iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Small businesses need eight practical controls to withstand AI-assisted phishing, impersonation and ransomware: phishing-resistant multifactor authentication (MFA), unique passwords in a managed vault, prompt patching, protected endpoints and networks, tested backups, encryption with least-privilege access, recurring anti-fraud training, and an exercised incident-response plan. Put MFA on email, finance, payroll, cloud, VPN and administrator accounts first, then build the remaining controls in stages. This baseline addresses the attacks that generative AI makes cheaper and more convincing, without requiring a large security department.
The urgency is measurable. The FBI Internet Crime Complaint Center recorded 22,364 AI-related complaints and $893,346,472 in adjusted losses in 2025. In the UK, 50% of small businesses said they had identified a breach or attack in the previous 12 months, and 42% reported phishing. Canada’s national assessment warns that chatbots can write convincing phishing and that generative AI enables realistic audio and visual impersonation.
Why is AI changing the cybersecurity risk for a small business?
Generative AI lets criminals produce tailored messages, fake invoices and convincing conversations at a scale that used to require teams of fraudsters. A message can mirror a supplier’s writing style, refer to a real project and arrive at the moment an employee expects a payment request. Voice cloning and synthetic video add credibility when an attacker calls or joins a meeting.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesAI does not replace ordinary security weaknesses; it exploits them faster. A reused password, an unpatched internet-facing device or an unverified bank-change request can become the entry point for account takeover, ransomware or business-email compromise. The FBI’s 2025 complaint and loss figures show the financial impact of AI-enabled crime, while the UK survey demonstrates that phishing remains a common practical threat rather than a hypothetical one.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Use the controls below as a baseline. “Cybersecurity is a continuous process,” the National Institute of Standards and Technology (NIST) says; treat each control as something to maintain, test and improve rather than a one-time purchase.
What should a small business do first?
Start with identity and recovery. MFA blocks many stolen-password attacks, while an isolated, tested backup gives you a route back from ransomware. Then close the common technical gaps and establish a way for staff to challenge suspicious requests.
- Within the first week: require MFA on email, administrator, finance, payroll, cloud-storage and VPN accounts; disable former users; and verify that backups exist.
- Within 30 days: deploy a password vault, turn on automatic updates where safe, inventory devices and software, harden routers and Wi-Fi, and enable endpoint protection.
- Within 60 days: encrypt laptops and removable media, review access by role, run anti-phishing and payment-verification training, and document an incident-response plan.
- At least quarterly: test backup restoration, run a short simulation, review logs and access, and update contacts and procedures.
Keep a simple control register with an owner, implementation date, evidence (such as a policy or test result), and next review date. That record helps an owner see what is actually working and helps an insurer, responder or regulator understand your baseline after an incident.
How do I deploy phishing-resistant MFA everywhere?
Require MFA for email, cloud applications, finance and payroll systems, VPN, remote administration and every administrator account. Prefer passkeys or FIDO2 security keys, which verify the legitimate site or service and resist fake login pages; use an authenticator app when those options are unavailable.
Implementation steps
- List every account and service that can access company data or money, including owner, contractor and vendor accounts.
- Turn on MFA in the service’s security or identity settings. Enforce it through the administrator console where the service supports a company-wide policy.
- Register two authenticators for each critical user (for example, a primary passkey and a stored security key) and place recovery codes in a protected offline location.
- Block legacy sign-in methods that bypass MFA, such as older mail protocols, unless a documented exception has compensating controls.
- Tell staff never to approve an unexpected push prompt. They should report it and contact the help channel if a prompt repeats.
- For an urgent payment, password reset or bank-detail change, confirm the request through a known telephone number or separate conversation, not by replying to the original message.
