Small Business Cybersecurity: 6 Steps to Reduce Risk

If your business computers stopped working tomorrow, could you still serve customers, access records, and pay employees? A cyberattack can interrupt all three. Small business cybersecurity starts with practical questions about your everyday systems.

Who installs security updates? Who responds to suspicious activity after hours? And when did someone last prove your backups actually work?

In a Travelers Institute podcast, cyber specialists John Menefee and Fayon Atkinson discussed ways businesses can strengthen their defenses. Here is how to turn those lessons into a manageable action plan.

1. Prove Your Backups Can Restore Your Business

A successful backup notification is reassuring. A successful restoration test gives you evidence that you can recover.

Start with the 3-2-1 backup strategy:

Three copies of important data: your working copy and two backups.
Two different storage media types.
One copy stored off-site.

For ransomware protection, also maintain an offline or properly configured immutable backup. Immutable storage prevents changes or deletion during its protected retention period. Off-site storage alone does not provide that protection.

Ask Your IT Provider These Questions

When was the last restoration test?
How much recent work could we lose?
How long would restoring our critical systems take?

Set backup frequency around those answers. A backup from three months ago may leave you without months of customer records, invoices, or project work.

2. Patch Urgent Vulnerabilities Quickly

Security patches fix weaknesses attackers can exploit. Knowing an update exists is only the beginning; someone must install it and verify that it worked.

The Travelers discussion highlights 72 hours as a ceiling for patching critical, internet-facing vulnerabilities being actively exploited. Some situations require faster action. Treat this as a risk-based target, rather than a universal deadline for every update.

Ask your IT provider:

Do we have a complete inventory of devices and software?
Which urgent patches are overdue?
How do we confirm updates were installed successfully?
Who handles emergency updates outside normal business hours?

Track overdue critical patches as a business issue. A written patching policy helps only when the work gets done.

3. Make Sure Someone Responds to Security Alerts

A security alert arriving at 2 a.m. needs an owner. Otherwise, an attacker may have hours to continue before anyone notices.

These terms describe different capabilities:

Protection	What it provides
Antivirus	Detects malicious software, with capabilities varying by product.
Endpoint detection and response (EDR)	Monitors device activity and provides tools to investigate and respond.
Managed detection and response (MDR)	Adds a managed service that investigates threats and supports or performs response.

When evaluating MDR, confirm whether monitoring runs 24/7, which systems are covered, and whether the provider can isolate compromised devices. Ask who approves urgent containment actions and how your business will be contacted.

4. Strengthen Account Security

Multi-factor authentication (MFA) adds protection beyond a password, but the method matters.

FIDO-based passkeys and security keys can provide phishing-resistant authentication. Standard text-message codes, authenticator app codes, and ordinary push approvals can still be phished or manipulated.

Prioritize email, remote access, administrator accounts, and financial systems. Have your IT provider check which stronger methods your software supports.

Train employees to report unexpected authentication prompts. A request to approve a login they did not start deserves immediate attention.

5. Set Clear Rules for Employee AI Use

An employee may paste a client contract into an AI tool simply to save time. Without clear rules, that convenience can create a data-handling problem.

Start with a short AI acceptable use policy that explains:

Approved tools: Which tools and account types the company approves.
Permitted information: Which information employees may enter.
Sensitive information: Which sensitive information requires approval or must stay out.
Review responsibilities: Who reviews AI-generated work before it reaches customers.
Reporting procedures: How employees should report an accidental disclosure.

Review each tool’s data retention, training, privacy, and access settings. These vary by provider, product, and account configuration.

“Shadow IT” means technology employees use without the company’s approval or oversight. Make the approved route clear and practical so employees can follow it.

6. Connect Your Cybersecurity Plan With Your Insurance

Cyber insurance can help address covered costs after an incident. Your broker can also help you understand available insurer resources and questions to raise with your IT provider.

Ask about risk consultations, security assessments, vulnerability alerts, and incident response support. Availability depends on the insurer and policy.

Security controls may influence underwriting, pricing, and terms. They do not guarantee a discount or coverage for a particular event.

Keep your insurer’s incident reporting instructions accessible outside your company network. If a suspicious message appears to come from your insurer, verify it through a known contact before opening links.

Start With One Conversation This Week

Schedule a short meeting with your IT provider. Ask for:

The date and results of your last backup restoration test.
A list of overdue critical patches.
Confirmation of who responds to alerts overnight.

Then review account protection and employee AI rules. Assign an owner and a completion date to each gap.

Contact us to review your cyber insurance and discuss the risk management resources available through your policy. A clear recovery plan and reliable security habits give your business a stronger foundation.