Why is identity the most important SMB security control in 2026?
The old way to think about cybersecurity for a small company was a perimeter: a firewall, a VPN, and “internal” things were safe because they were inside. That model died around the time everyone started using SaaS, and it died completely when the workforce went remote. Today the perimeter is identity. If somebody can sign in as one of your people, they are inside everything that person can reach. That is the entire threat model in one sentence.
The good news is that identity hardening is concrete, well-documented, and does not require a security operations centre. The starting point is multi-factor authentication, but the version that matters in 2026 is phishing-resistant MFA. SMS codes get phished. Push approvals get fatigue-bombed. A hardware security key or a passkey, both following the FIDO2 standard, do not. CISA’s guidance on phishing-resistant MFA is the cleanest write-up of why and how.
The second move is a real password manager, deployed and enforced through the company. Not “we recommend one”. Not “use what you have”. One company-owned password manager, with a billing record, a recovery process, and a written rule that any account credential that is reused or stored anywhere else is now a security incident. The economics are simple: a password manager costs a few dollars per user per month; one credential-reuse breach costs an order of magnitude more.
The third move is single sign-on for as many SaaS apps as your team uses. SSO with role-based access centralises the on-boarding and off-boarding flow that small teams almost always get wrong. The day someone leaves and three apps still let them log in for two weeks is the day a routine event becomes a breach. Most B2B SaaS supports SAML or OIDC; even smaller vendors have started shipping SSO under SCIM by 2026 because their enterprise customers stopped accepting the alternative.
share of breaches involving the human element (stolen credentials, phishing, errors), per Verizon DBIR 2025.
of automated account takeover attempts blocked when phishing-resistant MFA is enforced, per Microsoft’s 2024 identity report.
typical lag between an employee departure and full SaaS off-boarding on a team without SSO and SCIM. Long enough to matter.
How can a small company actually stop phishing in 2026?
Every annual breach report says the same thing in slightly different words. Most incidents start with an email. The vector is so well documented that hardening against it is not a research project; it is a checklist that has been stable for years and that small companies still skip.
The first technical control is DMARC enforcement. Without it, attackers can send mail from your domain, and recipient mailboxes will silently let it through if your DNS does not say otherwise. Set up SPF, DKIM, and a DMARC policy that starts in p=quarantine for two weeks and then moves to p=reject. The dmarc.org overview is the best technical primer; the operational side is making sure every legitimate sender (your CRM, your transactional email provider, your support tool) is in your SPF record before you go to reject.
The second is brand impersonation monitoring. Modern phishing rarely spoofs your own domain anymore; it spoofs a lookalike (typo-squatted, homoglyph, or IDN-confusable). Set up a quarterly check on registrations that resemble your domain, and put your brand on at least one monitoring service. The cheapest version is a saved alert in your DNS registrar; the better version is a managed feed.
The third is training, but the version that works. Generic “do not click suspicious links” videos do not move incident rates. Realistic, scenario-based simulations, run quarterly, against the actual templates attackers use against your industry, do. Treat the failures as a coaching moment, not a discipline event. The metric to watch is repeat-clicker rate; if it does not fall over four quarters, the program is theatre.
share of breaches where phishing was the initial action, per Verizon DBIR 2025. Email is still where most incidents start.
drop in unauthenticated emails (≈265 billion fewer) reaching Gmail users after Google and Yahoo enforced DMARC for bulk senders in early 2024, per the Google Gmail Security blog.
average loss per business email compromise / funds-transfer fraud claim, per the Coalition 2024 Cyber Claims Report. BEC and FTF together drove 56% of all 2023 claims.
Generative AI changed the economics of targeted phishing. Spear-phishing emails are now well-written, free of spelling mistakes, and personalised at scale. The old “look for grammar errors” advice is dead. We covered the broader business impact in our note on generative AI in business; the security translation is that detection has shifted from content (the email looks wrong) to behaviour (the request itself is unusual). Train people to verify unusual requests through a second channel, every time, no exceptions.
Which endpoint security control should small companies fix first?