The Federal Trade Commission lists authenticator codes, USB hardware tokens and smartcards as MFA methods. NIST specifically recommends phishing-resistant MFA. A USB FIDO2 security key can be useful where the operating system, browser and account support it; check compatibility before purchase and keep a spare under controlled custody.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How to compare MFA options
| Option | Resistance to fake sign-in pages | Operational considerations |
|---|---|---|
| Passkey or FIDO2 security key | High; the credential is bound to the legitimate service | Requires supported browsers and services; provide a recovery key or second device |
| Authenticator-app code | Better than password-only, but a user can still be tricked into typing a code into a phishing site | Works on many services; protect the phone and recovery process |
| SMS code | Lower; exposed to number-porting and interception risks | Use only when stronger methods are unavailable, and monitor account-recovery changes |
How should we manage passwords and account access?
Give every service a long, unique password and store it in a managed password vault protected by MFA. Never reuse a password between work, personal and administrative accounts. A vault reduces the temptation to keep credentials in spreadsheets, browsers shared by several people or email.
Set up the vault safely
- Choose a business-oriented vault with separate user accounts, administrator controls, audit history and secure sharing.
- Require MFA for the vault itself and for any recovery administrator.
- Generate unique passwords for each service; use long passphrases where a generated password is not practical.
- Store recovery codes in a sealed, access-controlled location separate from the vault’s normal login.
- Review shared credentials monthly and remove access immediately when an employee, contractor or vendor leaves.
- Rotate credentials after suspected exposure, a staff departure involving privileged access, or a vendor incident.
Keep an inventory of service owners and recovery contacts. A password vault does not replace MFA, patching or access reviews; it makes those controls easier to apply consistently.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How do patching and software inventory stop common attacks?
Update operating systems, browsers, routers, security software and business applications promptly. Attackers routinely target known vulnerabilities, especially on internet-facing equipment. Automatic updates are appropriate for many endpoints, but critical systems still need a maintenance window and a rollback plan.
A workable patch process
- Inventory every laptop, phone, server, router, cloud application and remote-access tool, recording owner, version, support status and internet exposure.
- Enable automatic updates for supported operating systems, browsers and applications where business testing permits.
- Prioritize vulnerabilities that are actively exploited, expose an internet-facing service or affect administrator tools.
- Test important updates on a representative device, then deploy them to the remaining fleet and record completion.
- Replace or isolate unsupported software. If replacement cannot be immediate, remove internet exposure and apply vendor mitigations.
- Scan or review update status weekly for critical systems and monthly for the full inventory.
FTC, NIST and Canadian guidance all identify timely patching as foundational. Do not assume a cloud service is automatically safe: review its security notices, administrator settings and connected applications.
How do I protect endpoints, email and the business network?
Use supported antivirus or endpoint detection, harden routers, separate guest Wi-Fi, disable unnecessary remote administration and watch for unusual activity. These measures reduce the chance that one compromised laptop becomes access to every system.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Endpoint checklist
- Install centrally managed endpoint protection on supported computers and servers; alert on malware, suspicious scripts and disabled protection.
- Turn on device firewalls, screen locks and automatic encryption where available.
- Remove local administrator rights from ordinary accounts and provide a controlled process for approved installations.
- Disable autorun for removable media and restrict unapproved software and browser extensions.
- Keep email filtering and attachment scanning enabled, but train staff that filters are not proof a message is safe.
Network checklist
- Use WPA2 or WPA3 encryption with a strong, unique router password; change default administrator credentials.
- Put visitors and unmanaged devices on a separate guest network from business systems.
- Disable remote router administration unless it is required, then restrict it to trusted addresses and MFA-protected accounts.
- Update router firmware and review connected-device lists for unfamiliar equipment.
- Log administrator sign-ins, VPN connections and major configuration changes; investigate unusual locations or times.
The FTC recommends router hardening, encrypted wireless networking, device protection and network monitoring. A small business may use a managed security provider when it cannot review alerts reliably, but responsibility for approving access and responding to warnings must remain clearly assigned.
How should backups be designed and tested for ransomware?
Back up critical files, databases and system configurations on a schedule tied to how much work the business can afford to lose. Keep at least one copy disconnected or otherwise isolated from the production network, and prove that restoration works. A backup that ransomware can encrypt is not a dependable recovery plan.
