Most incidents aren't sophisticated
Small businesses rarely get hit by elaborate, targeted attacks — they get hit by the same handful of ordinary problems, repeatedly: a reused password that leaked somewhere else, a phishing email that looks convincing enough, a former contractor who still has access, a website plugin that never got updated. None of that requires a sophisticated attacker. It just requires one of the basics being skipped.
The fundamentals worth doing first
Set up proper email authentication (SPF, DKIM, DMARC) so it's harder for someone to impersonate your domain in a phishing email. Use a password manager and unique passwords instead of variations on the same one. Turn on two-factor authentication everywhere it's offered, especially email, domain registrar, and hosting accounts — those three are the keys to everything else. Keep real, working backups of anything you can't afford to lose, and actually test that they restore. Remove access for anyone who no longer needs it, on a schedule, not just when you remember to.
These aren't expensive. They're mostly a few hours of setup and a habit of reviewing access periodically — the kind of thing that's easy to postpone until it's the reason something went wrong.
What this looks like in practice
One real security review of a production application found that role-based navigation was hiding pages from users without actually restricting access to them at the route level — the kind of gap that's invisible until someone checks for it directly. Most of what keeps a small business safe isn't dramatic. It's a short list of fundamentals, done consistently, and checked occasionally by someone who knows what to look for.