Endpoints (laptops, phones, contractor machines) are the second-most-common vector after email. The fashion in security marketing is endpoint detection and response, expensive software that watches for malicious behaviour. EDR is useful, but it is not the first move on a small team. The first move is patch hygiene.
share of breaches in 2024 that began with the exploitation of a vulnerability — a 34% year-on-year jump, per Verizon DBIR 2025.
median time organisations took to fully patch known-exploited vulnerabilities (DBIR 2025). For SMBs without an MDM-enforced auto-update policy, the lag is typically longer.
share of edge-device CISA KEV-catalogue vulnerabilities that remained fully unpatched through the DBIR 2025 survey window. Auto-update windows close this gap before EDR ever has to.
-
Auto-update windows on every device
OS updates inside seven days of release. Browser updates inside three. Productivity apps and security tools inside fourteen. Set a policy, configure it through your MDM, and audit compliance monthly. Most successful endpoint exploits use vulnerabilities that have been patched for more than a month.
-
Mobile device management for everyone
A small-team-grade MDM (Microsoft Intune, Jamf, Kandji, or similar) gives you: device inventory, encryption enforcement, remote wipe on lost or stolen, and patch reporting. Without it, you do not have an honest answer to “how many devices have access to our data right now”. With it, the answer is a query.
-
Disk encryption, on by default
FileVault on macOS, BitLocker on Windows, both enforced through MDM and verified in your monthly audit. Lost laptops happen. The difference between “we lost a laptop” and “we lost data” is whether the disk was encrypted at rest.
-
EDR after the basics
Once patch hygiene is real, EDR adds a layer that watches behaviour and detects threats that bypass updates. Pick one with a managed detection service if your team is small; raw EDR alerts without a triage team are noise.
-
Treat contractor devices as endpoints
If a contractor has access to your data, their device is your problem. Either issue a managed laptop, or scope their access through a hardened browser-based environment that does not put data on their machine. The middle path (their device, your data, no controls) is the worst of both worlds.
Two weeks. We assess your stack against the NIST Cybersecurity Framework and write the punch list.
You will get a written report covering identity, email, endpoints, backups, and response, with a prioritised list of fixes ordered by impact-to-effort.
How do small businesses test backups so ransomware does not win?
The single most-skipped control in small-business security is restore testing. Plenty of teams have backups; very few have ever proven they can read them. Ransomware has industrialised since 2022, the targets are small businesses far more often than the headlines suggest, and the deciding factor between “two-day recovery” and “three-week recovery with paid ransom” is whether the team has run the restore drill before the incident.
The shape that holds up is 3-2-1-1-0. Three copies of the data, on two different storage types, with one off-site, one immutable, and zero verification errors at the last drill. The immutable copy is the part most teams miss; without it, ransomware that reaches your file shares can reach your backups too. Object-lock on S3 or its equivalent on your cloud provider gives you immutability at low cost. The NIST Cybersecurity Framework covers the same logic at a higher level, but the operational version is the one you implement.
The drill is the unglamorous core. Once a quarter, pick a random subset of files (or one entire SaaS dataset) and restore it to a clean environment. Time the restore. Verify integrity. Update the runbook with whatever broke. The first drill always reveals at least one issue that would have made a real incident worse: a missing credential, an off-site copy that turned out to be on the same provider, or a backup tool that needs an admin who left two years ago.
average ransom payment in 2024 — a five-fold jump from $400K the year before — per the Sophos State of Ransomware 2024 survey of 5,000 IT leaders.
of ransomware victims reported that attackers tried to compromise their backups during the attack. The attempts succeeded in 57% of cases (Sophos State of Ransomware 2024). Immutability is what closes this gap.
share of ransomware-hit organisations that recovered within a week in 2024, down from 41% in 2023 and 50% in 2022 (Sophos). 55% of cases now take more than a month to recover.
Five things to verify, every time
- Restore one critical file from each backup destination, end-to-end.
- Confirm the restored file’s hash matches the original; do not eyeball it.
- Time the full restore from the moment the drill starts to the moment a user could resume work.
- Test that the immutable copy resists deletion attempts from the regular admin account.
- Update the runbook with anything that broke, missed, or surprised, before the next quarter.
Response in a small team
You do not need a security operations centre to have an incident response plan. You need a one-page runbook that everyone can find at three in the morning. The realistic small-team plan answers four questions, written down, kept current, and printed somewhere that does not depend on the systems that just broke.
