Small business security software, for a team under twenty, is a minimalism exercise: the budget is real, the attention is scarcer than the budget, and every product added is a product someone must watch. The minimum that works is smaller than the market suggests and more specific: three paid layers, endpoint protection, backup, and a password manager, two free controls, multi-factor authentication and enforced updates, and two written sentences that outperform any additional spend. Everything else, the dedicated mail gateway, the monitoring service, the compliance platform, is a justified addition for some firms and a default for none. This guide draws the minimum precisely: what each piece costs at licensed list prices, the honest monthly total for a ten-person firm, the signals that justify each addition beyond the minimum, and the free half every stack silently depends on.
The three paid layers and the arithmetic
Endpoint protection on every machine: Microsoft Defender for Business lists at $3.00 per user per month paid yearly, CrowdStrike Falcon Go at $59.99 per device billed annually, and either anchors the layer for a small fleet. Backup for the systems that matter, priced per machine or per gigabyte monthly. A password manager, priced per user monthly in the low single dollars, and worth it entirely for making unique credentials survivable. For a ten-person firm the three layers land in the low hundreds of dollars a month combined, a figure worth writing next to the cost of one ransomware week or one redirected invoice, which is the comparison the budget conversation deserves.
The two free controls, and why they outrank spending
Multi-factor authentication on mail, banking and anything remote is configuration, not purchase, and it neutralises the stolen-password event that drives most small-firm catastrophes. Enforced updates, the operating system's own mechanism switched from optional to required, closes the known holes attackers scan for. Free is not a metaphor: both controls cost login sessions and a policy sentence. A firm that buys the three layers and skips these two has bought a stack with its foundation missing, which is the commonest configuration failure the small-business market produces.
Signals that justify additions, and the paper floor
Add a dedicated mail security product when money moves on emailed instructions at volume or impersonation attempts become visible. Add monitored detection when the firm reaches the size where nobody would notice a compromised account for a weekend. Add compliance tooling when a client questionnaire or regulation names it. Until each signal fires, the minimum plus attention beats the maximum unattended. And beneath every configuration sits the paper floor: the access rules, the payment confirmation sentence, the leaver's checklist, the update policy, counted into a set by the free sheet on this site, generated with review dates by Hardenvo Pro, and costing drafting hours priced at your own figure rather than another subscription.
Questions people ask about small business security software
What is the minimum security software for a small business?
Three paid layers, endpoint protection (list anchors: $3.00 per user per month, or $59.99 per device per year on the licensed pages here), restore-tested backup, and a password manager, plus two free controls: multi-factor authentication and enforced updates.
How much should a ten-person business budget?
Low hundreds of dollars monthly for the three paid layers combined, plus drafting hours for the written set. Compare against one ransomware week or one redirected invoice; that is the budget conversation in one line.
When should a small business buy more than the minimum?
On signals: visible impersonation attempts or money moving on emailed instructions (add mail security), growth past the size where a compromised account would go unnoticed for a weekend (add monitoring), or a client questionnaire naming a requirement (add exactly that).