Business email compromise cost victims 2.77 billion US dollars across 21,442 complaints in 2024, according to HousingWire’s summary of the FBI’s IC3 report, and the average loss per reported incident rose to 19,372 US dollars from 14,197. For a small business, a single wrong payment can be larger than a month of revenue.
Cybersecurity Awareness Month, which runs all of October and has the 2026 national theme “Securing the Next 250”, is a convenient deadline for fixing the basics. This plan breaks the work into four weeks with one outcome per week: secure accounts, secure devices, train people, and prepare for recovery. Each week needs about two to three hours from one named owner, and none requires a dedicated security team.
Before You Start: Pick an Owner and a Baseline
Choose one person to run the plan, even if the business has only five people. Write down a baseline in a shared document: how many accounts use multi-factor authentication, how many devices are in use, when you last tested a backup, and who can approve a payment. You cannot show progress without a starting point. Our guide to a small business cybersecurity audit goes deeper if you want a more formal review, and this plan works as a four-week sprint that gets the highest-impact actions done first.
Week 1: Secure Accounts
Accounts are the front door. Verizon’s 2025 report found credential abuse in 30 percent of breaches, according to Abnormal AI’s summary, so start here. Turn on multi-factor authentication for email, banking, accounting software, cloud storage, and social accounts, using an authenticator app where possible. Roll out a business password manager so every account has a unique password, and our comparison of the best password managers helps you choose. Remove accounts for former staff and contractors, and review who has administrator rights. Finish by reviewing software-as-a-service apps against our SaaS security best practices guide.
Week 2: Secure Devices
List every laptop, phone, tablet, and router that touches business data, including personal devices used for work. Turn on automatic updates and install pending ones. Enable disk encryption, a screen lock, and remote wipe on phones and laptops. Replace default passwords on routers and printers, and separate guest Wi-Fi from the business network. Retire or isolate any device that no longer receives updates, since known flaws are the easy route for attackers. For remote staff, see our remote work cybersecurity guide.
Week 3: Train the People
Hold a 30-minute session on phishing, passwords with multi-factor authentication, and reporting, using the agenda in our guide to cybersecurity awareness training for employees. The human element contributed to 60 percent of breaches in the Verizon report. Send a simulated phishing message a week later, track who clicks and who reports, and share the result without naming individuals. Praise staff who report suspicious messages, and make reporting as easy as possible with one email address or button.
Week 4: Prepare for Recovery and Payments
Assume something will go wrong, and make recovery fast. Set up automatic backups of critical files with at least one copy stored offline or in a separate account, then actually restore a file to prove it works. Write a one-page incident plan: who to call first, how to isolate a device, who tells customers, and which bank and insurer contacts to use. Add a payment rule: any change to bank details or an urgent payment request must be confirmed by calling a known number, never a number in the email. This single rule targets business email compromise, the costliest category in the FBI’s report.
The Four-Week Plan at a Glance
| Week | Focus | Key Actions | Time | Evidence of Done |
|---|---|---|---|---|
| 1 | Accounts | MFA, password manager, remove old users | 3 hours | MFA coverage percentage |
| 2 | Devices | Updates, encryption, router, inventory | 3 hours | Device list with update status |
| 3 | People | 30-minute training, phishing test | 3 hours | Click and report rates |
| 4 | Recovery | Backup restore test, incident plan, payment rule | 3 hours | Tested restore, signed-off plan |
Extending the Plan to Vendors and Customers
Third-party involvement in breaches doubled from 15 to 30 percent in the Verizon 2025 report, so ask vendors that hold your data about their security controls, including multi-factor authentication and breach notification. Our guide to supply chain security explains what to ask. If you handle customer payments or personal data, tell customers how to verify your messages, and keep a clear channel for them to report suspicious ones.
After October: Keep a Quarterly Rhythm
Put a 60-minute security review on the calendar each quarter. Check MFA coverage, remove stale accounts, install updates, test one backup, and run a short phishing exercise. Record the numbers in the same document as your baseline. In a year, you will have a record that supports insurance applications, customer questionnaires, and your own peace of mind.
