Why Antivirus Is Not a Small-Business Cybersecurity Plan

Antivirus remains useful, but it is no longer a credible cybersecurity plan by itself. Verizon’s 2026 breach findings show why: exploitation of software vulnerabilities became the leading entry point, appearing in 31% of breaches; third parties were involved in 48%; and frequent use of unapproved workplace AI tools rose from 15% to 45% of employees.

What has not changed is the value of disciplined fundamentals—but they now need to operate as a managed business system rather than a collection of security products. The current NIST framework for small businesses organizes that system around six connected functions: Govern, Identify, Protect, Detect, Respond and Recover.

Start with the business, not the security catalogue

The first decision is what the company cannot afford to lose or leave unavailable. That may include payment systems, customer records, production equipment, business email, cloud documents or the credentials used to administer them. A short inventory of critical data, devices, software, accounts and suppliers gives security spending a business purpose.

Assign an owner to every critical system and record who can access it, which vendor supports it, where its data is stored and how long the business could operate without it. This does not require an elaborate database: a maintained spreadsheet can be enough for a small organization. The important point is that someone is responsible for keeping the information current.

Governance also means deciding who can accept cyber risk. A technician may explain that an old application cannot be patched, but a business leader must decide whether to replace it, isolate it, limit the data it handles or formally tolerate the exposure. Cybersecurity becomes manageable when exceptions have owners, deadlines and documented reasons.

Close the entry points that create the most exposure

Protection should begin with internet-facing systems, privileged accounts and the services employees use every day. Automatic updates are appropriate where they will not disrupt essential operations; other systems need a defined patch schedule and an expedited route for actively exploited flaws. Unsupported software should be replaced or separated from sensitive systems because no future patch may arrive.

Require multi-factor authentication for email, cloud administration, financial services, remote access and other high-impact accounts. Prefer stronger methods such as security keys or authenticator-based sign-in when a service supports them, and keep recovery methods under the same control as the primary login. An attacker who can reset an account through an unprotected mailbox or phone process may be able to bypass an otherwise strong sign-in configuration.

The FTC’s current small-business guidance combines these measures with regular software updates, limited access to sensitive assets, encryption, staff training, network monitoring and backups that are not connected to the production network. It also recommends separate guest Wi-Fi and written security requirements for vendors.

A practical protection baseline should therefore cover:

unique accounts, a password manager and multi-factor authentication;
rapid patching of browsers, operating systems, routers, servers and business applications;
least-privilege access, with administrator rights reserved for administrative work;
email authentication and a separate verification channel for payment or credential requests;
encryption and remote-lock capabilities for laptops and mobile devices;
prompt removal of accounts and access tokens when staff or contractors leave.

Design backups for recovery, not reassurance

A successful backup job is not the same as a recoverable business. Decide which records and systems must be restored first, how much recent data the company can tolerate losing and how long each critical service may remain unavailable. Those answers determine backup frequency, retention and recovery priorities.

Keep at least one backup isolated from ordinary user and administrator accounts so that a compromised account cannot erase both the live data and every recovery copy. Protect backup consoles with multi-factor authentication, encrypt backup data and record the credentials and procedures needed to restore it. Test a representative restoration on a schedule; a report saying “backup completed” does not prove that files, applications and dependencies will work together.

Backups address availability, not every ransomware consequence. They can help restore systems after encryption or destruction, but they cannot retract information that an attacker has already copied. Data minimization, access control, encryption and an incident communications plan remain necessary even when restoration works perfectly.

Treat suppliers and unapproved tools as part of your perimeter

A vendor with remote access, a cloud application holding customer data or a contractor using an administrative account can create the same business impact as an internal system. Before granting access, establish what information the supplier can reach, how authentication works, whether subcontractors are involved, how incidents will be reported and how data and credentials will be removed when the relationship ends.

Access should be limited by purpose and time. Give a payroll provider the records needed for payroll, not unrestricted access to a general file store; give a support contractor an individual, monitored account rather than a shared administrator password. Review active integrations and dormant accounts periodically, because an old connection can retain powerful permissions after employees have forgotten why it exists.

The same principle applies to AI and other employee-selected cloud tools. A workable policy should identify approved services, prohibited data types and a route for requesting a new tool. Blocking everything without offering usable alternatives may conceal adoption rather than control it; the objective is to make business use visible and subject it to the same data, retention and access decisions as any other supplier.

Prepare to detect and contain an incident

Prevention will sometimes fail, so a small company needs enough visibility to recognize unusual activity. Centralize alerts from the most important email, identity, endpoint, firewall and cloud services where practical. Define who reviews them, which events require escalation and how to contact that person if normal email or messaging is unavailable.

Create a concise incident plan with names and decision authority, not just generic steps. It should cover isolation of affected devices, preservation of evidence, password and token resets, contact with technical support, assessment of legal or contractual notification duties, and communication with staff and customers. Store an accessible offline copy along with insurer, legal counsel, critical vendors and relevant government reporting contacts.

Exercise the plan with a realistic scenario, such as a stolen cloud administrator account or an unavailable order system. The test should reveal whether the team can make decisions when information is incomplete: who may disconnect a system, who approves customer communication, what operations can continue manually and which supplier must respond first. Record the gaps and assign each correction an owner and deadline.

Use specialists and insurance for defined gaps

A small company does not necessarily need a full internal security department. It may need outside expertise to configure identity systems, investigate alerts, test recovery or respond to an incident. Scope the work around specific responsibilities, response times, access controls and evidence the provider will deliver; the word “managed” alone does not establish who is watching what.

Cyber insurance can transfer some financial exposure, but it does not patch systems, restore data or make operational decisions during an attack. Compare proposed coverage with the company’s actual risks, including business interruption, incident investigation, notification, fraud, extortion and claims by customers or partners. Pay close attention to exclusions, waiting periods, sublimits, required security controls and the process for obtaining approval before engaging outside responders.

The useful outcome is not a perfect network. It is a company that knows what matters, reduces the most consequential access paths, notices abnormal activity and can continue or restore essential work under pressure. Antivirus belongs inside that system, but it cannot substitute for it.

Antivirus Is Not a Cybersecurity Plan: The Gaps Small Businesses Must Close