Cybersecurity Services for Small Business: A Guide for Regulated SMBs

The real threat landscape, the 7-control baseline stack, cyber insurance requirements, and incident response — a plain-English security guide for regulated SMBs.

By Scott McAuley · Aug 3, 2026 · 12 min read

There's a sentence we hear in almost every first meeting with a small business, and it's the most dangerous sentence in cybersecurity: *"We're too small for anyone to bother with."*

Here's what that sentence gets wrong. Attackers don't pick you — software does. The overwhelming majority of attacks on small businesses are automated: scanners sweeping the internet for unpatched systems, credential lists tried against every login page, phishing emails sent by the million. Your business isn't a target because someone in a hoodie chose you; it's a target because you have an IP address, employees with inboxes, and money in a bank account.

And if you're a *regulated* small business — a medical or dental practice, a law firm, a financial or insurance office, a company in an energy supply chain — you're carrying a second burden: the breach isn't just an IT disaster, it's a compliance event with notification duties, regulators, and liability attached.

This guide is the full picture for owners and managers, in plain English: what the threat landscape actually looks like, the baseline security stack every SMB needs, what your cyber insurer now requires, how to plan for the bad day, and how compliance overlays change the math.

The Threat Landscape, Without the Hype

Strip away the vendor fear-marketing and small-business incidents cluster into a handful of patterns:

| Threat | How it actually happens | Typical damage |

|---|---|---|

| Phishing / credential theft | An email that looks like Microsoft, your bank, or your boss harvests a password | Mailbox takeover, launching pad for everything below |

| Business email compromise (BEC) | Attacker lurks in a real mailbox, then alters payment instructions on a genuine invoice | Five- to six-figure wire fraud, often unrecoverable |

| Ransomware | Entry via phished credentials or unpatched remote access; data encrypted *and* stolen | Days-to-weeks of downtime plus extortion over the stolen copy |

| Vendor/supply-chain compromise | Your software vendor or IT tool is breached; you inherit it | Depends — from nuisance to full network access |

| Insider/departure risk | Ex-employee accounts left active, data walking out the door | Data loss, compliance exposure, occasionally sabotage |

Two things are worth noticing. First, almost every row starts with a human being and an inbox — most studies attribute somewhere around two-thirds to three-quarters of breaches to a human element (stolen credentials, phishing, error), which is why the training section below isn't optional filler. Second, none of these require you to be interesting. They require you to be reachable.

For the local, current-year specifics — which of these patterns we're actually seeing hit Houston companies, and how they've evolved — see our field report on [cybersecurity threats facing Houston small businesses](/resources/cybersecurity-threats-houston-small-businesses-2026).

The Baseline Stack: What Every SMB Needs

Security vendors will happily sell you forty products. The honest truth is that a disciplined baseline stops the large majority of real-world SMB attacks, and it fits in a table:

| Layer | What it is | Why it's non-negotiable |

|---|---|---|

| MFA everywhere | A second factor on email, VPN, banking, and admin accounts | Single highest-value control; defeats most stolen-password attacks outright |

| EDR on every device | Endpoint detection & response — modern behavior-based protection, not 2010 antivirus | Catches and isolates ransomware behavior instead of matching yesterday's signatures |

| Tested backups (3-2-1) | Multiple copies, separate media, one off-site/immutable — with scheduled restore tests | Your ransomware leverage and your hurricane plan in one; untested backups are hopes |

| Patching discipline | Automated updates for OS and applications, tracked and verified | Closes the doors automated scanners look for |

| Email filtering | Advanced filtering + malicious-link protection in front of every inbox | Thins the phishing flood before humans have to judge it |

| Access hygiene | Unique accounts, least privilege, same-day offboarding, a password manager | Kills the shared-login and ghost-account problems that turn small breaches into big ones |

| Security awareness training | Short, ongoing, with simulated phishing | The human layer, addressed like the control it is |

If your business has all seven working, you're ahead of most of the market. If you're missing MFA or tested backups, stop reading and fix those first — everything else in this guide is secondary. The implementation details of each layer are what our [cybersecurity services](/services/cybersecurity) team does daily, usually as part of a broader [managed IT relationship](/services/managed-it-support) so the tools are actually watched, not just installed.

One honest caveat: the baseline is necessary, not sufficient. It won't stop a determined, targeted attacker. But SMBs almost never face determined, targeted attackers — they face automation, and the baseline defeats automation.

Ransomware: The One That Ends Businesses

Ransomware deserves its own section because it's the incident that turns "IT problem" into "existential problem." The modern version is double extortion: your data is encrypted *and* exfiltrated, so even a perfect backup restore leaves the criminal holding a copy and threatening to publish it — which, for a regulated business, converts the attack into a reportable breach regardless of how fast you recover.

