Getting started
The 1-hour security check
Four checks in one hour, nothing to buy: who to call, the payment call-back rule, MFA on email, and your top five gaps.
All guides
25 practical guides covering the core small-business security stack and the owner’s own identity. Each one explains what the category is for, what to verify before you pay, and a rollout plan a small team can finish without a dedicated security department.
Where to start: if you only have an hour, do the 1-hour security check. After that, most offices get the biggest risk reduction from a team password manager and MFA on email, then tested backups and endpoint protection. VPN comes last, for the specific access problems you actually have.
Comparison cluster: Start with Password managers for small business, then compare 1Password vs Bitwarden, and see why browser-saved passwords are not a business vault.
Getting started
Four checks in one hour, nothing to buy: who to call, the payment call-back rule, MFA on email, and your top five gaps.
Password managers
Shared vaults, admin controls, offboarding, and which team plan fits.
Comparison
Polish versus price: a head-to-head for small teams, plus a two-week pilot plan.
Identity
Security defaults, Authenticator, passkeys, Conditional Access, and recovery.
Password managers
Why browser saving fails at sharing and offboarding, and the migration to a team vault.
Password managers
Credential stuffing, a free Have I Been Pwned check for your team, and the order to fix reused passwords.
Access control
Named, least-privilege, time-boxed access that ends on schedule.
Offboarding
Disable accounts the same day, rotate shared logins, collect devices.
File sharing
Share by name, expire external links, audit quarterly.
Email security
Plain-English SPF, DKIM and DMARC setup for Google Workspace and Microsoft 365.
Phishing
How fake QR codes steal logins and payments, and what FTC, FBI and CISA advise.
Phishing
The verify-first team rule for macro attachments, plus controls and incident steps.
Phishing & fraud
Callback phishing turns a fake $499 invoice into a scam phone call. The verify-it-yourself routine and remote-access rules.
Scams
The tells of the toll smishing text, how to check your real account, and what to do if you already paid.
Phishing & fraud
Verify money requests out-of-band and use a two-person payment rule.
Endpoint
Antivirus vs EDR vs managed protection, a vendor shortlist, and a 30-day rollout.
Patching
Windows, macOS, phones, routers and WordPress: the update settings to switch on today.
Device security
BitLocker and FileVault defaults, with recovery keys in the vault.
Device habits
Short lock timeouts and the Win+L / Ctrl+Cmd+Q habit.
Shadow IT
Move client files to approved work storage, share by name, and back up separately.
Backup
Choose backup by what you must restore: laptops, cloud data, shared files, or servers.
Identity theft
Free credit freezes and IRS IP PINs first, then whether a paid service like Coveron is worth it.
Remote access
When a VPN helps, when it does not, and business VPN vs mesh/ZTNA options.
Network security
Internet-only guest access that cannot reach staff devices.
Network security
Default router logins are public. Change the admin password, update firmware, and turn off remote management.