Last week's post put a real number on the cost of doing nothing: somewhere between $15,000 and $200,000 for most organizations reading this, once an incident actually happens. This post is about the other side of that comparison. What does a few thousand dollars a year of prevention actually buy, and in what order should you spend it?
The numbers below assume an organization of about 15 people with a similar number of devices. Scale them up or down with your headcount, but keep the sequence. The order matters more than the exact dollar amount, because each step is meaningfully less useful without the one before it.
Pricing reflects typical published small-business list prices as of fall 2026, and vendor pricing changes often, so confirm current rates before you buy. The plan below fits inside $5,000 using entry-tier options at each step, and entry tier is enough to get started. Higher tiers add admin controls and features worth having, but they are upgrades, not prerequisites. Choosing them can push the first three steps to about $3,800 a year and the total past $5,000. That is a reasonable second-year decision, and it is exactly the kind of decision the step 4 review is meant to inform.
Password reuse across personal and work accounts is still one of the most common ways attackers get in, and it is invisible to leadership until it causes a problem. A business password manager gives every employee a unique, strong password for every account without requiring them to remember any of it, and gives you visibility into which accounts are weak or reused.
Team-tier plans from providers like Bitwarden run roughly $4 per user per month. Business-tier plans from providers like 1Password run higher, around $9 per user per month, with more admin controls. For an organization of 15 people, that is a range of roughly $60 to $135 a month, or about $720 to $1,620 a year depending on tier.
- Pick a business-tier password manager and enroll every employee, not just the ones who ask for it.
- Turn on the admin dashboard's weak and reused password report during setup; most platforms include this by default.
- Make enrollment part of onboarding for every new hire from this point forward.
This blog's foundational series already covered why backups are the difference between having options during a ransomware incident and having none. The budgeting question is simply: back up everything, or back up what matters?
For a 15-person organization, backing up every single device usually is not necessary or worth the cost. Identify the 8 to 10 devices and systems that actually hold or process critical data (your finance computer, your donor or client database server, key shared drives) and back up those specifically. At roughly $7 to $9 per device per month, that is about $56 to $90 a month, or roughly $670 to $1,080 a year, for the coverage that actually matters.
- List the handful of devices and systems that would be genuinely damaging to lose, not everything your organization owns.
- Set up automated cloud backup for that shorter list, with at least one copy stored somewhere an attacker on your network could not reach.
- Test a restore before you need one. An untested backup is an assumption, not a plan.
MFA and backups close the two biggest doors. This step narrows what gets through the ones that remain. Entry-tier endpoint detection and response (EDR) tools, priced around $2 to $5 per device per month at the budget end of the market, catch malicious activity that antivirus alone misses. Layered with a low-cost security awareness training platform, roughly $0.50 to $1.25 per user per month for streamlined, self-serve options, staff get periodic phishing simulations and short training instead of a once-a-year lecture nobody remembers.
For 15 devices and 15 staff, that combination runs roughly $30 to $75 a month for EDR and $8 to $19 a month for training, or about $450 to $1,125 a year together.
- Choose an entry-tier EDR product sized for small businesses, not an enterprise platform priced for a security operations team you do not have.
- Choose a training platform with short, frequent content and built-in phishing simulations rather than a single annual course.
- Review simulation results quarterly. The point is not to catch people, it is to see whether the gap from the myths post on this blog is closing.
The first three steps close the gaps that account for most successful attacks against organizations like yours, and they are the right place to start regardless of what comes next. But they are also generic. They do not know what your organization specifically holds, which systems would be catastrophic to lose, or where your particular vendor and access risks sit.
The remaining budget, roughly $2,500 of the $5,000 for a 15-person organization at entry-tier pricing, is best spent on an independent review that tells you whether the money above actually went to the right places, and what the next dollar should buy after that. This is the step most small organizations skip, usually because it feels like the most skippable one. It is actually the one that makes sure the other three were not a guess.
Full disclosure: this is a service Defensible Cyber Risk offers. Any qualified, independent assessor who is not also selling you tools will do the job.
- Budget for a structured risk assessment annually, not as a one-time purchase. Post 3 in this series covers why one-time security spending fails.
- Look for a review that produces a prioritized list tied to your actual risk, not a generic checklist or a sales pitch for more tools.
- Use the review to decide what next year's $5,000, or $10,000, should fund.
What five thousand dollars actually buys
None of these four steps are exotic. None require a security team or a six-figure budget. Together they cover the identity risk, the ransomware risk, the human risk, and the blind-spot risk that show up again and again in incidents at organizations this size, for less than the low end of the incident cost range from last week's post.
Where this fits into the bigger picture
Five thousand dollars a year is a real, defensible number, not a rounded-up guess. It is also not a number you spend once. If year one fits inside $5,000 and year two does not, that is not a sign the plan failed. It usually means the review found something worth funding, which is the point of doing it.
The next post in this series covers the specific ways small organizations waste the budget they do allocate, because a well-sequenced plan on paper and a well-executed plan in practice are not automatically the same thing.
- Bitwarden, Business plan pricing (accessed October 2026).
- 1Password, Business pricing (accessed October 2026).
Want help sequencing this for your specific organization?
A 30-day Security Business Review turns this general sequence into a prioritized plan built around your actual systems, data, and risk. No product upsells, no enterprise complexity.
Start a Conversation