If you can make one change today, require phishing-resistant multi-factor authentication on administrator, email, finance and remote-access accounts. Then patch internet-facing systems in the same week and build tested, isolated backups in parallel. The order matters, but these are not three annual projects. Together they reduce account takeover, close exposed technical entry points and preserve a route to recovery.
Click to load the YouTube player. Watch on YouTube ↗
- 01MFA is normally the fastest low-cost action, especially for email and privileged access.
- 02Verizon's 2026 SMB analysis puts vulnerability exploitation at 26% of known initial access, ahead of credential abuse at 13% and phishing at 9%.
- 03Ransomware appeared in 48% of all breaches in the 2026 DBIR, so recovery cannot be postponed.
- 04Only 26% of critical CISA KEV vulnerabilities in the report's dataset were fully remediated during 2025.
- 05CIS IG1 provides 56 essential cyber-hygiene safeguards once the most urgent gaps are under control.
Why “do everything” is not an answer
Security frameworks describe the destination, not always the first Monday morning. The CIS Critical Security Controls contain 56 safeguards in Implementation Group 1 alone. Those safeguards are designed as essential cyber hygiene, but a small business without dedicated security staff cannot give all of them equal attention at the same time.
The useful question is therefore narrower: which action produces the most immediate reduction in common risk, using technology the organisation probably already owns? The answer has to consider attacker behaviour, cost, deployment time and what happens when prevention fails.
MFA first today. Internet-facing patching in the same week. Tested, isolated backups running in parallel. Inventory, training and response planning follow.
What the newest breach data actually says
The 2026 Verizon Data Breach Investigations Report analysed more than 22,000 confirmed breaches. Across the full dataset, exploitation of vulnerabilities became the most common known initial-access vector at 31%, while credential abuse fell to 13%. Ransomware grew to 48% of breaches.
The focused small and medium-sized business analysis reports 7,152 confirmed breaches. Its known initial-access breakdown is vulnerability exploitation at 26%, credential abuse at 13% and phishing at 9%. Third-party involvement appeared in 55% of SMB breaches, and the human element in 45%. These figures correct a common mistake: the report does not say compromised credentials caused 38% of SMB breaches or that SMBs represented 96% of ransomware victims.
Why MFA still gets the first move
Vulnerability exploitation now leads the statistics, so why place MFA first? Because “first” here means the quickest broadly applicable action, not the only priority. CISA recommends requiring MFA across email, file storage and remote access, beginning with administrators and people handling sensitive information. Many small businesses can enable it with services they already pay for.
Choose the strongest method available. Passkeys and hardware security keys resist fake sign-in pages because the authentication exchange is bound to the legitimate service. Authenticator apps remain useful where passkeys are unavailable. SMS is better than a password alone, but it is a weaker fallback. The full trade-off is explained in Passkeys vs Authenticator Apps in 2026.
A policy email is not enforcement. Review every privileged account, new starter, departed employee, service account and recovery method. One forgotten administrator login can undermine a rollout that appears complete on a dashboard.
Why patching cannot wait for next quarter
The 2026 DBIR's strongest technical signal is the rise of vulnerability exploitation. The report says only 26% of critical vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalogue were fully remediated in 2025, while the median time to full resolution rose to 43 days.
Turn on supported automatic updates for browsers, operating systems and ordinary applications. For internet-facing routers, VPN gateways, firewalls and remote-access tools, use a faster risk-based process: track vendor notices, compare exposures against CISA KEV and patch or isolate urgently. Automatic updating is helpful, but it is not a complete process for appliances that require manual intervention.
When every vulnerability cannot be fixed immediately, prioritise active exploitation, internet exposure, privileged access and business impact. Network segmentation can limit the blast radius while a permanent fix is prepared.
Backups run in parallel, not third
Backups do not stop initial access, so ranking them after MFA and patching can sound logical. That interpretation is dangerous. Prevention lowers the chance of a breach. Recovery controls decide whether the business can resume operations after one occurs.
Keep at least one protected copy that ordinary production credentials cannot alter. Use offline media, immutability or a separately controlled backup service. Encrypt sensitive backups, monitor job failures and test a real restore. A green “backup completed” message proves that data was copied; it does not prove the business can recover the right systems within an acceptable time.
Choose one critical system, restore it into a safe environment and record the time, dependencies and missing steps. That exercise turns a comforting assumption into evidence.
A realistic first 90 days
- 01Days 1 to 7: close the obvious doorsEnforce strong MFA for email, administrators, finance and remote access. Patch exposed systems and confirm automatic updates are working.
- 02Days 8 to 30: make recovery realIdentify critical data, protect at least one backup copy from production access and complete a documented restore test.
- 03Days 31 to 60: inventory and separateList devices, software, accounts and owners. Separate guest and IoT devices, user endpoints, servers and backups where practical.
- 04Days 61 to 90: train and rehearseRun short social-engineering training and write a one-page incident plan with contacts, decisions and restoration priorities.
Training should show staff how attacks arrive across email, texts, calls and QR codes. Use the four-channel phishing guide as the briefing, then let staff practise in the arcade.
What not to buy first
Do not make a large security-platform purchase the opening move while basic account and recovery gaps remain. EDR, managed detection, next-generation firewalls and compliance automation can all add value, but they solve different parts of the problem. A premium detection tool observing an unprotected administrator account is watching the wrong door.
Buying a product can also hide process gaps. Someone still has to review alerts, own patch deadlines, test restores and accept residual risk. For the governance side of that work, see what a GRC analyst actually does.
Where CIS IG1 fits after the first week
CIS describes Implementation Group 1 as the starting point and minimum standard of information security for every enterprise. Its 56 safeguards cover asset management, data protection, secure configuration, account management, access control, vulnerability management, logging, recovery and other foundational practices.
Use IG1 as a managed programme rather than a shopping list. Assign an owner, record whether each safeguard is implemented and collect evidence. The goal is repeatable operation, not 56 boxes ticked once. If the business handles more sensitive data, faces targeted threats or operates complex systems, move beyond IG1 based on risk and relevant regulation.
Practise choosing controls in the right order
These games make trade-offs visible by showing which attack paths remain after every decision.
PRIMARY PRACTICE
NETWORK DEFENCE
IDENTITY DEFENCEQuestions people ask
What is the first cybersecurity control a small business should implement?+
Require phishing-resistant multi-factor authentication on administrator, email, finance and remote-access accounts. It is usually quick and inexpensive. Treat it as the first move in a first-week package that also patches exposed systems and verifies backups.
How much do MFA and automatic patching cost?+
Often little beyond the subscriptions and devices a business already uses. The larger cost is the time needed to enrol users, remove exceptions, test recovery and confirm updates are actually reaching every system.
Should antivirus or EDR come before MFA?+
Endpoint protection is useful, but it should not replace stronger account protection, rapid patching or recoverable backups. A sophisticated endpoint tool cannot compensate for an exposed administrator account or an unpatched internet-facing appliance.
Does the priority change for regulated businesses?+
The first controls remain valuable, but healthcare, finance and other regulated organisations need a risk assessment and sector-specific requirements alongside the baseline. They will normally move beyond CIS IG1 sooner.
What if the business can complete only one task this week?+
Enforce phishing-resistant MFA on email and privileged accounts, including recovery methods. Then schedule patching and a real backup restore test immediately rather than treating MFA as a completed security programme.