What actually determines whether a ransomware event is a bad week or a business-ender:

1. Whether backups survive. Attackers hunt backups first. Off-site, offline, or immutable copies — backups the attacker's stolen admin credentials *cannot* reach — are the difference between restoring and negotiating. Our [backup and disaster recovery](/services/backup-disaster-recovery) builds are designed around exactly this assumption.

2. How fast it's detected. EDR that isolates one infected machine at 2 a.m. beats discovering forty encrypted machines at 8 a.m.

3. Whether you have a plan. Companies with a rehearsed incident response plan (next section) recover in a fraction of the time.

4. Downtime tolerance. Recovery takes days even when it goes well. Whether your business survives days offline is a number you should know *now* — we walk through the math in [the real cost of IT downtime for Houston small businesses](/resources/real-cost-it-downtime-houston-small-businesses), and for most companies it's uncomfortably larger than expected once lost revenue, idle payroll, and recovery costs stack up.

Should you ever pay the ransom? That's a decision made with your insurer, counsel, and incident responders — never alone, and never quickly. The better move is making the question moot with backups they can't touch.

Phishing and the Human Layer

You cannot patch people, but you can train them — and the data consistently shows trained organizations click far less. What works is not an annual hour of compliance video. What works:

Fold training into onboarding, run it continuously, and keep the records — your insurer (next section) and your regulators both ask.

What Cyber Insurance Now Requires

Five years ago, cyber insurance applications asked if you had antivirus. Today's applications are technical audits, and the market has hardened: carriers routinely decline coverage, surcharge premiums, or — worst — deny claims when the application's answers turn out to have been aspirational.

The controls most carriers now expect from SMBs:

| Commonly required control | Typical carrier stance |

|---|---|

| MFA on email, remote access, and admin accounts | Hard requirement — applications are declined without it |

| EDR / managed detection | Increasingly required, especially for regulated industries |

| Tested, segregated backups | Required; some ask for immutability and test cadence |

| Patching program | Attested on the application |

| Security awareness training | Attested; records requested at claim time |

| Incident response plan | Increasingly requested |

| End-of-life systems eliminated | Unsupported Windows versions can void eligibility |

The trap to respect: the application is a legal document. Checking "yes, we have MFA everywhere" when the bookkeeper's remote login doesn't have it is how claims get denied after the incident, which is the worst possible time to discover the gap. Before renewal season, have someone technical verify every answer — we cover the current carrier landscape and how to prepare in [cyber insurance requirements for Houston businesses](/resources/cybersecurity-insurance-requirements-houston-businesses), and pre-renewal verification is a standing service of our [compliance support](/services/compliance-support) practice.

Silver lining: everything insurers demand is in the baseline stack above. Build the baseline once and you've simultaneously satisfied your carrier, most regulator expectations, and reality.

Incident Response: Deciding Before the Bad Day

An incident response plan is a short document that answers, in advance, the questions that are agonizing to answer at 6 a.m. mid-crisis:

1. Who's in charge? One named incident lead with authority to disconnect systems and spend money, plus a deputy.

2. Who gets called, in what order? IT provider, insurer's breach hotline (calling them early matters — many policies require it before other spending), attorney, and — for regulated businesses — whoever owns the notification-deadline clock.

3. What gets isolated first? Contain, don't investigate. Disconnect, preserve evidence, resist the urge to wipe and reinstall (you may destroy forensic evidence your insurer and regulator need).

4. How do you operate while down? Paper workflows, phone triage, customer communication — the same emergency-mode thinking as hurricane planning, which Houston businesses already know how to do.

5. Who says what? One voice for staff, customers, and — if it comes to it — press. Improvised breach communication reliably makes everything worse.

Write it, print it (it may need to survive your systems being down), and tabletop it once a year: gather the leadership team, walk through "it's Monday 7 a.m. and nothing opens," and note where the plan creaks. Two hours a year, and it routinely cuts real recovery time dramatically.

The Compliance Overlays: When Security Is Also the Law

For regulated SMBs, the baseline isn't just prudent — chunks of it are legally mandated, with documentation duties on top:

The through-line: regulators and insurers converged on essentially the same list. A regulated SMB that builds the baseline *with documentation* — policies, training records, test results, an incident plan — satisfies all of them at once. The documentation is not busywork; in every framework above, an undocumented control legally barely exists.

Do You Need a Formal Framework? (NIST and CIS, Briefly)

Somewhere in your reading you'll encounter the frameworks — NIST Cybersecurity Framework, CIS Controls, maybe SOC 2 — and wonder whether your 25-person business needs one. The honest answer for most SMBs: you don't need to *adopt* a framework, but you benefit from *borrowing* one.

