People sometimes ask us where a small, real budget should go. Not a fortune - say five hundred pounds - and the answer surprises them, because it is not the exciting kit. If a business handed us that money and asked for the honest order of value, it would be a password manager, then a backup with proper retention, then a test that the backup actually restores. In that order, and rarely spending all of it.

The password manager comes first because passwords are where small businesses quietly bleed. Reused, guessable, or shared over text, they are the way in. A good manager for a small team costs very little a month, ends the reuse, and makes turning on a second sign-in step easy rather than a chore. It is the cheapest change with the widest effect, which is why it leads.

The backup comes second, and the word that matters is retention. A backup that only holds yesterday is no help if a problem started last week and you did not notice until today; a good one lets you go back to before the trouble. This is what turns a ransomware morning from a disaster into an annoyance, and it is worth paying a modest amount to get right.

The third line item is the one everyone skips: a restore test. An untested backup is a hope, not a safeguard, and the worst time to discover it never worked is the day you need it. Actually pulling a file - or a whole system - back from the backup, once, is how you find out the truth while it is still cheap to fix.

Notice what is not on the list: no dramatic appliance, no subscription with a frightening name. Five hundred pounds spent this way protects a small business far better than five thousand spent on things that look impressive and change nothing. Spend on the boring three first, and you will almost certainly have change left over.