Guide to implementing cyber risk strategies: 5 Simple Steps

Guide to Implementing Cyber Risk Strategies: 5 Simple Steps

I started Sentree Systems in 1999. Back then, cybersecurity was basically making sure your antivirus didn't slow down your computer too much and reminding people not to open attachments from strangers. Fast forward to today, July 19, 2026, and the landscape has changed so drastically that I barely recognize the early days. If you’re running a small professional service firm—a law office, an accounting practice, or a consultancy—the stakes have never been higher. Being small no longer makes you invisible; in many cases, it makes you a perfect, low-resistance target for attackers who have industrialized their craft using artificial intelligence.

Over the last 26+ years, I’ve seen businesses run headlong into cyber threats they didn’t even know were lurking. Most of the time, they were trusting their IT provider to "cover everything," only to find out during a crisis that "everything" didn't include a comprehensive risk strategy. In 2026, the gap between generic IT support and true cyber risk management is where most small firms lose their shirts. According to the 2026 Verizon Data Breach Investigations Report, 88% of small business breaches now involve a ransomware component—more than double the rate we see at large enterprises. Attackers know you have less monitoring and fewer safeguards, and they are exploiting that with surgical precision.

That is why I wrote this guide. You don’t need an enterprise-sized budget or a degree in computer science to protect your firm. You need a clear, actionable plan that focuses on the risks most likely to interrupt your business. Let’s cut through the vendor hype and the technical noise and look at how you can build real resilience in five simple steps.

Key Takeaways:

• The Human Factor is Primary: In 2026, the human element is involved in 68% of all breaches. Technology alone cannot save a firm that doesn't train its people to recognize AI-powered threats.
• SMBs are the New Primary Target: Small businesses are now four times more likely to be targeted than large corporations because they often lack sophisticated monitoring tools.
• Downtime is the Real Killer: The average ransomware recovery takes 24 days. For most professional service firms, three weeks of zero billable hours is an existential threat.
• MFA is the Bare Minimum: Multi-factor authentication is no longer an "extra" step; it is the absolute baseline for survival, and passkeys are rapidly becoming the 2026 gold standard.
• Testing is Proof: A backup you haven't successfully restored in the last 30 days is just a collection of hope, not a recovery strategy.

The 2026 Reality: Why Traditional IT Support Isn't Enough

In my experience, the biggest mistake a business owner can make is assuming that because they pay a monthly fee for "managed IT," they are secure. Traditional IT is about uptime—making sure the printers work, the cloud is accessible, and the laptops aren't crashing. Cyber risk management is about survival. It’s about ensuring that even when things go wrong—and they will—your business doesn't fold.

I recently worked with a 15-person accounting firm that had a local IT provider for a decade. The owner was confident. "Kevin," he told me, "we have a firewall, we have antivirus, and my guy says the backups are green every morning." Three weeks later, they were hit with a ransomware strain that specifically targeted their cloud backups first, then encrypted their local servers. When they tried to restore, they found the "green" light on the backup software had been lying for six months; the data was corrupted and unrecoverable. They lost three years of client files. That isn't an IT failure—it's a risk management failure. They had the tools, but they didn't have the strategy to verify those tools were working.

As of 2026, the IBM Cost of a Data Breach Report shows the average cost of a breach for a US-based organization has hit a staggering $10.22 million. While that number is skewed by massive corporations, the cost for a small firm (under 100 employees) still averages roughly $2.9 million when you factor in forensics, legal fees, client notifications, and the devastating loss of productivity. You can’t afford to just "assume it’s covered."

Step 1: Inventory Your "Digital Attic"

I often tell my clients that you cannot protect what you don’t know you have. Most small firms have what I call a "Digital Attic"—a collection of cloud accounts, old servers, forgotten laptops, and "shadow IT" (apps employees use without telling you) that creates a massive attack surface.

In 2026, the #1 entry point for attackers is no longer just stolen passwords; it is the exploitation of vulnerabilities in unpatched or forgotten software. The latest data shows that 31% of breaches start here. To start your strategy, you need a literal list of everything that touches your client data. This includes:

• Managed Devices: Every laptop, tablet, and smartphone that accesses business email.
• Cloud Repositories: Not just OneDrive or Dropbox, but also the niche software you use for case management or billing.
• Third-Party Access: Who else has a key to your house? Your HVAC vendor? Your marketing agency? The 2026 Verizon report shows that third-party breaches have surged by 60% in the last year.
• External-Facing Assets: Your website, your VPN, and any remote desktop tools your team uses to work from home.

