No-cost security priorities
- First: Turn on MFA, updates and secure defaults in accounts and devices you already use.
- Then: Check backup coverage with a real restore and document how staff report suspicious requests.
- Free has limits: A no-cost tier may exclude support, administration or eligibility for your business.
- Buy later: Pay only when a named control gap remains after configuration and a pilot.
Last updated: September 24, 2026
A free tool can be valuable, but it still needs an owner, setup time and ongoing review. Start with CISA's SMB essentials: avoid phishing, use strong passwords and MFA, update software, keep useful logs and back up data. The NIST small-business quick-start helps choose what matters for your operations.
Actions that usually cost no new subscription
| Action | Where to start | How to verify |
|---|---|---|
| Enforce MFA | Existing email, cloud, finance and remote-access accounts | Export enrollment and exceptions; test an admin login |
| Use named accounts and unique passwords | Existing identity provider and browser/approved vault | Remove a test user and confirm access ends |
| Patch systems | Operating-system and app update settings you already have | Review update status on representative devices |
| Turn on built-in protections | Existing endpoint and email subscriptions | Confirm policy is assigned and an alert reaches an owner |
| Test backup restore | Existing backup product or provider | Recover a sample file and a critical workload if feasible |
| Practice payment callback | Finance process and known vendor phone records | Simulated bank-detail change stops before transfer |
These are “no incremental license” actions only if the underlying platforms are already paid for. They are not necessarily free to operate. See the password-manager guide, email-security guide and backup strategy for implementation details.
Specific no-cost resources with boundaries
- CISA SMB resources: Guidance and checklists for owners and IT staff. Educational material does not configure or monitor your systems.
- CISA Cyber Hygiene services: No-cost external scanning for eligible organizations, including US public and private critical-infrastructure organizations. Eligibility and enrollment matter; this is not a universal free scan for every SMB. It focuses on internet-facing assets and does not replace internal inventory or patch ownership.
- Valydex assessment: Free browser-local scoring and PDF report without signup. It helps identify priority actions; it is not a penetration test, compliance certification or verification of technical settings. Optional AI sends assessment context only after consent.
- Action1 patch-management allowance: Its documented first-200-endpoints allowance can support a pilot for eligible supported endpoints. Check current terms, OS coverage and free-plan support limits before relying on it. A “free” patching platform still needs a deployment owner and rollback plan.
Avoid downloading random “free security scanners” or granting them broad permissions just because a list ranks them highly. Verify the vendor, data access, update channel and support boundaries first.
A two-week no-cost baseline
- Days 1–2: List administrator accounts, business devices, critical data and current subscriptions. Ask your IT provider what is already included.
- Days 3–5: Enforce MFA on administrators and finance users; review dormant accounts and external access.
- Days 6–8: Check supported devices for updates and built-in protection. Route high-priority alerts to a named person.
- Days 9–11: Restore a sample backup and record time, missing data and ownership.
- Days 12–14: Practice a vendor bank-change callback and an account-compromise response. Re-run the action list for unresolved gaps.
Do not assume a control is complete because a toggle exists. Evidence is a successful test, a policy assignment, a current report or an owner who can act. The SMB toolbox helps decide which remaining gaps warrant paid tools; the budget worksheet uses your actual costs.
When to upgrade
A paid tool may be justified if you cannot centrally manage users, cover the actual devices, get a useful alert, meet recovery objectives or obtain needed support under the no-cost option. Write down the exact plan, seat/device count, term, required administrator time and a pass/fail pilot. Do not upgrade just to replace a free feature that is already working.
Choose your first three actions
Run the free assessment and use the local report to assign owners and verification steps. Work through existing entitlements before comparing products in the tool directory.
Sources checked September 24, 2026: CISA SMB resources, CISA Cyber Hygiene eligibility, NIST SP 1300, and Action1 plan documentation. Tool terms can change; this is source-based guidance, not hands-on testing.