Cybersecurity for Small Businesses and Freelancers (on a Realistic Budget)

If you run a small business, freelance, or fly solo as an entrepreneur, you have probably had a quiet moment of dread about "cybersecurity" and then closed the tab. It sounds expensive. It sounds like it needs a specialist. And honestly, most advice out there is written for companies with an IT department and a budget to match. That is not you, and this article is not written for them.

Here is the good news, and it is genuinely good news: the handful of things that stop the overwhelming majority of real-world attacks are cheap, mostly free, and take an afternoon to set up. You do not need to become a security expert. You need to do a small number of high-impact things in the right order, and then get back to running your business. That is exactly what we are going to walk through, in plain English, with no scare tactics.

Why Would Anyone Bother Attacking a Small Business?

The most common thing I hear from freelancers and small business owners is some version of "I am too small to be a target." It feels true. Why would a criminal waste time on a two-person design studio or a solo bookkeeper when there are banks and big corporations out there?

The answer is that most attacks are not personal, and they are not hand-picked. They are automated and opportunistic. Criminals run software that scans millions of email addresses, websites, and login pages at once, looking for the ones with weak or reused passwords, no two-factor authentication, or unpatched software. You are not being singled out. You are being swept up in a net that is cast across the whole internet.

And here is the uncomfortable part: small businesses are actually better targets in some ways. You probably do not have a security team. You likely handle real money and real client data. You are busy, distracted, and wearing ten hats at once, which makes you more likely to click the wrong thing at the wrong moment. Attackers know this. They are not looking for a challenge; they are looking for the easy win.

The threats that actually hit businesses your size are not exotic. They are boring and repetitive: someone reuses a password that leaked from another site, an invoice gets rerouted to a criminal's bank account, a laptop gets stolen from a car, or a ransomware infection locks up every file and demands payment. None of these require a genius attacker. All of them are preventable with basics.

The Highest-Impact Basics, In Order

Before we get into the details, understand the philosophy: do the cheap, boring, high-impact things first. Fancy tools and expensive services matter far less than the fundamentals. If you only ever do the first three sections below, you will have shut the door on the vast majority of attacks that hit small businesses. Everything after that is polish.

1. Get a Password Manager for You and Your Team

This is the single highest-impact, lowest-cost thing you can do, so we are starting here. The core problem is simple: humans cannot remember dozens of strong, unique passwords, so we reuse them. And password reuse is how one leak becomes ten break-ins. When a website you signed up for years ago gets breached, criminals take that email-and-password combination and try it everywhere else, your email, your bank, your accounting software, your client portals. If you reused it, they are in.

A password manager solves this permanently. It generates a long, random, unique password for every single account, stores them encrypted, and fills them in for you. You remember one strong master password, and the software handles the rest. It is genuinely easier than what you do now, not harder.

For a small team, look at Bitwarden, which is open-source, audited, and has an extremely capable free tier plus very affordable business plans that let you share credentials securely across your team. If you want the most polished experience and do not mind paying a little more, 1Password is excellent and its team features for onboarding and offboarding staff are among the best available. Either one is a great choice; the important thing is that you pick one and actually use it.

The team angle matters enormously. Right now, if you are like most small businesses, your shared logins live in a spreadsheet, a group chat, or someone's memory. A team password manager lets you share access to the accounts a person needs without ever telling them the actual password, and it lets you revoke that access instantly when they leave. We will come back to that in the section on employees and contractors.

2. Turn On Two-Factor Authentication Everywhere That Matters

Two-factor authentication (2FA, sometimes called multi-factor or MFA) means that logging in requires two things: something you know (your password) and something you have (a code from an app, or a physical key). Even if a criminal steals your password, they cannot get in without that second factor. It is the closest thing to a magic shield in all of security, and it is usually free.

Turn it on, starting with your most important accounts and working down:

• Your email — this is the master key to everything, because password resets for every other account go through it. Protect it first.
• Your bank and payment accounts — anything that touches money.
• Your accounting, invoicing, and payroll software.
• Your domain registrar and website host — if someone takes over these, they can hijack your entire online presence.
• Cloud storage, client portals, and social media.