I once sat down with a law firm that swore they only had one server. After running a basic discovery scan, we found four "zombie" servers that a former partner had set up years ago and forgotten to turn off. One of them was running an operating system that hadn't seen a security update since the Obama administration. That was the open window an attacker would have used. Inventory is the foundation of every good decision you will make regarding cyber risk.

Step 2: Prioritize Risks (The Risk Matrix)

Once you have your inventory, you’ll likely feel overwhelmed. That’s normal. The goal isn't to fix everything tomorrow; it’s to fix the things that could kill the business by Friday. I use a simple "High Impact / High Likelihood" matrix to help owners decide where to spend their limited security budget.

For a professional service firm, the highest impact risk is usually Account Takeover (ATO) via phishing. If a criminal gets into your O365 or Google Workspace account, they aren't just reading your mail; they are you. They can send invoices to clients with "updated bank details," they can intercept sensitive contracts, and they can plant malware across your entire team. The likelihood of this happening is extremely high—phishing remains the primary entry point for 74% of human-driven breaches in 2026.

Risk Type	Business Impact	Likelihood in 2026	Primary Defense
Ransomware	Extreme (Downtime/Loss)	High (AI-automated)	Immutable Backups + EDR
Phishing / BEC	High (Financial Fraud)	Very High	MFA / Passkeys + Training
Supply Chain Attack	Medium/High (Data Theft)	Rising (48% of breaches)	Vendor Risk Assessments
Insider Threat	Variable	Moderate	Access Control / Logging

When I talk about ROI in cybersecurity, I’m talking about the cost of the defense versus the cost of the disaster. If a $2,000-a-year investment in advanced email filtering and phishing-resistant MFA prevents a $120,000 ransomware recovery, that is a 6,000% return on your investment. In my 27 years, I’ve never seen a business owner regret spending money on prevention after seeing the bill for a recovery.

Step 3: Build Your Defensive Wall (Beyond Antivirus)

If your IT provider is still telling you that "antivirus is enough," it’s time to have a very difficult conversation. Modern attackers don't always use files that antivirus can detect; they use "living off the land" techniques, using your own computer's built-in tools against you. To be resilient in 2026, your defensive wall needs three specific layers:

1. Phishing-Resistant MFA (Passkeys)

Standard SMS codes or even app-based push notifications are being bypassed by "MFA Fatigue" attacks and session hijacking. I’ve seen firms get breached even with MFA on because an employee got tired of the prompts and finally hit "Approve" just to make it go away. In 2026, we are pushing all our clients toward Passkeys (FIDO2). These are hardware-bound credentials that can't be phished or shared. If the attacker doesn't have the physical device or the biometric (face/fingerprint) of the user, they aren't getting in. Period.

2. Endpoint Detection and Response (EDR)

EDR is the 2026 version of antivirus, but it's much smarter. Think of old antivirus like a security guard with a list of known criminals; if a new criminal shows up, the guard lets them in. EDR is like a security guard who watches behavior. If a program that normally just writes Word documents suddenly starts encrypting 5,000 files a minute and trying to talk to a server in Eastern Europe, the EDR shuts it down instantly. I've watched EDR save a 50-person engineering firm from a total wipeout by isolating a single infected laptop before the ransomware could spread to the main server.

3. Network Segmentation

In most small firms, the network is "flat." If you get into one computer, you can get into all of them. I advise my clients to segment their networks. Your guest Wi-Fi shouldn't be able to talk to your billing server. Your receptionist’s computer doesn't need to be able to access the HR files. By creating these internal walls, you ensure that a small fire in one room doesn't burn down the entire building.

Step 4: The Human Layer (AI-Awareness)

In 2026, phishing has undergone a terrifying upgrade thanks to Generative AI. We are no longer looking for misspelled words or weird logos. Scammers now use AI to draft perfectly written, personalized emails that sound exactly like your clients or colleagues. Even worse, AI Voice Cloning is now a reality for small businesses.

