Ask most business owners what cybersecurity means and you'll hear the same three things: antivirus, a firewall and a strong password. Those matter, but together they're really just one layer. Attackers only need one gap, and a single layer leaves plenty of them.
At Tech Plus Consulting, we protect Oakland, San Francisco and East Bay businesses with 20–100 employees. Here are the 10 layers we put in place, and why each one matters.
What it really takes: 10 layers of protection
1. Multi-factor authentication (MFA)
MFA on email, cloud apps and remote access stops the vast majority of account takeovers. If you do nothing else, start here.
2. Managed EDR with a 24/7 SOC
Endpoint detection and response (EDR) watches every laptop and server for suspicious behavior. A security operations center (SOC) has people reviewing alerts around the clock, so threats get stopped at 2 a.m., not discovered Monday morning.
3. Patching and updates
Most attacks use known vulnerabilities that already have a fix. Fast, automated patching for operating systems and apps closes those doors.
4. Email and phishing protection
Advanced email filtering plus SPF, DKIM and DMARC records block malicious messages and keep attackers from impersonating your domain.
5. Security awareness training
Phishing simulations and short, regular training help your team spot the emails that slip past filters.
6. Backups you've actually tested
Backups only help if they work. Keep copies offline or immutable, and test restores on a schedule so you know recovery is possible.
7. An offboarding kill switch
When someone leaves, every account should shut off at once. Automation tied to your HR system removes access in minutes. Read more in our employee offboarding checklist.
8. Secure Wi-Fi and network
Separate networks for staff, guests and devices, a business-grade firewall and properly configured access points keep one compromised device from reaching everything else.
9. AI and data-sharing policies
Your team is already using AI tools. Clear policies on what data can be shared, plus approved tools, protect client and company information.
10. Cyber insurance controls
Carriers now require specific controls before they'll write a policy. Meeting them protects you twice: fewer incidents, and coverage that pays out when you need it. See the 8 questions on almost every cyber insurance form.
Why layers matter
No single tool stops every attack. Layers mean that when one control misses something, the next one catches it. A phishing email that gets past the filter meets a trained employee. A stolen password meets MFA. Ransomware that lands on a laptop meets EDR and a 24/7 SOC, and if all else fails, tested backups get you running again.
How many layers do you have today?
Count honestly. Most small businesses we meet have three or four of these in place. The good news is that the rest can usually be added in weeks, often for a predictable monthly cost.
Frequently asked questions
Is antivirus enough for a small business?
No. Traditional antivirus misses many modern attacks. Managed EDR with 24/7 monitoring is now the baseline most carriers expect.
Which layer should we add first?
MFA on email and cloud apps. It's fast to deploy and blocks the most common attacks.
How do we know which layers we're missing?
Start with an assessment. Our free IT scorecard rates your environment in green, yellow and red so you can see the gaps at a glance.
Get your free IT scorecard
Tech Plus is a white-glove managed security and managed IT provider in Oakland. We'll show you how many of the 10 layers you have in place today, and what to do next. Let's Talk →
