How to prevent a data breach: 10 steps for small businesses

For the first time in the 19 years Verizon has published its Data Breach Investigations Report, exploited software flaws have passed stolen passwords as the most common way attackers get in, at 31% of breaches in the 2026 report. Breaches involving a third party rose to 48%. If you want to know how to prevent a data breach in an office of 10 or 200 people today, those two numbers set the priorities.

Strong passwords and phishing training still matter, and patching and vendor control now sit beside them at the top of the list.

How to prevent a data breach: close the doors attackers use most

1. Patch fast, starting with anything facing the internet

Verizon found the median time to patch actively exploited vulnerabilities grew to 43 days, and only about a quarter of them were fully fixed. Attackers don’t wait that long. Turn on automatic updates for Windows, browsers and Microsoft 365 apps, and put firewalls, VPNs, remote access tools and other internet-facing devices first in line. Replace equipment that no longer gets security updates. Our guide to vulnerability management lays out a process.

2. Move to phishing-resistant sign-in

Turn on multifactor authentication everywhere, then move toward passkeys or security keys, which can’t be typed into a fake login page. For our clients, admin accounts use phishing-resistant sign-in such as security keys or passkeys, and everyone else approves sign-ins in an app with number matching.

3. Use long, unique passwords where you still need them

Current NIST guidance favors length over complexity and says organizations shouldn’t force routine password changes. A business password manager lets staff keep a unique password for every account without memorizing them.

Limit what an attacker can reach

Assume something will eventually get through, and make sure it can’t go far once it does.

4. Give people only the access they need

Staff should not be local administrators on their computers. Review who can reach sensitive folders, shared mailboxes and financial systems at least twice a year, and shut off former employees’ accounts the day they leave. We disable access for our clients the same day they ask.

5. Encrypt data on devices and in transit

Turn on full-disk encryption (BitLocker on Windows, FileVault on Mac) for every laptop, and use encrypted email or secure portals for sensitive files. A stolen encrypted laptop is an inconvenience. An unencrypted one can be a reportable breach.

6. Run endpoint detection and response, watched around the clock

Traditional antivirus looks for known bad files. Endpoint detection and response watches for suspicious behavior and can isolate a device before an attacker spreads. What matters most is whether someone sees the alert at 2 a.m., when many attacks run, which is why every one of our clients has a 24/7 security operations center behind it. Application control, which only lets approved software run, closes another common gap.

Train your people and check your vendors

7. Train staff on texts and calls, too

Verizon found that scams delivered by text message and phone call succeeded 40% more often than traditional email phishing. Include texts, calls, fake help desk requests and payment change requests in training. Our clients get continuous phishing simulations, and a click triggers a short lesson on the spot and shows up in the report to the client. Add one firm rule: any change to bank details or payment instructions gets verified by calling a known number.

8. Know which vendors can touch your data

With third parties involved in nearly half of breaches, list every vendor and app with access to your systems or client data, require MFA on their access, get the contracts your industry requires, and remove vendors you no longer use. Our guide to supply chain security goes deeper.

Plan for the day something gets through

9. Keep backups attackers can’t reach

Ransomware groups go after backups first. Keep at least one copy offline or immutable, keep copies on site and in the cloud, back up Microsoft 365 separately, and test real restores. For our clients, server backups run hourly, are copied off-site daily, are immutable and are verified with screenshots, and Microsoft 365 and Google Workspace data is backed up three times a day to immutable storage, as part of our business continuity services.

10. Write and practice an incident response plan

Decide ahead of time who makes decisions, who calls your cyber insurer and attorney, how you will communicate if email is down, and which notification deadlines apply to you. Walk through a scenario as a team once a year. Our post on data breach response steps and common pitfalls is a good starting point.

What a breach costs, and what the rules require

That average comes mostly from large organizations. Your number would be smaller, and so is your budget for absorbing it. The costs include notices to customers and regulators, legal fees, lost work time and lost trust. Louisiana requires businesses to notify affected residents without unreasonable delay and no later than 60 days after discovering a breach of personal information.

For many organizations these steps are required. If you prepare taxes, give financial advice, lend or broker mortgages, the FTC Safeguards Rule requires a written security program with a risk assessment, encryption, MFA, staff training, vendor oversight and an incident response plan, and since 2024 covered firms must notify the FTC within 30 days of discovering a breach involving unencrypted information of 500 or more consumers. Healthcare practices have similar duties under the HIPAA Security Rule. The ten steps above map closely to what an auditor will ask to see, and our compliance services help keep that documentation current.

Count how many of the ten you could prove today, with a setting or a document to point to. Book a 15-minute call with that count and we’ll go through the rest with you. That work is the core of our cybersecurity services.

Related reading: What is password spraying? How it works and how to stop it, What is malvertising? Why clicking search ads can lead to malware and Business email compromise: How it works and how to stop it.