Cybersecurity for Small Business 2026: 10 Steps That Actually Work

In 2025, CERT-UA recorded 4,300+ cyber incidents — 1,400 of them hit small businesses and sole traders. Not Ukrtelecom. Not Naftogaz. Small companies with no dedicated IT staff, run by owners who figure there’s nothing worth stealing.

There’s plenty worth stealing: money in a Monobank Business account, a customer database in Google Sheets, access to Diia (Ukraine’s digital government ID and services app). The war isn’t only on the front line. Russian APT groups — Sandworm, APT28, Gamaredon — have been systematically targeting Ukrainian infrastructure since 2022. Small businesses aren’t their primary target, but they’re an excellent stepping stone to larger systems.

The good news: 80% of successful attacks on Ukrainian SMBs could have been stopped with basic measures. No big budget. No IT department.

# Why Ukrainian small businesses get attacked more than corporations

Because you’re an easy target with real money. A major bank spends tens of millions of hryvnias a year on security — it has a SIEM, a SOC, a Red Team. You have one laptop, a shared inbox, and your accountant’s password is “1234qwer”.

According to CERT-UA’s 2025 report, the average loss from a successful cyberattack on an SMB was UAH 85,000 in direct costs — plus 3–7 days of downtime, unhappy clients, and reputational damage. Ransomware encrypts every file and demands payment. Phishing steals banking login credentials. And attackers don’t check in advance whether you’re a sole trader or an LLC with 500 employees.

The war adds another layer. Since February 2022, targeted attacks on Ukrainian businesses have grown 3.4x, per SSSCIP data. Some are direct sabotage. Others are data theft for blackmail or resale. This isn’t paranoia — it’s simply the Ukrainian reality of 2026.

# Steps 1–2: Two-factor authentication and a password manager

Step 1 — 2FA cuts account breach risk by 99.9%, according to Microsoft Security 2024. That’s not a marketing claim; it’s drawn from 1.2 billion accounts.

Enable 2FA everywhere: Gmail, Google Workspace, Privatbank Business, Monobank (Ukraine’s largest digital bank), Diia, your hosting panel, your CRM. For TOTP codes, use Google Authenticator or Authy — SMS codes are weaker and can be intercepted via SIM-swapping. In Privatbank Business, 2FA is under Settings → Security and takes four minutes. In Monobank — Settings → Login Confirmation. There’s no reason not to do this today.

Step 2 — a password manager for your team. I asked three small-business owners in Kyiv about this. All three had staff storing passwords in phone notes or a shared Google Doc. That’s not security; that’s a disaster waiting to happen.

1Password Teams costs around $3 per user per month — roughly UAH 120 at the current rate. Bitwarden Business is $5/month, open-source, and can be self-hosted. For teams under 5 people, Bitwarden Free is enough. A password manager does three things: generates unique, complex passwords; stores them encrypted; and never auto-fills on a phishing site — because the domain won’t match.

Here’s a real example. An LLC with 8 employees (packaging manufacturer, Kharkiv) lost access to Google Workspace in October 2025 after a manager’s account was breached — password: “Kh@rkiv2022”. Recovery took 11 days. The owner then rolled out 1Password for UAH 960 per month across the team. “That’s cheaper than one lost order,” he said.

# Steps 3–4: Backups and software updates

Step 3 — the 3-2-1 backup rule. Three copies of your data, on two different media types, one stored off-site. For an SMB that means: working files in Google Drive with auto-sync + a weekly export to an external drive + a monthly archive in Backblaze ($7/month, roughly UAH 280).

This is especially urgent if you work with client databases in Excel or 1C (a widely used accounting platform in Ukraine and Eastern Europe). Ransomware — 340+ confirmed cases in the Ukrainian SMB segment in 2025 alone — encrypts every file, including connected drives. If your backup drive is permanently attached, it gets encrypted too. At least one copy must be offline or in a cloud storage with versioning. Google Drive keeps version history for 30 days on the free plan.

Step 4 — software updates. Boring, but 60% of successful ransomware attacks exploit vulnerabilities in unpatched Windows or Microsoft Office, per the Veeam Ransomware Trends Report 2025. Enable automatic updates for Windows, Office 365, your browser, and antivirus. On macOS: System Settings → General → Software Update → Automatic. That’s 2 clicks and a 5-minute restart.

