Cybersecurity for Virginia Small Businesses: Where to Start

Updated October 22, 2026

Most attacks on small businesses aren’t sophisticated. They’re a stolen password, a convincing fake invoice, or ransomware that walks in through an unpatched laptop. The good news is that a short list of controls blocks the large majority of them, and most cost little or nothing beyond what you already pay for.

This guide puts those controls in priority order. If you only have time for the first three, do the first three.

Why small businesses are targets

Attackers don’t usually pick a business by name. They send millions of phishing emails, scan the internet for unpatched systems, and try leaked passwords against every Microsoft 365 and Google login they can find. Small businesses get caught because they’re easier: fewer controls, nobody watching the logs, and owners who will pay a ransom to get back to work.

The FBI’s Internet Crime Complaint Center (IC3) reported more than $16 billion in losses for 2024, with business email compromise (fake invoices and payment-change requests) among the costliest categories. Those are only the incidents that got reported.

The priority list

1. Turn on multi-factor authentication everywhere

Multi-factor authentication (MFA) means a password alone isn’t enough to log in. It’s the single most effective control you can add, and it’s free in Microsoft 365, Google Workspace, and nearly every banking and payroll system.

Start with email, then banking, payroll, accounting software, and any remote-access tools. Use an authenticator app rather than text messages where you can. See our step-by-step MFA guide.

2. Have backups an attacker can’t reach

Ransomware works because victims have no clean copy of their data. A real backup is automatic, stored somewhere separate from your network, and tested. Syncing files to OneDrive or Dropbox is helpful but isn’t a backup on its own, because deletions and encrypted files sync too.

Our backup and disaster recovery guide covers what “good enough” looks like for a small office.

3. Verify payment changes by phone

The most expensive small-business incidents often involve no malware at all. Someone gets into an email account (or spoofs one), watches for an invoice, then sends “updated bank details.” The fix is a process, not a product: any change to payment instructions gets confirmed by calling a number you already have on file, never the number in the email.

4. Keep everything updated

Turn on automatic updates for Windows, macOS, browsers, and Microsoft Office. Replace anything that no longer gets security updates. Windows 10 reached end of support in October 2025, so any Windows 10 machine without Microsoft’s paid Extended Security Updates is now running without security patches.

Don’t forget the firewall, Wi-Fi access points, and any network storage device. These get forgotten more than PCs, and attackers specifically scan for them.

5. Use business-grade endpoint protection

Built-in Microsoft Defender is a reasonable baseline. Microsoft 365 Business Premium adds Defender for Business, which includes endpoint detection and response (EDR): it watches for suspicious behavior, not just known viruses, and can isolate an infected machine. For a business without dedicated IT staff, the value of EDR depends on whether someone is actually watching the alerts.

6. Train people briefly and often

A once-a-year slideshow doesn’t change behavior. Short, regular reminders and simulated phishing tests do. Make it easy and blame-free to report a suspicious email, because the employee who clicks and then reports it right away has done you a favor. Our guide to spotting phishing emails is a good place to start.

7. Limit admin rights and shared accounts

Day-to-day accounts shouldn’t have administrator rights. Shared logins (“frontdesk@” with a password on a sticky note) make it impossible to tell who did what and hard to revoke access when someone leaves. Give everyone their own account and use a password manager for anything that must be shared.

8. Write down what you’d do in an incident

One page is enough: who to call (your IT provider, your cyber insurance carrier’s hotline, your bank), how to disconnect affected machines, and where your backups are. Your insurer may require you to use their approved responders, so check before you need to.

What this costs

These are ballpark ranges. Prices change and vary by vendor, so confirm current quotes.

Cyber insurance will ask about all of this

Cyber insurance applications now routinely ask whether you use MFA, how you back up, whether you have EDR, and whether you train staff. Answering “no” can mean higher premiums or a declined application. Answering “yes” when it isn’t true can mean a denied claim. Treat the application as a checklist.

Virginia-specific considerations

If a breach exposes certain personal information about Virginia residents, Virginia law requires you to notify affected people and the Attorney General’s office. See our guide to Virginia data privacy and breach notification laws for what counts and when the clock starts.

Where to start this week

1. Check that MFA is on for every email account. (In Microsoft 365, an admin can see this in the Entra admin center.)
2. Confirm your backups exist, run automatically, and that someone has restored a file from them in the last 90 days.
3. Tell whoever pays the bills: no payment-detail changes without a phone call to a known number.