Help Clients Reduce Cyber Risks Without Breaking the Budget

• October 12, 2026

By Courtney Hans

Data breaches making headlines typically involve large, well-known companies, but small businesses account for a disproportionate number of cybercriminal targets. Ninety-six percent of ransomware victims last year were small and medium-sized businesses, according to Verizon’s “2026 Data Breach Investigations Report.”

Threat actors assume small businesses don’t have robust security resources, making them an easy target. However, small businesses don’t need a six-figure security budget to practice preventive cybersecurity hygiene, and knowledgeable insurance agents can help clients improve their security posture while securing effective, economical cyber coverage.

Cyber risk presents a valuable opportunity for brokers and agents to demonstrate their expertise as trusted risk management partners. Because security is contextual and should serve the business, agents must understand each client’s operations before recommending controls. They can then suggest practical, budget-friendly defenses that support growth, protect assets and improve eligibility for favorable policy pricing and coverage.

Providing a checklist can help clients pursue a more favorable cyber policy, but it shouldn’t be one-size-fits-all. Agents should recommend high impact controls that reduce risk for the least cost, working with the client’s existing technology and operational considerations.

Here are four control categories that can be implemented pragmatically and cost-effectively:

1) Identity protection. Turn on multifactor authentication (MFA) everywhere you can. Most software and cloud services provide the option or the requirement to enforce MFA for all logins. A typical third-party MFA service costs around $2 per user per month.

In today’s threat landscape, it’s critical to have phishing-proof MFA in place for remote access, email, privileged account access and any system holding confidential info or personally identifiable information (PII). Best practice is to turn it on for every user and every system.

Password managers are another cost-effective tool.Stolen credentials remain a top cyberattack vector. A password manager stores passwords in a zero-knowledge environment, helps create strong, complex passwords, and removes users’ mental burden.

Browser-based password managers such as Chrome or Edge are preferable to reusing passwords, but dedicated managers reduce attack surface and may detect weak or reused passwords and provide dark-web exposure notifications. Many offer free tiers, while paid family or enterprise plans remain affordable. Password managers can also manage passkeys, an even more robust MFA mechanism.

2) Endpoints and email. Businesses can take advantage of security features built right into platforms.

Platform-native security features. Both Windows and macOS offer built-in security features, either enabled by default or through simple user or IT security manager activation. Windows devices include Defender antivirus, Windows Firewall and automatic updates, which are enabled by default.

Users can further strengthen defenses by enabling hard-drive encryption BitLocker, Windows Hello biometrics, and passkeys for supported websites and platforms.

Similarly, macOS users benefit from native tools, including XProtect malware protection, automatic security updates and Touch ID. They should also enable FileVault, a disk encryption program, Firewall and Lockdown Mode. Advising clients to review operating system tools helps ensure they maximize existing protections.

Email programs also include built-in features. Both Google and Microsoft offer robust, modern email security protection through their business platforms. Talk with your clients to understand their license level and utilization of available security features to determine the most suitable platform. Some insurance carriers also offer email security reviews to assist clients with their readiness.

And with nearly all cyber insurance applications asking about endpoint security for laptops, desktops, servers and cell phones, implementing endpoint detection and response (EDR) technology is essential for preferential terms in the open market—to say nothing of guarding vulnerable endpoints against devastating ransomware. Endpoint protection can start as low as $5 per endpoint per month.

3) Business recovery. One of the most effective ways to deny leverage to a threat actor who’s deployed ransomware is to have offline, air-gapped—the industry term for physically isolated—and tested backups. Though the cost of a backup strategy is variable, even a small investment can pay off in protective value.

An incident response plan is also crucial. Many insurance carriers offer assistance or review of a company’s incident response plan. Ensuring your client has a plan is a strategic way to support a positive outcome if an incident occurs and to demonstrate operational resiliency when marketing an account to multiple carriers.

4) Security-conscious culture. Credential theft remains a leading cause of compromise. Regular security awareness training can equip employees with the knowledge required to spot attempts to extort credentials, access and data.

Training is an incredibly cost-efficient mechanism to strengthen defenses and build a strong security culture within a client’s operations. This can be done internally, with an external consultant, or through a training platform. Many cyber insurance carriers offer training as part of a policy, so it’s always worth investigating the service offerings of an insurance carrier.

Agents who lead with practical, budget-conscious guidance will become the trusted partner their clients call first, before an incident even happens.

Courtney Hans is vice president of cyber services at AmTrustCyber.