How to secure small business computers without an IT team
By Jean Luc Poitier, SEO and growth marketing strategist · Bitdefender Reviews · Updated October 1, 2026
Most small businesses can cover the basics with tools they already own. The eight steps below cost nothing beyond time, and they close the doors attackers use most: stolen passwords, unpatched software, users with admin rights, and no working backup.
The hard part is keeping it up. Settings drift, laptops miss updates, and nobody notices until something breaks. The last section covers when paying for central endpoint security starts to make sense.
The small business security checklist
1. List every device and account
Write down each laptop, desktop, server, and phone that touches company data, who uses it, and its operating system version. Do the same for admin accounts. A spreadsheet is enough. You can't protect a machine you forgot about, and the old PC under the front desk is usually the one that gets hit.
2. Turn on the protection Windows already has
Windows 10 and 11 include Microsoft Defender Antivirus. On each PC, open Windows Security and check that real-time protection, cloud-delivered protection, and tamper protection are on, and that the firewall is on for every network type. Turn on controlled folder access if your software tolerates it; it blocks unknown programs from changing files in protected folders, which is what ransomware does.
3. Patch on a schedule
Set Windows Update to install automatically and restart outside working hours. Then do the part that gets skipped: browsers, PDF readers, Java, and line-of-business apps. Attackers exploit holes in those apps as well as in Windows. Check once a month that every device on your list is current, and retire anything that no longer gets security updates.
4. Take away everyday admin rights
Give staff standard user accounts and keep one separate admin account for installing software. With User Account Control on, malware a user opens runs with that user's limited rights. This is free and blocks a lot.
5. Require multi-factor authentication
Turn on MFA for email, the Microsoft 365 or Google Workspace admin, banking, payroll, and remote access. Stolen passwords are one of the most common ways in, and MFA stops most of those logins. An authenticator app is stronger than text-message codes.
6. Encrypt laptops
Turn on BitLocker on Windows Pro laptops and FileVault on Macs, and store the recovery keys somewhere other than the laptop. A lost encrypted laptop is a hardware cost; an unencrypted one can be a reportable data breach.
7. Back up, and test the restore
Keep at least one backup copy offline or immutable, where ransomware on your network can't reach it, and one copy off site. Once a quarter, restore a real folder to prove the backup works.
8. Teach the two habits that matter
Staff should report odd emails instead of clicking, and should call to confirm any request to change payment details. The FTC's small business cybersecurity guide and CISA's Cyber Essentials have free material you can hand out.
Doing it by hand vs a managed endpoint security tool
| Compared on | By hand (built-in tools) | Central endpoint security |
|---|---|---|
| Cost | Free, plus your time | From $34.99/yr for 1 device (GravityZone Small Business Security) |
| Where settings live | On each PC | One policy in a web console, pushed to every device |
| Knowing a PC is unprotected | Only if you check it | The console flags it |
| Third-party patching | Manual, app by app | Add-on in most suites (Patch Management for GravityZone) |
| Ransomware recovery | Restore from backup | Some products roll back encrypted files; you still need backups |
| Macs and servers | Different tools per platform | One agent family and one console |
Figures checked against each company's published pages and review-platform listings as of 2026-10-01. “Not published” means the company does not publish that figure.
When the checklist stops being enough
The checklist works while one person can keep it in their head. Past ten or so devices, or once staff work from home, the gaps are usually in the follow-through: a laptop that hasn't checked in for a month, an exclusion someone added and forgot. That is the job a central console does.
Bitdefender GravityZone is one way to get there. It puts every Windows, Mac, and Linux device under one cloud console, and its entry package includes ransomware rollback and anti-exploit protection. In AV-Comparatives' business tests from 2023 to 2025 it was compromised 3 times in 2,901 attack cases. The trade-off reviewers name most is setup: the console has a learning curve, and support can be slow. Read what 110+ users say or start a free trial.
If you already pay for Microsoft 365 Business Premium, check Defender for Business first; you may already own it.
Small business computer security FAQ
Is Windows Defender enough for a small business?+
For a handful of PCs, with the settings above turned on and someone checking them, it is a reasonable baseline. Its limits are management: each PC is configured separately, there is no central view of alerts, and no one is told when a machine stops updating. Microsoft sells central management as Defender for Business.
How much does endpoint security cost for a small business?+
Bitdefender's entry package, GravityZone Small Business Security, lists at $34.99/yr for 1 device (checked 2026-09-30). Competitors price per device or per user; our comparison pages list their published prices.
When should a small business pay for endpoint security?+
When nobody has time to check every machine by hand, when you have more than about ten devices, when you handle regulated data, or when your cyber insurer or a customer asks for managed endpoint protection.
What do I need for cyber insurance?+
Insurers' questionnaires vary, but they commonly ask about MFA, offline backups, patching, and endpoint protection or EDR on every device. Doing the steps on this page covers most of the common questions.