I recently helped a firm where the office manager received a phone call from what sounded exactly like the Managing Partner. The "Partner" said he was in a meeting, had lost his wallet, and needed a $15,000 wire transfer for an emergency retainer. The voice was perfect—the cadence, the tone, even the specific slang he used. It was a clone. The only thing that saved them was a policy I helped them implement months prior: Any financial transaction over $5,000 requires a "code word" verification or a face-to-face confirmation, regardless of who is asking.

Employee training in 2026 shouldn't be a boring 45-minute video you watch once a year. It needs to be continuous, bite-sized, and focused on current threats like voice cloning, deepfake video calls, and QR code phishing (quishing). When your team knows what to look for, they become your strongest defense rather than your greatest vulnerability.

Step 5: The Backup "Acid Test"

I say this constantly: A backup is not a backup until you have successfully restored it. I’ve seen too many business owners pay for cloud backup services for years, only to find out during a crisis that the data was never actually being saved, or the encryption keys were lost, or the restoration time was projected to take four weeks.

Your cyber risk strategy must include an "Acid Test" for your backups every 30 to 90 days. This means your IT team should pick a random, critical folder or database and prove they can restore it to a working state within a set amount of time (your Recovery Time Objective, or RTO). If they can't do it in under 4 hours, your strategy is broken. In 2026, we also mandate Immutable Backups—these are backups that cannot be changed or deleted for a set period, even if an attacker gets administrative access to your network. This is your ultimate "Get Out of Jail Free" card against ransomware.

Comparison: Managing Your Risk in 2026

How you implement these steps depends on your size and budget. Here is how I break down the three most common models I see in the field today:

Model	Pros	Cons	Typical Cost (20-person firm)
In-House / DIY	Maximum Control	Extremely difficult to maintain; high risk of "blind spots"	$120k+ (Salary + Tools)
Generic Managed IT (MSP)	Good for uptime/support	Often lacks deep security expertise; "Security" is usually just basic tools	$3k - $5k / Month
Cyber-Focused Managed Security	Expert-led; 24/7 monitoring; focuses on risk, not just tech	Higher monthly investment; requires cultural change	$4k - $7k / Month

In my opinion, for a firm with 10 to 100 employees, the "Cyber-Focused" or "Co-managed" model offers the best ROI. You get a team that does nothing but watch for threats, allowing your local IT guy to focus on keeping the lights on. It removes the "conflict of interest" where the person setting up the network is also the one auditing it for mistakes.

Frequently Asked Questions

Q: Is my business too small for cyber insurance to care about?

A: Absolutely not. In fact, in 2026, cyber insurance carriers have become the primary "policemen" of small business security. If you don't have MFA, EDR, and tested backups, you will either be denied coverage or your premiums will be astronomical. Most small firms pay between $1,500 and $3,500 annually for a $1 million policy, but that price doubles if your security controls are weak.

Q: We use the cloud for everything (Office 365, Clio, Xero). Do we still need backups?

A: Yes! This is a dangerous myth. Cloud providers like Microsoft and Google are responsible for the infrastructure, but you are responsible for the data. If an employee accidentally deletes a folder, or an attacker encrypts your SharePoint, Microsoft generally won't help you get that data back beyond a very short window. You need a third-party cloud-to-cloud backup solution to be truly safe.

Q: How do I know if my current IT provider is actually doing what they say?

A: Ask for proof, not just promises. Ask for a "Restoration Report" showing the last time they successfully tested a data restore. Ask for a "Vulnerability Scan" that shows what software in your office is out of date. If they get defensive or give you vague answers about "it's all handled in the background," that is a major red flag.

Q: What is the most common way small firms are breached in 2026?

A: Business Email Compromise (BEC) fueled by AI. An attacker steals a session token or a password, gets into an executive's email, and watches conversations for weeks. They wait for a large invoice to be mentioned, then step in with a perfectly timed email saying, "Actually, use this new routing number for that payment." Because it comes from the real email account, it’s incredibly effective.

Q: How much should I be spending on cybersecurity?

A: A good rule of thumb in 2026 is that 10% to 15% of your total IT budget should be dedicated specifically to security. If you spend $50,000 a year on IT, and only $500 of that is for a basic antivirus, you are dangerously under-invested. Think of it like insurance: you hope you never need it, but when you do, it's the only thing that matters.

Final Words

I’ve spent 27 years helping small firms navigate these waters,