For a small or medium business in 2026, basic cybersecurity comes down to a short list that blocks the attacks that actually happen: enforce phishing-resistant MFA everywhere, keep immutable backups, run EDR on every endpoint, and patch the handful of vulnerabilities that are genuinely being exploited rather than the thousands that are not. Most SMB guides bury you in a 50-item checklist. The data says the opposite is what works: a few controls stop the overwhelming majority of real incidents.

The reason to be selective is that attackers are, too. According to Verizon's Data Breach Investigations Report, the large majority of breaches involve the human element, with stolen credentials and phishing the number-one entry point, not exotic zero-days. And on the patching side, fewer than 4% of the vulnerabilities published to the National Vulnerability Database are ever exploited in the wild, and over 90% of confirmed in-the-wild exploitation shows up in CISA's Known Exploited Vulnerabilities catalog. So the winning SMB strategy is narrow and evidence-led, not broad and box-ticking.

What is the minimum cybersecurity an SMB actually needs?

Start with the controls that map to how SMBs actually get breached, which is also, not coincidentally, what cyber-insurance underwriters now require before they will write a policy:

If we can only do one thing, what should it be?

Phishing-resistant multi-factor authentication. Because credential theft is the most common path in, MFA is the single control with the highest return, and its absence is now the fastest way to be denied a cyber-insurance payout. If you extend to a second, make it immutable backups, since they turn a ransomware catastrophe into a bad afternoon.

How should an SMB prioritize patching without a security team?

Do not try to fix everything your scanner flags. Filter by evidence: patch anything in the CISA KEV catalog that you run, then anything with a high EPSS probability, and let the rest wait. This is how a lean team eliminates the large majority of real exploitable risk while touching only a fraction of the backlog. See our explainers on what is EPSS and what is CISA KEV for how to read the scores.

Our read

The trap for SMBs is confusing a full checklist with actual protection. A control you have configured but never tested against a real bypass is a hope, not a defense, and IBM's Cost of a Data Breach research puts the average breach for organizations under 500 employees in the millions, with credential-based breaches taking the longest to contain. The verifiable-by-design move is to run the short list of high-impact controls, then prove they hold by testing them the way an attacker would, prioritized by what exploitation data says actually matters.

Statistics per Verizon DBIR, IBM, CISA and FIRST.org. Sources linked above.

Related: what CVSS misses and do you need a penetration test.