Who calls who. The first call is to a designated incident coordinator. The second call is to legal. The third is to your cyber insurance carrier (because the policy almost certainly requires early notification). The runbook includes phone numbers, not just Slack handles, and a paper copy lives outside the systems that might be down. We have seen an otherwise-prepared team waste four hours during a real incident because the only copy of the runbook was in a Google Doc that the same outage took down.
What we say, internally and externally. Have draft holding statements ready: one for employees, one for customers, one for regulators. Write them in calm conditions; you will not write good ones in panic. The same logic applies as in our note on AI product strategy under uncertainty: pre-decided defaults beat improvised judgment when the timer is running.
The best response plans we have seen are not impressive. They are short, specific, and printed. The team can find them with the lights off.
Vadim Leviev · Levievs
global average cost of a data breach in 2024 — the largest year-on-year jump since the pandemic, per IBM Cost of a Data Breach Report 2024.
average breach cost for organisations under 500 employees — a 13.4% rise vs. 2022 (IBM 2024). The SMB premium is real.
average lifecycle of a breach — 204 days to identify, 73 days to contain. Teams that combine a written runbook with security automation cut containment by an average of 98 days (IBM 2024).
For the AI-platform side of incident response (where the unique failure modes around prompt injection, training-data exposure, and model abuse all live), the playbook is different and more involved. We covered it in our note on building cybersecurity into AI platforms; the SMB version above is the floor, the AI-platform version is the next ceiling.
Cyber insurance and audit trails
Cyber insurance has become a real control rather than a financial product, because the underwriting questions have hardened. Modern policies require evidence of MFA, EDR, off-site backups, and a written incident response plan. Failing to maintain them after the policy is signed can void coverage at exactly the moment you need it. Treat the underwriting questionnaire as a checklist of controls you actually run, not a form you fill in once.
The audit trail is the other underexamined control. If an incident happens, the question becomes “how long had the attacker been inside, what did they touch”. The answer comes from logs you set up months earlier or it does not come at all. Centralise authentication logs, file-access logs from the cloud storage tier, and admin-action logs from your SaaS apps. The day you actually need them, you will be glad they were already in one place. Our consulting work often starts with this gap; clients have the controls, but the evidence trail to prove they had the controls is missing.
share of 2025 cyber-insurance applications that ask specifically about MFA implementation across email, VPN, remote access, cloud platforms and admin accounts, per the Marsh McLennan 2025 Cyber Insurance Market Report.
jump in ransomware claim severity in the first half of 2024, driving overall claim severity to record highs, per the Coalition 2025 Cyber Claims Report.
average ransomware-specific loss reported by insured organisations, per the Coalition 2024 Cyber Claims Report. Coverage covers the cheque; the audit trail decides whether the claim pays out.
The minimum viable security stack for a 200-person company in 2026 is phishing-resistant MFA on every account, DMARC enforced to reject, MDM-enforced patch hygiene on every device, immutable off-site backups verified quarterly, and a one-page response runbook. None of it is exotic. All of it moves more risk than any single tool the next vendor will pitch you.
On the identity-perimeter side specifically: how passkeys, WebAuthn, and faceprint actually fit (and where they fail) is in our piece on biometric authentication for SMBs.
Frequently asked questions
Do small companies really need this much?
Small companies are targeted more than large ones in 2026, because automation has made small targets economically attractive. The Verizon DBIR has tracked the share of incidents at companies under 1,000 employees rising every year for four years running. The list above is the floor, not the maximum.
How often should we run phishing drills?
Quarterly, with at least one realistic scenario per industry. The metric to watch is repeat-clicker rate over four quarters; the absolute click rate is less informative because it depends on the difficulty of the test.
Do we need a SOC or a managed service?
Not a 24-7 SOC at this scale. A managed detection and response service that watches your EDR alerts at night and weekends covers most of the gap. Pick one with a written response time and a real escalation tree.
What about cyber insurance, is it worth it?
Yes for the financial backstop and the panel of incident-response specialists most policies include. Read the exclusions carefully; many policies exclude failures of basic controls (MFA off, backups never tested) that turn a covered claim into an uncovered one.
How do remote employees and contractors fit in?
Remote employees follow the same MDM, MFA, and patch policies as office staff; the work location does not change the threat model. Contractors either get a managed device or access through a hardened browser environment that keeps data off their personal machine. The hybrid case (their machine, your data, no controls) is the failure mode.
