Small businesses are targeted precisely because attackers assume their defenses are thin. The good news: the measures that stop the vast majority of attacks are affordable and well understood.
Multi-factor authentication is the single highest-value control — it defeats the credential theft behind most breaches. Endpoint detection and response comes next, because every laptop is now a perimeter. DNS filtering blocks malicious sites before a connection is made.
Behind the tools sit two habits: patching promptly, and backing up in a way you've actually tested. A backup you've never restored is a hope, not a plan.
Finally, train your people. Most incidents begin with a click, and short, regular awareness training measurably reduces the click rate. Security is a system — tools, habits, and people together.