3 Proven Tips on How to Prioritize Cyber Risks

I started helping small professional service firms with their technology back in 1999. In those 26-plus years, the most common thing I hear from business owners hasn't changed: "Kevin, I know I need to be secure, but I don't know where to start, and I'm tired of being told that everything is a priority."

I get it. When everything is a priority, nothing is. If you're running a law firm, a boutique accounting practice, or a 30-person engineering shop, you don't have a million-dollar security budget or a 10-man IT department. You have a business to run. But the reality of 2026 is that being "too small to target" is a myth that has put thousands of firms out of business. According to recent 2026 industry data, 43% of all cyberattacks target small businesses, and a staggering 60% of those firms close their doors permanently within six months of a major attack (StationX).

Cybersecurity shouldn't be about buying the newest, shiniest tool. It’s about making smart, risk-based decisions so you can protect your clients and keep your doors open. Today, I’m sharing the three proven tips I use with my own clients to prioritize cyber risks and get the most "security bang" for their buck.

Key Takeaways:

• Prioritize Assets, Not Tools: Security starts by identifying your "Crown Jewels"—client data, financial access, and proprietary processes—not by buying more software.
• Fix the Entry Points First: 2026 data shows that 31% of breaches now start with software vulnerabilities, overtaking stolen credentials as the leading cause of entry (Verizon DBIR 2026).
• Human Resistance is Your Best ROI: Consistent training can reduce your phishing susceptibility by up to 86%, and a tested incident response plan can save you over $232,000 in recovery costs (IBM 2025/2026).
• Compliance is Mandatory: New 2026 FTC guidelines mandate that even small firms must have written security plans and multi-factor authentication (MFA) to meet "reasonable" standards of care.

The Real Cost of Indecision in 2026

Before we dive into the tips, we need to look at the numbers. In my 26 years, I’ve seen breach costs move from a nuisance to an existential threat. The average breach cost for a business with fewer than 500 employees has now hit $3.31 million (IBM). For a 15-person firm, even a "small" incident costing $150,000—the median price for ransomware recovery in 2026—is enough to wipe out a year's profit.

Last year, I got a call at 5:30 AM from a long-time friend who runs a 12-person CPA firm. He was in a panic. An employee had received a deepfake voice memo that sounded exactly like him, authorizing an "emergency" $45,000 wire transfer to a vendor. By the time he called me, the money was gone, and the attackers were already moving laterally through his email system. They didn't target him because he was a global conglomerate; they targeted him because they knew he was busy, relied on trust, and likely hadn't updated his wire transfer protocols in five years. That experience is why prioritization isn't just a technical exercise—it’s a survival strategy.

Tip 1: Map Your "Crown Jewels" (The Digital Inventory)

Most IT providers will start by giving you a list of hardware: 20 laptops, two servers, one firewall. In my experience, that’s the wrong way to look at risk. Criminals don't want your five-year-old Dell laptop; they want what’s inside it.

I advise my clients to perform a "Digital Inventory" focused on three specific categories of assets:

1. Client Personally Identifiable Information (PII)

For professional service firms, your reputation is your primary asset. If you lose client social security numbers, tax records, or legal strategy documents, the trust you spent decades building vanishes in an afternoon. In 2026, the FTC has strengthened its requirements, mandating that any firm handling consumer data must have explicit encryption and access controls in place (FTC).

2. Financial "Keys to the Kingdom"

Who has the authority to move money? Which accounts are linked to your operating capital? I once worked with a 20-person engineering firm that had no "out-of-band" verification for wire transfers. An attacker sat in their email system for 95 days—which is the median "dwell time" before a ransomware strike in 2026 (Verizon 2026)—just watching how they talked to their bank. Map these flows and put a "human-in-the-loop" for any transaction over $5,000.

3. The New Threat: "Shadow AI"

This is a 2026-specific priority. I’ve seen a massive surge in employees using unauthorized generative AI tools to "help" with client work. They paste sensitive client data into public AI models to summarize a meeting or draft a contract. Shadow AI was a factor in 20% of breaches last year, adding an average of $670,000 to the recovery bill (IBM 2025). If you don't know which AI tools your team is using, you have a massive, unprioritized risk.

Tip 2: Target the "Path of Least Resistance" (Vulnerability Assessment)

Once you know what you're protecting, you have to look at how a criminal is going to get to it. For years, we focused almost exclusively on phishing. But in 2026, the game has shifted. For the first time, exploitation of software vulnerabilities (unpatched systems) has surpassed stolen credentials as the leading point of entry, accounting for 31% of all breaches (Verizon 2026).

I sit down with business owners and tell them to look at these three high-risk areas first:

1. The "Edge" Devices

Your VPNs, firewalls, and remote access tools are the front doors to your business. In 2025 and 2026, we’ve seen an eightfold increase in flaws targeting these devices. The median time to patch these is currently 43 days, but attackers are scanning for them within hours of a vulnerability being announced. If you aren't patching your edge devices within 72 hours, you are leaving your front door unlocked.