Choose recovery targets
| Business question | Target to define | Example decision |
|---|---|---|
| How much recent work can we lose? | Recovery point objective (RPO) | If losing one hour is acceptable, back up at least hourly; a daily schedule permits up to a day of loss |
| How quickly must service return? | Recovery time objective (RTO) | A payroll system needed the next morning requires a faster, prioritized restore than an archive |
| Can attackers reach the backup? | Isolation and credential separation | Keep an offline, air-gapped or immutable copy with separate credentials |
Backup procedure
- Classify systems and data by business impact, legal obligation and restoration order.
- Configure automatic, continuous or frequent backups as appropriate; include cloud data, endpoint files and configuration records.
- Maintain at least one disconnected or air-gapped copy. An encrypted external backup drive must be disconnected or otherwise isolated when it is not actively backing up.
- Protect backup administration with MFA, separate accounts and least privilege.
- Test a file restore monthly and a full system or application recovery at least quarterly, recording elapsed time and failures.
- After each test, fix missing credentials, incompatible software, corrupted media or unclear ownership and repeat the test.
CISA recommends automatic, continuous backups with an air-gapped copy; FTC and Canadian guidance also emphasize protected, regular backups. Cloud synchronization alone is not a backup if it instantly synchronizes encrypted or deleted files.
How do encryption and least privilege limit damage?
Encrypt data on laptops, phones, removable media and cloud stores, and encrypt it in transit. Then limit each employee, contractor and vendor to the data and actions required for the job. If an account is compromised, these controls reduce what the attacker can read or change.
Access review actions
- Map roles such as sales, payroll, finance and administration to the applications and data each role needs.
- Use separate administrator accounts; do not browse email or the web from a privileged account.
- Require approval for new access and an expiration date for temporary vendor or contractor access.
- Review group memberships, shared links, API keys and service accounts at least quarterly.
- Revoke sessions, tokens, keys and device access immediately when a user leaves or a device is lost.
Encryption protects lost devices and intercepted traffic, but it does not stop an authorized user from misusing data. Least privilege, logging and prompt offboarding address that gap. CISA describes need-to-know permissions as a core safeguard, and FTC guidance recommends both encryption and access limitation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
How can staff recognize AI phishing, deepfakes and payment fraud?
Run short, recurring training that covers email, SMS, voice, video and invoice scenarios. Teach a verification behavior rather than relying on a list of suspicious words: pause, use a known contact method, and confirm any unusual request involving money, credentials or sensitive data.
Rules employees can use immediately
- Do not open an unexpected attachment or sign in through a message link; navigate to the known service directly.
- Treat urgency, secrecy, threats and last-minute account or payment changes as reasons to verify, not reasons to hurry.
- Confirm wire transfers, payroll changes, gift-card requests and new bank details through a separate, trusted channel.
- For a voice or video request from an executive or supplier, call a known number or ask a pre-agreed verification question.
- Report suspected phishing even when no link was clicked; early reporting can protect coworkers and suppliers.
Make training measurable
Deliver a five- to ten-minute lesson monthly, followed by realistic simulations that do not shame people. Track completion, reporting time and whether staff use the second-channel procedure. Refresh scenarios when the business changes payment systems, suppliers or remote-work practices. FTC and Canadian guidance call for awareness training, while FBI and Canadian assessments document AI-generated text, voice and visual impersonation.
What should an incident-response plan contain, and how do I exercise it?
Write down who makes decisions, how to contain an intrusion, how to preserve evidence and how to restore operations. NIST SP 800-61 Revision 3 provides current, Cybersecurity Framework 2.0-aligned response guidance; CISA advises maintaining and exercising response and recovery procedures.
Plan contents
- Authority: name an incident lead, deputies and a decision-maker who can shut down systems or halt payments.
- Contacts: list internal leaders, IT support, legal counsel, cyber-insurance carrier, bank fraud team, key vendors, law enforcement and regulators relevant to your location and data.
- Detection and triage: define what counts as an incident, where reports go and how severity is assigned.
