Seventy-three percent of small business owners say they have a plan in place to respond to a cyberattack. Only 52% reported technical network security protocols, such as firewalls and VPNs. Both figures come from the same national survey of small business owners, and side by side they describe the real problem: the paperwork is more common than the plumbing.
A response plan tells you what to do after someone gets in. Firewalls, patching and password rules decide whether they get in at all. If your business has the first and not the second, you’re better prepared to document a breach than to avoid one.
Does having a cyberattack plan mean you’re protected?
No. A response plan is a recovery tool, not a preventive control. It shortens the time between discovery and containment, which matters. But it does nothing to stop the initial intrusion. Prevention lives in the boring layer: patched systems, a maintained firewall, enforced password rules and multifactor authentication on the accounts that matter.
That doesn’t make the plan worthless. Businesses that have rehearsed who calls whom, who talks to customers and who pulls the network cable recover faster and spend less. The plan is genuinely useful. It’s just the wrong thing to finish first, because writing it changes nothing about your odds of needing it.
There’s also a quieter reason plans outnumber firewalls. A plan is free. Somebody can draft one in an afternoon, save it to a shared drive, and tick the box on an insurance questionnaire. Buying, configuring and maintaining edge hardware costs money and takes ongoing attention. So the cheap artifact gets done and the expensive habit gets postponed. If you’re writing yours now, it’s worth knowing what belongs in an incident response plan before you file it away.
What small businesses actually have in place
The survey asked owners which safeguards they use. The pattern is consistent: the further a control sits from paperwork and the closer it sits to infrastructure, the fewer businesses have it.
| Safeguard reported | Share of owners |
|---|---|
| A plan to respond to a cyberattack. | 73%. |
| Regular software updates. | 59%. |
| Required use of strong passwords. | 59%. |
| Network security protocols, such as firewalls and VPNs. | 52%. |
Read the bottom row again. Nearly half of these businesses are running without the layer that decides what can reach them from the open internet. Meanwhile 87% believe a cyberattack could have severe financial consequences for them, and 84% think it would damage customer relationships. The fear is nearly universal. The controls are not.
One more number is worth holding onto: about 15% said they had experienced a cyberattack in the past three years. That gap between 87% who expect severe damage and 15% who have been hit is where budgets go to die. The damage feels catastrophic but distant, so it never quite becomes this quarter’s problem.
Why is malware the top worry when it isn’t usually the way in?
Nearly three in four owners named malware as their greatest concern. Malware is real, but it’s usually the last step rather than the first. Most intrusions start with a working login or an exposed remote service. The attacker signs in, looks around, and only then deploys anything that would trip an alarm.
That ordering matters because it changes what you buy. Antivirus answers the thing owners picture. It does not answer the credential someone bought or guessed, and stolen logins often go unnoticed for days before anyone spots the pattern.
Federal assessors run into the same thing. In one published assessment, a government team could not phish its way into the organization at all — and still took over the network by exploiting misconfigurations and weak passwords once it looked internally. The email defenses held. The plumbing didn’t.
Close the gap before you polish the plan
None of the fixes below require a new budget line the size of a salary. They require someone to own them.
Start with whatever faces the internet
Find out what your firewall is, whether it’s still under a support contract, and whether it’s receiving updates. Plenty of small offices are running an appliance the last provider installed and nobody has logged into since. If no one at your business can answer those three questions today, that’s the finding — you don’t need an assessment to tell you it’s a gap. This is the part most businesses hand off, and having someone owning the security side day to day is usually cheaper than the first incident it prevents.
Make updates somebody’s actual job
Fifty-nine percent said they do regular software updates. In practice, “regular” often means whenever a laptop nags loudly enough. Patching works when it’s scheduled, tracked and reported on, and when someone notices the machine that keeps failing. We keep patch management and remote monitoring running as standing services for exactly that reason — it’s not the kind of work that survives being a good intention.
Put MFA on the accounts that would hurt
Email, banking, payroll, remote access, and whatever holds customer records. You don’t have to boil the ocean. Start with the handful of accounts that would ruin a month if someone else controlled them. It’s worth checking the setup rather than assuming, because some MFA configurations still leave a usable way in.
Frequently Asked Questions
How much does cybersecurity cost for a small business?
It depends far more on how many people and systems you have than on any package name. The useful way to budget is to separate one-time cleanup from the ongoing monthly cost of keeping things patched, monitored and backed up. Ask any provider to quote those two things separately so you can see what you’re actually committing to.
What is the easiest cybersecurity solution for small businesses?
Multifactor authentication on email. It’s usually free with the mail plan you already pay for, it takes an afternoon, and it blocks the single most common way small businesses lose control of an account. Nothing else gives you that much protection for that little money or effort.
Can small businesses get managed cybersecurity without an internal IT team?
Yes, and most do. The work gets handled by an outside provider who owns patching, monitoring, backups and the firewall, and who reports on them. The thing to confirm is that someone is accountable for those specific tasks by name, rather than assuming they’re bundled into general support.
How do we know if our firewall is doing anything?
Ask three questions: what model is it, is its support contract current, and when did it last receive a firmware update. A firewall past end-of-support stops getting fixes for newly found flaws, so it keeps sitting there looking like protection while quietly becoming an entry point.
Does cyber insurance replace these controls?
No. Insurance covers some of the cost after an incident, and most policies now ask whether you have MFA, backups and patching before they’ll quote a competitive rate. Answering those questions inaccurately can complicate a claim later, so the controls tend to come first either way.
How often should we review any of this?
Once a year as a baseline, plus any time you change providers, move offices, or add a system that touches customer data. Staff turnover is the one people forget. Accounts belonging to someone who left months ago are a common finding, and they’re straightforward to clean up.
Find out where your business actually stands
You can guess at which of those four safeguards you’d have reported on that survey, or you can check. We work with businesses across the Treasure Coast and South Florida, from Port St. Lucie and Stuart to West Palm Beach and Fort Lauderdale, plus Tampa, Orlando, Naples and Fort Myers.
You can book a security risk assessment as a standalone engagement — you don’t have to change providers to find out what’s missing. You get a straight answer about what’s installed, what’s expired and what’s quietly unowned.