Frameworks are essentially the baseline stack from this guide, organized, numbered, and extended — CIS even publishes implementation tiers that explicitly scale down to small organizations. Where they earn their keep for an SMB is in three situations: when a large customer sends a security questionnaire and answering "we follow CIS Controls Implementation Group 1" beats improvising; when your industry overlay (HIPAA, FTC Safeguards) asks for a risk-assessment methodology and referencing an established one saves reinventing it; and when you want a neutral yardstick for measuring your IT provider's work instead of taking their word for it.

What you should *not* do is let framework vocabulary stall action. A business debating which framework to adopt while running without MFA has the priorities exactly backwards. Build the baseline first; borrow the framework language when paperwork demands it. A good provider — ours included, via [IT strategy consulting](/services/it-strategy-consulting) — will map one to the other for you in an afternoon.

Don't Forget the New Stuff: Securing AI and Automation

A fast-growing blind spot: businesses adopting AI tools — chat assistants, AI phone agents, workflow automation — without extending security governance to them. These tools are genuinely valuable (we implement them ourselves through our [AI and automation](/services/ai-automation) practice), but each one is a new place your data lives and a new credential to protect. Before adopting any AI tool, ask: what data does it see, where is that stored, who can access the account, and does it need to be in our risk assessment and vendor list? For a clear-eyed look at what these systems handle and how the data flows work in practice, our sister company Talos Automation's guide to [AI voice agents for business](https://talosautomation.ai/guides/ai-voice-agents-for-business) is the reference we point clients to — it treats data handling as a first-class topic rather than fine print. Treat AI vendors like any other vendor holding your data: vet, document, and offboard deliberately.

Where to Start (a 90-Day Order of Operations)

If this guide reads like a long to-do list, here's the sequence that gives the most protection per dollar, fastest:

1. Weeks 1–2: MFA on email, remote access, and financial accounts. Verify backups exist, are isolated, and actually restore.

2. Weeks 3–6: EDR deployed everywhere; email filtering upgraded; ghost accounts and shared logins eliminated.

3. Weeks 7–10: Patching automated and verified; security awareness training launched; money-movement verification ritual instituted.

4. Weeks 11–13: Incident response plan written and tabletopped; insurance application answers verified against reality; compliance documentation gathered.

That's a defensible security program in one quarter, and none of it requires enterprise budgets — it requires follow-through, which is exactly what a managed security relationship is for.

Texas Management Group has been building and running these programs for Houston-area SMBs — especially regulated ones — since 2014. If you'd like an honest assessment of where your business stands against this guide, [contact us](/contact): we'll benchmark you against the baseline, flag anything your insurer or regulator would, and give you the findings in writing whether you hire us or not.

*Scott McAuley is the founder and CEO of Texas Management Group, and founder of Talos Automation and Talk Is Cheap — 25+ years running IT, communications, and automation for Texas businesses.*

Frequently Asked Questions

What cybersecurity does a small business actually need?

A baseline of seven controls: MFA everywhere, EDR on every device, tested 3-2-1 backups, disciplined patching, advanced email filtering, access hygiene (unique accounts, least privilege, fast offboarding), and ongoing security awareness training. This baseline stops the large majority of real-world SMB attacks, which are overwhelmingly automated rather than targeted.

Are small businesses really targets for hackers?

Yes — but not personally. Most attacks are automated: scanners hunting unpatched systems and mass phishing campaigns. Small businesses get hit because they're reachable and typically less defended, not because anyone chose them. Regulated SMBs carry extra exposure because a breach also triggers notification duties and regulatory liability.

What does cyber insurance require from a small business?

Most carriers now require MFA on email, remote access, and admin accounts as a hard minimum, and increasingly expect EDR, tested segregated backups, patching, security training, and an incident response plan. Answers on the application are binding — inaccurate "yes" answers are a common reason claims get denied after an incident.

What should we do first with a limited budget?

MFA and backup verification, in that order, in the first two weeks. MFA defeats most stolen-credential attacks outright, and isolated, restore-tested backups are your survival guarantee against ransomware. Both are cheap; both are the first things insurers and attackers check.

How often should employees get security training?

Continuously, not annually — short monthly modules plus simulated phishing outperform yearly marathon sessions. Pair training with a no-blame reporting culture and a strict voice-verification rule for any change to payment or payroll instructions.

Does ransomware still work if we have backups?

Partially. Modern ransomware is double extortion: data is stolen before it's encrypted, so backups solve the downtime but not the threatened publication of your data — which for regulated businesses is a reportable breach either way. That's why prevention (MFA, EDR, patching) and detection speed matter alongside recovery.

What extra cybersecurity rules apply to regulated industries?

Healthcare falls under HIPAA's Security Rule; financial businesses (including small advisory, mortgage, and dealership operations) fall under the FTC Safeguards Rule; law firms carry ABA-grounded confidentiality duties; energy-sector vendors face flowed-down contractual requirements. All converge on roughly the same control set — with mandatory documentation on top.