Most incidents exploit ordinary gaps. Closing them does not need a large budget.
The short list
One: turn on multi-factor authentication for email, banking and admin accounts. Two: use a password manager so no password is reused. Three: keep automatic updates on for every laptop, phone and server. Four: back up critical data to a separate location and test a restore. Five: remove access on the day someone leaves.
Train for the convincing email
Phishing remains the most common way in. Short, regular training with realistic examples works better than an annual slideshow. Make it easy and blame-free to report something suspicious.
Know who to call
Write a one-page incident plan: who decides, who to notify, where the backups are and which provider to call. The first hour of an incident is the wrong time to look for phone numbers.
Cybersecurity Services