# Steps 5–6: Phishing protection — email and messengers

Phishing is the top threat for Ukrainian SMBs in 2026. CERT-UA data shows 62% of incidents started there. An email looks like a notification from Ukraine’s tax authority (ДПС), Diia, or Privatbank — and links to a fake site.

Step 5 — set up DMARC, SPF, and DKIM on your domain. These are three DNS records that tell mail servers: “Only these IP addresses are authorized to send email from our domain.” Without them, fraudsters can send phishing emails to your clients using your company name. Setup is done through your hosting control panel (Timeweb, Ukraine.com.ua, NIC.UA) and takes about 20 minutes. Check the result for free at MXToolbox.com.

Step 6 — block malicious links. Google Workspace Enterprise includes Safe Links, which checks every URL before it opens. Cloudflare Gateway (free plan) blocks known phishing and malware domains at the DNS level for your entire office network. Setup takes 15 minutes: change your router’s DNS servers to 1.1.1.2 and 1.0.0.2.

What about Telegram? Phishing there spreads through fake channels and “official bots” impersonating banks. One rule: no bank, tax authority, or government app ever asks for your password or OTP code in a messenger. Ever. If a bot asks — it’s fraud.

# Steps 7–8: Wi-Fi, VPN, and network segmentation

Step 7 — secure your Wi-Fi. If your office has one router and it connects work laptops, a courier’s phone, and a client’s tablet, that’s a single network. Compromise any device on it and an attacker can see all traffic. The fix is simple: create a Guest Network in your router settings. ASUS, TP-Link, and Mikrotik routers all have this option in the standard menu. A guest network is isolated — devices on it can’t see each other or the main network.

Use WPA3 encryption. If your router doesn’t support it, it’s time to upgrade. A solid Mikrotik hAP ac3 costs around UAH 2,800 and will last 5–7 years.

Step 8 — VPN for remote staff. When an employee works from a café or coworking space, their traffic is visible to everyone on that Wi-Fi network. A VPN encrypts the connection. ProtonVPN Plus is $10/month and works in Ukraine without restrictions. Mullvad is €5/month and accepts anonymous crypto payments. For teams with up to 5 remote employees, a ProtonVPN Business account ($8/user) covers it.

Honest caveat: VPN doesn’t replace the other steps. It’s an encrypted tunnel, not a magic shield. A weak password and no 2FA still leaves the door open, tunnel or not.

# Steps 9–10: Access policy and an incident response plan

Step 9 — least-privilege access. Every employee should access only the data and systems their role actually requires. Your accountant doesn’t need to see the CRM. Your sales manager doesn’t need delete rights on the server. This isn’t excessive caution — it’s the ISO 27001 standard.

In practice: open Google Workspace Admin Console → Users and check who has super-admin rights. There should be at most 2. In your CRM (Bitrix24, Pipedrive, Salesforce) configure roles by function. When an employee leaves — delete their account on the day they go. In my experience working with 6 clients over the past year, 4 of the 6 had former employees with active access to company systems for over a week after departure. That’s a direct threat.

Step 10 — an incident response plan. This is the most underrated step. When something happens — and eventually it will — you need a written document: who calls whom, which systems to shut down, where to report the incident (CERT-UA: [email protected], phone +380 44 281-88-25), and how to restore data from backup.

One page. No technical jargon. Printed and kept in a desk drawer — because during an attack, the computer may be locked. It takes two hours to write once. It can save weeks of downtime.

# What minimum cybersecurity costs for an SMB

Honest answer: the baseline is nearly free — if you invest time rather than money.

The most expensive part of cybersecurity isn’t the tools. It’s the time to configure everything and train your team. Budget 4–8 hours upfront to work through all 10 steps with your people.

Separate consideration: cyber insurance. In Ukraine it’s available through ARX, PZU Ukraine, and UNIKA. A policy for an SMB with annual turnover up to UAH 5 million costs UAH 4,000–15,000 per year and covers legal costs from a data breach, client notification, system recovery expenses, and partial compensation for downtime. It’s not a substitute for technical measures — but it’s a solid financial safety net for when things go wrong anyway.

# See also

• Business insurance and financial risk protection
• Business interruption insurance Ukraine 2026
• Best VPN for Ukraine 2026
• AI agents for business 2026

Subscribe to Kompanion — practical guides for small business owners, once a week, no corporate filler. Next up: how to set up a registered cash register (ПРРО) securely without running afoul of Ukraine’s tax authority.