here's the uncomfortable math: a business that does the entire free list and buys nothing is meaningfully safer than a business that buys a stack of tools and never enforced MFA.
So if your budget conversation this year ends with "we're going to finish the basics and spend nothing," that's not a failure. That's the correct answer for a lot of companies, and you'll have earned it.
Call someone when you want the basics done properly and documented, when you want someone watching outside business hours, or when a client starts asking for proof. Not because it's November and the budget has to go somewhere.
See you in two weeks.
— Kfir ObsidianRidge.io
Forwarded this? Subscribe here — practical security for small businesses, every other Tuesday.