Small Business Security on a $0 Budget

#1 Bitwarden — Free Password Manager (10 minutes)

Here is a stat that still surprises me every time I hear it: the average person reuses the same password across 13 different accounts. Thirteen. When one of those sites gets breached — and one of them will — attackers try those credentials everywhere. Your bank. Your email. Your accounting software.

Bitwarden's free tier does everything a small business needs: unlimited password storage, a strong password generator, and sync across all your devices. It takes about 10 minutes to install, and frankly, if you do nothing else on this list, do this one. The browser extension is particularly useful — it auto-fills credentials so you don't have to type them, which also means it won't fill them on a phishing page that looks like your bank but isn't.

#2 Cloudflare — Free CDN + DDoS Protection + Basic WAF (30 minutes)

Cloudflare's free plan is genuinely remarkable for what it costs (nothing). You point your domain's nameservers at Cloudflare, and suddenly your website sits behind the same infrastructure that protects multinational banks. DDoS attacks get absorbed. Basic SQL injection and cross-site scripting attempts get blocked. Bots that scan for vulnerabilities get rate-limited.

The setup is five clicks and a DNS change. The only gotcha is that you need to be careful about your SSL settings — set it to "Full (strict)" mode, not just "Full." The difference is that "Full (strict)" validates certificates end-to-end, while plain "Full" accepts self-signed certificates, which defeats the purpose.

#3 Windows Defender + Automatic Updates (Built-in, 5 minutes)

When I started doing security consulting, I assumed every small business at least had their computers updating automatically. I was wrong. About a third of the businesses I visited had updates deferred indefinitely because "they interrupted work" or "broke an old piece of accounting software." Some were running builds of Windows from three years ago.

Windows Defender (the antivirus built into Windows) scored as well as paid alternatives in the last three years of independent AV testing. The key is making sure it's actually turned on and signatures are updating. Settings → Windows Security → Virus & threat protection. While you are there, set Windows Update to install security patches automatically. Not "notify me." Automatically. The inconvenience of a restart is nothing compared to the inconvenience of ransomware.

#4 Have I Been Pwned — Domain Monitoring (Free, 1 minute to sign up)

Troy Hunt's Have I Been Pwned is the closest thing the security world has to a public service hero. Sign up for domain monitoring (free), and HIBP will email you whenever any email address on your domain appears in a data breach. You would be amazed how often this happens — and how early the warning comes relative to public disclosure.

I have a story about this. A small law firm I worked with signed up for HIBP monitoring on a Friday. Monday morning they got an alert: their managing partner's email had appeared in a breach of a legal research platform. They forced a password reset, turned on MFA, and moved on. Two months later, another law firm in the same city was hit with a BEC attack that started with credentials from the exact same breach. They lost $140,000. The difference between the two firms? One read an email alert.

#5 Google Workspace / M365 Admin Console (Included, 20 minutes)

You are already paying for this — use it. Both Google and Microsoft include security features in their business plans that most small companies never turn on. At minimum:

• Enforce MFA for all users. Both platforms let you require it globally. Do this before anything else.
• Review third-party app access. Every app your employees have ever connected with their work account shows up here. Revoke everything you don't recognize. You will be surprised how many entries there are.
• Set up alerts for suspicious logins. Impossible travel (login from New York then Tokyo an hour later), multiple failed attempts, logins from unusual locations — both platforms can email you when these happen.

#6 VeraCrypt — Free Disk Encryption (20 minutes per computer)

Windows BitLocker and macOS FileVault handle full-disk encryption on most modern computers. But if you have any older machines without TPM chips, or you need to encrypt USB drives and external hard drives, VeraCrypt is the go-to free tool. It is the open-source successor to TrueCrypt and has been independently audited.

#7 UptimeRobot — Free Website Monitoring

Knowing your website is down before your customers tell you is a basic business requirement. UptimeRobot's free plan monitors one URL every five minutes and alerts you by email if it goes down. It is not a security tool per se, but downtime is often the first sign of a security incident — especially with DDoS attacks or defacements.

What I Would Skip

Not every free security tool is worth the install. VPN services that advertise "military-grade encryption" are mostly marketing. Free antivirus scanners beyond Windows Defender add complexity without adding protection. "Free dark web scans" are usually upsell funnels for identity theft protection. And please, for the love of everything, do not install browser extensions that promise to "speed up your PC" or "clean your registry." Those are malware delivery vehicles, not security tools.

The Math

Total cost for this stack: $0. Total time to set up everything: about two hours, spread across a week. The most expensive part is the discipline to keep doing it — checking HIBP alerts, reviewing third-party app access quarterly, making sure automatic updates are still actually automatic. The tools are free. The habits take work.