2. The Identity Layer

Multi-factor authentication (MFA) is no longer a suggestion; it’s a requirement for cyber insurance and regulatory compliance. However, I’ve seen many firms that only have MFA on their email. What about your accounting software? Your CRM? Your file storage? In 2026, attackers are using "session hijacking" to bypass simple MFA. I recommend moving toward phishing-resistant MFA (like hardware keys or biometrics) for your most sensitive accounts.

3. The Human Firewall

Despite the rise in technical exploits, the human element still contributes to 62% of all breaches (Verizon 2026). But here’s the thing: social engineering has evolved. My clients aren't just getting bad emails with typos; they're getting deepfake voice calls and SMS messages (smishing) that have a 40% higher success rate than traditional email phishing. If you're still doing "once-a-year" security training, you're failing. You need monthly, bite-sized simulations that reflect these new 2026 threats.

Tip 3: The 80/20 Rule of Security (Implementation & ROI)

Now we get to the actual work. You have a finite amount of money and time. How do you spend it? I’m a big fan of the 80/20 rule: 80% of your risk can be mitigated by 20% of the available security controls. Here is how I break down the ROI for a typical 25-person firm in 2026:

Security Measure	Estimated Annual Cost (per user)	Potential Loss Mitigated	ROI Multiple
Phishing-Resistant MFA	$10 - $15	$115,000+ (Ransomware)	8.1x
Managed EDR (Security Monitoring)	$15 - $25	$3.31M (Average Breach)	10x+
Employee Awareness Training	$3 - $8	$200,000 (Social Engineering)	7x
Tested Incident Response Plan	Time/Consulting	$232,007 (Recovery Savings)	Infinite

I once consulted for a small engineering firm that refused to pay for a managed security service because it was "too expensive" at $600 a month. Three months later, they were hit by ransomware. They didn't have an incident response plan, so they spent 35 days offline. They lost $150,000 in billable hours and eventually paid a $120,000 recovery fee to a forensics firm. The "expensive" $7,200 annual security service would have detected the intruder on day one. Prevention is always 50 to 60 times cheaper than recovery (StationX 2026).

The "Kevin Mabry" Simple Risk Assessment

If you're feeling overwhelmed, I want you to take 15 minutes this afternoon and answer these four questions. This isn't a technical audit; it’s a business audit.

1. If we couldn't access our main server or cloud drive for three days, what is the dollar amount we would lose in billable time? (This is your "downtime risk.")
2. Who are the three employees most likely to be targeted for a wire transfer or payroll fraud? (This is your "human risk.")
3. Do we have a backup that is "immutable" (cannot be deleted or encrypted by a hacker)? (This is your "survival insurance.")
4. When was the last time we actually practiced restoring from those backups? (In my experience, 40% of small business backups fail when you actually need them.)

"Cybersecurity should help you make better decisions—not bury you in technical noise."

I’ve watched firms lose everything because they assumed their "IT guy" had it covered. But generic IT support is not the same as security. One manages your productivity; the other manages your risk. In 2026, you need both.

Frequently Asked Questions

Q: Is cyber insurance worth it for a small firm in 2026?

A: Yes, but only if you actually meet their requirements. In 2026, insurance companies have become incredibly strict. If you claim to have MFA on your application but didn't have it on a single remote-access point, they can—and will—deny your claim. Treat your insurance policy as a security checklist, not just a safety net.

Q: What is the most common way small businesses get hit today?

A: It’s a tie between vulnerability exploitation (unpatched software) and credential theft. However, AI-powered phishing is the fastest-growing threat. Attackers now use AI to scrape your LinkedIn profile and draft an email that looks exactly like something your partner or a major client would write.

Q: How much should a firm with 20 employees spend on security?

A: On average, companies spend about 0.7% of their total revenue on cybersecurity. For a firm doing $5 million in revenue, that’s about $35,000 a year. If you’re spending less than that, you’re likely taking on significant unmanaged risk that could cost you millions later.

Q: Does NIST 2.0 apply to my small business?

A: Yes. The NIST Cybersecurity Framework 2.0 was specifically updated recently to include small businesses and even non-employer firms (NIST). It provides a great roadmap: Identify, Protect, Detect, Respond, and Recover. If you follow those five steps, you’re ahead of 90% of your peers.

Conclusion

Prioritizing cyber risk isn't about being perfect; it's about being difficult to hit. Criminals are looking for the low-hanging fruit—the firms with no MFA, unpatched VPNs, and untrained staff. By identifying your crown jewels, closing the most obvious entry points, and training your team to spot the new AI-driven threats of 2026, you move your business out of the "easy target" category.

Remember, I’ve been doing this since 1999. I’ve seen the technologies change, but the solution remains the same: Focus on the risks most likely to interrupt your business. Tackle one step at a time. If you need help figuring out which step is first for your specific firm, let's talk. You don't have to navigate this digital minefield alone.