Most attacks on small businesses aren't sophisticated. They rely on reused passwords, missed updates, and a convincing email.
Turn on two-step sign-in for email and banking. It blocks the vast majority of account takeovers.
Keep automatic updates on for every computer and phone. Schedule restarts after hours.
Back up your important files to a location that isn't connected all the time, and test restoring them.
Teach your team to pause before clicking. A five-minute talk at a staff meeting goes a long way.