For the second factor, use an authenticator app (like the one built into your password manager, or a free standalone app) rather than text-message codes. SMS codes are better than nothing, but they can be intercepted or hijacked through your phone number. For your most critical accounts, especially your email and your domain registrar, consider a hardware security key. A device like a YubiKey is a small physical key that plugs into your computer or taps your phone; an attacker literally cannot log in without physically holding it. It is the gold standard, it is essentially phishing-proof, and one or two of them for your admin accounts is a modest one-time cost with an outsized payoff.

3. Secure Your Email and Your Domain

Your business email is the crown jewels. It is where password resets land, where clients send sensitive information, and where impersonation attacks do their damage. Lock it down hard.

Beyond enabling strong 2FA (covered above), think about where your email actually lives. If you are still running your business off a free personal email account, or your email is bundled into a cheap web-hosting package with weak security, it may be worth moving to a provider built with privacy and security in mind. Proton Mail offers encrypted business email with your own custom domain, strong 2FA support, and a genuine focus on keeping your data private. For a solo operator or small team that handles confidential client information, that peace of mind is worth the modest monthly cost.

Whatever provider you use, make sure your domain has proper email authentication set up (the technical terms are SPF, DKIM, and DMARC). These are settings that help stop criminals from sending fake emails that appear to come from your address, which is a common way scammers trick your clients. Your email provider or domain registrar usually has a guided setup or a support article for this; it is a one-time job and it protects your reputation as much as your inbox.

4. Set Up Backups You Can Actually Restore

Ransomware, the kind of attack that encrypts all your files and demands payment, is one of the most damaging things that can hit a small business. Hardware also just dies. Laptops get stolen, dropped in coffee, and left in cabs. The only reliable defense against losing everything is a backup you can actually restore from.

A simple, robust approach is the "3-2-1" rule: keep 3 copies of important data, on 2 different types of storage, with 1 copy kept off-site (or in the cloud). In practice, for a tiny business, that might mean your working files on your laptop, an automatic cloud backup, and an external drive you plug in periodically and keep somewhere separate.

Two things people always get wrong. First, cloud file sync is not the same as a backup. If ransomware encrypts your files and they sync to the cloud, your cloud copy is now encrypted too. Choose a backup service that keeps version history so you can roll back to before the damage. Second, and this is the big one: test your restore. A backup you have never restored from is a hope, not a plan. Once a quarter, actually try to recover a file and make sure it works.

5. Secure Your Devices

Your laptops and phones are where the work happens, and they walk out the door with you. A few settings turn a lost device from a catastrophe into a minor annoyance:

• Turn on full-disk encryption. This is built in and free: FileVault on Mac, BitLocker on Windows (Pro editions), and it is on by default on modern phones. It means a thief who steals your laptop gets an expensive paperweight, not your client files.
• Set a strong screen lock with a short auto-lock timeout, and use a real passcode or biometrics, not a four-digit PIN you also use elsewhere.
• Enable "find my device" and remote wipe so you can erase a lost phone or laptop from afar.
• Keep the built-in security tools on. Modern Windows and Mac have solid built-in protection; you generally do not need to buy expensive third-party antivirus. Just leave the built-in defenses enabled and do not disable them.

6. Keep Your Software Updated

This one is unglamorous and easy to ignore, which is exactly why attackers rely on it. A huge share of breaches exploit vulnerabilities that were fixed months ago, in people who simply never installed the update. Turn on automatic updates for your operating system, your web browser, and your apps. When your phone or laptop nags you to update, do not "remind me tomorrow" for the fifth time; let it run overnight. If you have a website, keep its platform and plugins updated too, since outdated plugins are one of the most common ways small business sites get hacked.

Phishing, Business Email Compromise, and Invoice Fraud

Now we get to the attacks that actually drain bank accounts. The most expensive threats to small businesses often are not technical wizardry, they are cons that trick a human into doing something. Understanding how they work is your best defense, because no software can fully protect you from a convincing lie.

Phishing: The Bait and the Hook

Phishing is any message designed to trick you into clicking a malicious link, opening a booby-trapped attachment, or handing over your password on a fake login page. It usually arrives as an email but can also be a text, a DM, or even a phone call. The classic tells still work: urgency ("your account will be suspended in 24 hours"), a sense of authority ("this is your bank"), and a link that goes somewhere slightly off.