- Containment: document how to isolate a device, disable an account, revoke sessions, block a domain and preserve volatile evidence without destroying it.
- Communication: prepare customer, employee, supplier and regulator messages; identify who may speak publicly.
- Recovery: specify restore order, clean-device requirements, password resets, validation checks and a return-to-service approver.
- Improvement: record causes, timeline, decisions and corrective actions after every event or exercise.
Ransomware first response
- Disconnect affected computers and network segments from wired and wireless networks, but do not immediately wipe or power off systems that may contain evidence unless safety requires it.
- Call the incident lead and IT responder using the plan’s out-of-band contact method.
- Disable compromised accounts and remote access; preserve logs, ransom notes, timestamps and suspicious email.
- Notify the insurer, legal adviser, law enforcement and relevant regulators according to policy and jurisdiction.
- Identify clean backups and restore only after the entry point is contained and credentials are reset.
- Document decisions, downtime, affected data and communications throughout the response.
Run a tabletop exercise at least twice a year: one for ransomware and one for business-email compromise or a deepfake payment request. Measure how long it takes to reach the decision-maker, isolate a test account, locate an unaltered backup and approve a customer message. Use the gaps found to update the plan.
How should I compare implementation choices?
Choose the option that can be operated consistently, not the one with the longest feature list. Compare each control against the business outcome it must deliver.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
| Control | Comparison criteria | Evidence to request |
|---|---|---|
| MFA | Phishing resistance, recovery process and coverage of all critical services | Enforcement report, supported authenticators and exception list |
| Backups | RPO, RTO, isolation, retention and restoration testing | Recent restore log and proof that backup credentials are separate |
| Patching and endpoints | Automatic coverage, visibility, supported platforms and alert response | Asset inventory, patch-age report and unresolved-alert queue |
| Identity and access | Least-privilege support, approvals, offboarding and audit history | Quarterly access review and terminated-user checklist |
| Training | Completion, reporting behavior and quality of simulations | Attendance, report rates and remediation records |
| Incident response | External response capacity, evidence handling and tested recovery | Exercise after-action report, contact test and recovery timeline |
There is no universal small-business cybersecurity budget or guaranteed percentage reduction in risk. Spend first where a failure would stop operations or move money: identity, backups, payment verification and administrator access. Reassess as headcount, suppliers, regulations and the value of stored data change.
What does a sustainable security routine look like?
Assign a named owner to each control and put recurring checks on the calendar. Weekly, review critical alerts, backup status and newly disclosed high-impact vulnerabilities. Monthly, check MFA coverage, patch age, endpoint health, new users and leavers, and training completion. Quarterly, restore data, review privileged access, inspect router and cloud settings, and run an incident exercise. Annually, update risk priorities, contacts, insurance details, supplier assurances and the recovery sequence.
CISA’s practical message is simple: “Make MFA a policy—not a preference.” The FTC likewise warns that cybercriminals target companies of all sizes. A documented routine turns those principles into habits that continue after the initial setup.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Frequently Asked Questions
Can a small business rely on email spam filtering to stop AI phishing?
No. Filtering can remove known malicious messages, but AI-generated mail may be new, personalized and technically clean. Keep filtering enabled and pair it with MFA, direct sign-in instead of message links, and mandatory second-channel verification for money or credential requests.
Should cyber insurance replace security controls?
No. Insurers commonly ask about MFA, backups, patching and response procedures, and a claim can be affected by missing or inaccurate controls. Treat insurance as financial support after an incident, while the eight controls reduce the likelihood and size of the loss.
How often should a small business change every password?
Routine forced changes can encourage predictable passwords. Use unique passwords and MFA, then change a credential when it is exposed, when a privileged user leaves, after a suspected compromise, or when a service requires it; review the vault and privileged accounts on a schedule.
What evidence should we keep to prove our controls work?
Retain MFA-enforcement reports, asset and patch inventories, backup and restore logs, access reviews, training records, incident exercises and corrective-action dates. Store the evidence where an incident cannot destroy it, and limit access to the people who need it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
