When we look at a small business for the first time, the same handful of gaps come up again and again, and most of them close with tools that are already free. The reason they are still open is rarely money. It is that nobody set aside the hour, or nobody knew the setting existed. So here is the list we hand people, in the order we would do it.

Start with the account that owns everything else, which is usually email. Turn on the free authenticator app that comes with your provider, so a password on its own is no longer enough to get in. Add a recovery method you control. Then turn on the built-in phishing and malware filtering that Microsoft and Google both include and that a surprising number of businesses have never switched on.

Next, the devices. Windows Defender and the built-in Mac protection are genuinely good now, so the paid antivirus you are still renewing is often money you can stop spending. Turn on automatic updates and full-disk encryption, both free and both off by default on plenty of the machines we see. A free password manager for the team removes the reused-password problem that sits behind most of the break-ins we investigate.

None of this is glamorous, and none of it takes special skill. It is an afternoon, a checklist and a bit of stubbornness about finishing. The eleven items below are the ones that give the most protection for the least effort, and they are the ones we would want done before we talked to you about spending anything at all.