Modern phishing is more polished than the old "Nigerian prince" clichés, so lean on habits rather than instinct. Before you click a link in an email, hover over it and look at where it actually goes. Be deeply suspicious of any message that asks you to log in via a link, when in doubt, open a new tab and type the site's address yourself. And remember that 2FA and a password manager are quiet heroes here: a password manager will refuse to autofill your credentials on a fake look-alike site, which is often the first clue that something is wrong.

Business Email Compromise and Invoice Fraud

This is the one that keeps me up at night for small businesses, because the losses are large and the attack is devastatingly simple. Business Email Compromise (BEC) is when a criminal either breaks into a real email account or convincingly impersonates someone you trust, and then uses that trust to redirect money.

The most common flavor is invoice fraud. It works like this. A supplier you regularly pay sends you a normal-looking email that says, "We have changed banks, please use these new account details for future payments." Except the email is not really from your supplier, it is from a criminal who either compromised the supplier's inbox or spoofed their address. You update the payment details, pay the next invoice as usual, and the money vanishes into a criminal's account. By the time anyone notices, it is gone.

Another flavor is CEO fraud, where someone impersonates the business owner and emails a staff member: "I am tied up in a meeting, can you urgently wire this payment / buy these gift cards?" The urgency and authority are the whole trick.

The defense here is a rule, not a tool:

Any request to change payment details, or any unexpected request to move money, must be verified through a second channel you already trust. Call the person on a number you already have, not one from the email. Never trust bank-detail changes that arrive only by email.

Write that rule down, tell everyone who handles money, and make it non-negotiable. It costs nothing and it stops the most expensive attack that hits businesses your size. Combine it with strong 2FA on your email accounts (so criminals cannot get in and lurk in the first place) and proper domain email authentication (so impersonation is harder), and you have closed the door on the worst of it.

Protecting Your Clients' Data

When clients trust you with their information, their contracts, their financial records, their personal details, their creative work, protecting it is both an ethical duty and, increasingly, a legal one. A breach of client data can end a small business through lost trust alone, before you even count the potential fines under privacy rules like GDPR or various state laws.

You do not need an enterprise data-governance program. You need sensible habits:

• Collect and keep only what you need. The safest data is the data you never stored. If you do not need a client's full ID document after verification, do not keep a copy.
• Know where client data lives. Take five minutes to list it: your email, your cloud storage, your accounting tool, your project software. You cannot protect what you have not accounted for.
• Encrypt it at rest and in transit. Full-disk encryption on your devices covers "at rest." Using reputable services that use encryption, and a secure email provider, covers "in transit." Do not send sensitive files as plain email attachments if you can share them through a secure link instead.
• Limit who can see it. Not every contractor needs access to every client folder. Share on a need-to-know basis.
• Delete it properly when you are done. When a project ends and your retention obligations expire, actually remove old client data rather than letting it pile up as a future liability.

Working Securely From Cafes and Home

The freedom to work from anywhere is one of the best parts of running your own show, and it comes with a couple of easy-to-manage risks.

Public Wi-Fi

Public Wi-Fi in a cafe, airport, or coworking space is convenient and generally fine for casual browsing, but it is a shared, untrusted network. The main modern risk is not that everything is intercepted, most websites are encrypted with HTTPS now, but rather fake hotspots set up to impersonate the real one, and the general uncertainty of who else is on the network.

A reputable VPN neatly solves this by encrypting all your traffic before it leaves your device, so even on a sketchy network, your activity is a sealed tunnel. For a small business owner who works on the road, Proton VPN is a solid, privacy-respecting choice with a genuinely usable free tier and affordable paid plans. Turn it on whenever you are on a network you do not control. Beyond that, avoid public USB charging ports (use your own charger and a wall socket), and never do sensitive work on a shared or public computer.

