Most small businesses don't fall short on security because they don't care. They fall short because their protection was never designed as one system. Tools got added over time to solve whatever was urgent that month: a new threat here, a client request there.
On paper that can look like solid coverage. In practice it's usually a patchwork: some things overlap, others quietly fall through the cracks. And the gaps don't show up in everyday support. They show up when something slips through and becomes an expensive, disruptive mess. Here are the five layers we most often find missing, and how to close them.
A simpler way to think about coverage
The easiest way to spot gaps is to stop thinking about products and start thinking about outcomes. A widely used framework from NIST (the US standards body) groups security into six plain questions:
- Govern: who owns security decisions, and what counts as standard versus an exception?
- Identify: do you actually know what you're protecting?
- Protect: what's in place to make a break-in less likely?
- Detect: how quickly would you notice something's wrong?
- Respond: who acts, how fast, and how do you communicate?
- Recover: how do you get back to normal and confirm you're there?
Most small businesses are strong on Protect and okay on Identify. The missing layers almost always live in the other four. That's the pattern the five gaps below follow.
1. Phishing-resistant sign-ins
Basic multi-factor authentication, your password plus a second step, is a great start, but it isn't the finish line. The common gap is that it's switched on inconsistently, and some of the methods can still be fooled by a convincing fake login page. Make strong sign-ins mandatory for every account that touches sensitive systems, remove the easy-bypass and outdated options, and add extra checks for unusual logins.
2. A clear standard for which devices you trust
Plenty of businesses manage their computers; far fewer have a written, enforced standard for what makes a device trustworthy, and what happens when one falls short. Set a minimum baseline every device must meet, put the rules for personal devices in writing, and limit access when a device drifts out of line, rather than relying on reminders.
3. Real guardrails on email
Email is still the front door for most attacks. If you're leaning on staff training alone to catch every scam, you're betting on perfect attention every single day. Add built-in safety rails: filtering for risky links and attachments, protection against lookalike sender addresses, and clear labels on outside email. Make reporting a suspicious message easy and judgment-free. Our piece on stopping ransomware early picks up where this leaves off.
4. Patching you can actually prove
"Patching is handled" often really means "patching is attempted." The missing piece is proof: clear visibility into what's missing, what failed, and which exceptions are quietly piling up. Set update deadlines based on how serious each fix is and stick to them, cover the other software you run (not just Windows or macOS), and keep a short list of exceptions so they don't silently become permanent.
5. Knowing what to do when an alert fires
Most setups generate alerts. What's usually missing is a repeatable way to turn an alert into action. Decide the minimum you'll monitor, agree on rules that separate "deal with this now" from "track and review," write simple step-by-step guides for the common situations, and, importantly, test your recovery for real before you need it.
Build a baseline you can trust
Strengthen those five layers and your security stops depending on luck. It becomes a repeatable, measurable baseline. You don't have to do it all at once: start with the weakest layer in your business, make it solid, confirm it's working, then move to the next.
If you'd like a second set of eyes on where your gaps are, that's exactly what we do. We'll assess what you've got, point out what to fix first, and lay out a practical plan without piling on complexity.