Your Home Network

Your home has become your office, so give the network a little attention. Change your Wi-Fi router's default admin password (a shocking number of people never do), make sure your Wi-Fi uses WPA3 or at least WPA2 encryption with a strong passphrase, and keep the router's firmware updated. If your router supports a "guest network," put your smart-home gadgets and visitors on that, and keep your work devices on your main network, separated from the cheap internet-connected devices that tend to have poor security.

Employees and Contractors: Onboarding and Offboarding Access

The moment you bring on your first employee, freelancer, or virtual assistant, you have a new category of risk, not because they are untrustworthy, but because access has to be granted and, crucially, revoked cleanly. The single most common failure I see in small businesses is the ex-contractor who still has access to a shared account six months after the project ended.

Onboarding

• Give each person their own account wherever possible, rather than sharing one login. Individual accounts mean you can see who did what and remove one person without disrupting everyone.
• Grant the least access needed to do the job, and no more. A social media contractor does not need access to your accounting software.
• Use your team password manager to share credentials for the accounts that genuinely must be shared. Both Bitwarden and 1Password let you share a login with a team member without revealing the actual password, and let you pull that access back instantly. This is far safer than emailing passwords around.
• Require 2FA on the accounts they touch, and take two minutes to explain the payment-verification rule and how to spot phishing.

Offboarding

When someone leaves, whether an employee quits or a contract simply ends, have a short checklist you run through the same day:

1. Revoke their access in the password manager and remove them from the team.
2. Disable or delete their individual accounts in every tool.
3. Change any truly shared passwords they knew (this is why individual accounts are better, you avoid this scramble).
4. Remove them from shared drives, email groups, and client communication channels.
5. Collect or remotely wipe any company devices.

None of this implies distrust. It is simply hygiene, the same way you would collect an office key from a departing employee. A written checklist means you never forget the account that turns into a security hole a year later.

A Simple Incident Plan

Even with everything above in place, something might still go wrong one day. The difference between a bad afternoon and a business-ending disaster is often just having a basic plan so you act fast and calmly instead of panicking. You do not need a thick binder. You need a one-page document that answers a few questions, prepared before you need it.

What to Include

• Who to call. Your bank's fraud line, your accountant, a trusted tech-savvy contact or IT consultant, and your cyber insurer's hotline (if you have one). Have these numbers written down somewhere you can reach even if your systems are locked.
• First moves for common scenarios. For example: if an account is compromised, immediately change its password from a different, clean device and check its 2FA and recovery settings. If you sent money to a fraudster, call your bank immediately, minutes matter, and they can sometimes recall a recent transfer. If a device is lost or stolen, remotely wipe it and change the passwords for anything it could access.
• How to contain the damage. Disconnect an infected computer from the network to stop malware spreading, but do not wipe it if you might need evidence.
• Who to notify. Depending on where you operate and what data is involved, you may have a legal obligation to notify affected clients and possibly regulators within a set timeframe. Know your obligations in advance.

The single most important instruction on your plan is this: if money has moved to a criminal, call your bank first, before anything else. The window to reverse a fraudulent transfer is small and closes fast.

Cyber Insurance Basics

Cyber insurance has gone from a curiosity to something worth seriously considering, even for very small businesses, especially if you handle client data or move meaningful sums of money. It is not a replacement for the basics, in fact insurers increasingly require you to have things like 2FA and backups before they will cover you, but it is a genuine safety net.

A typical policy can cover the costs of responding to an incident: forensic investigation, notifying affected clients, legal fees, and in some cases the financial loss from fraud or the cost of recovering from ransomware. Some policies also give you access to an incident-response team, which for a solo operator with no IT support is enormously valuable when everything is on fire.

A few things to keep in mind as a non-expert shopping for it:

• Read what is actually covered. In particular, check whether "social engineering" and invoice/BEC fraud are covered, because those are often excluded or limited unless you specifically add them, and they are exactly the attacks most likely to hit you.
• Be honest on the application. If you claim to have controls you do not actually have, the insurer can deny your claim. This is a good reason to actually do the basics first.
• Right-size it. For a tiny business, you do not need a corporate-scale policy. Look for products aimed at small businesses and freelancers, sometimes available as an add-on to a general business liability policy.

Think of it the way you think of any other business insurance: you hope never to use it, but if the worst happens, it can be the difference between recovering and closing your doors.

Your Prioritized Roadmap: Ordered by Impact Per Dollar

Here is everything above, distilled into a do-this-in-order plan. It is deliberately sequenced so that the cheapest, highest-impact steps come first. If you get through the first several, you will have protected yourself against the vast majority of real threats. Do not try to do it all in one day, do a step or two a week, and you will be in great shape within a month or two.

1. Set up a team password manager and start replacing reused passwords. Nearly free, highest impact. Begin with Bitwarden or 1Password.
2. Turn on 2FA everywhere, starting with your email, bank, and domain registrar. Free.
3. Adopt the payment-verification rule to stop invoice fraud and BEC. Free, and it stops the most expensive attack there is.
4. Turn on automatic software updates on all devices and your website. Free.
5. Enable full-disk encryption and strong screen locks on every laptop and phone. Free and built in.
6. Set up automatic, versioned backups and test a restore. Low cost.
7. Secure your business email and domain with proper authentication, and consider moving to a private provider like Proton Mail. Low cost.
8. Add hardware security keys like a YubiKey for your most critical admin accounts. Modest one-time cost, huge protection.
9. Get a VPN for remote and cafe work, such as Proton VPN. Low cost.
10. Write your onboarding/offboarding checklist and your one-page incident plan. Free.
11. Review your client-data habits and tidy up what you store and share. Free.
12. Look into small-business cyber insurance once the basics above are in place. Modest ongoing cost.

Frequently Asked Questions

I am a solo freelancer with no employees. Do I really need all this?

You need most of it, and it is even easier for you because there is no team to coordinate. A password manager, 2FA everywhere, backups, device encryption, and the payment-verification habit are non-negotiable regardless of size. The employee and contractor sections become relevant the moment you hire your first helper, even a part-time virtual assistant. Everything else scales down cleanly to a team of one.

How much should a tiny business realistically spend on security per month?

Less than you fear. A huge portion of this is free: 2FA, updates, encryption, and good habits cost nothing. Your recurring costs are typically a password manager (a few dollars per person per month), a backup service, and optionally a VPN and a private email provider, plus a one-time purchase of a couple of hardware keys. For many solo operators the whole stack lands in the range of a single modest subscription bill. It is dramatically cheaper than recovering from one incident.

Is the free antivirus built into my computer good enough?

For most small businesses, yes. Modern Windows and macOS have strong built-in protection that is kept up to date automatically. Your money and attention are far better spent on a password manager, 2FA, and backups than on premium antivirus. Just make sure the built-in protection is turned on and never disable it.

What is the very first thing I should do today?

Two things, and they take under an hour. First, set up a password manager and change the password on your primary email account to a long, unique one. Second, turn on 2FA for that email account. Your email is the master key to your entire digital life, so securing it first gives you the biggest immediate improvement. Everything else can follow over the coming weeks.

Someone changed our supplier's bank details by email. How do I know if it is real?

Assume it is fraud until proven otherwise. Do not reply to the email or call any phone number listed in it. Instead, contact your supplier using a phone number you already had on file from before this message, and verify the change directly with a person you know. This one habit prevents the most costly attack that targets businesses your size, so make it a firm rule for everyone who handles payments.

Do I need a VPN all the time?

Not at home on your own secured network, where it is optional. Where a VPN genuinely earns its keep is on any network you do not control, cafes, hotels, airports, and coworking spaces. Turn it on whenever you are working away from your trusted home or office connection, and you will have the situations that actually matter covered.

The Bottom Line

Cybersecurity for a small business is not about buying the fanciest tools or living in fear. It is about doing a short list of cheap, boring, high-impact things and then getting on with your work. Get a password manager, turn on 2FA, adopt the verify-before-you-pay rule, keep good backups, encrypt your devices, and stay updated. That handful of steps, most of them free, will put you ahead of the vast majority of businesses your size and shut the door on the attacks that actually happen.

You do not have to do it all this week. Pick the first item on the roadmap, spend an hour on it, and check it off. Then do the next one. In a month or two you will have quietly built a level of protection that would have felt impossible when you first opened this article, without becoming an expert and without breaking the bank. That is exactly how it should be.