Most small companies think security is a budget problem. It usually isn't. Almost everything I find comes down to the same four things, and none of them require a security team to fix.

1. Email is the front door, and it's unlocked.

Not sophisticated malware. An invoice that looks real, sent from a domain one character off from a supplier you actually use. If you have no SPF, DKIM, and DMARC records set up, anyone on the internet can send email that looks like it came from you. That's a 30-minute fix that most companies have never done.

2. The person who left six months ago still has access.

Ex-employees, old contractors, a shared login for a tool nobody uses anymore. Every account that exists and shouldn't is a way in that nobody is watching. Pull a list of every user in your email, your cloud, and your main tools right now. I'd bet money there are names on it that surprise you.

3. Something is exposed that you forgot you built.

A staging site from a rebuild two years ago. An admin panel on a subdomain. A database port open to the whole internet because someone was debugging. Attackers scan for these constantly, and they don't care how big you are, they care what's reachable.

4. Nobody has ever practiced.

The first time you think about what to do during a breach should not be during a breach. Who cuts access. Who calls the clients. Who talks to the insurer. Ten minutes writing that down beats any tool you could buy.

The reason this stuff sits unfixed isn't cost. It's that nobody owns it. In a 5 to 50 person company, security is everyone's job, which means it's nobody's, until a client sends a security questionnaire or something actually goes wrong.

If you want to check yourself against this list: pull your user list, look up your domain's DMARC record, and write down every subdomain you can remember. That's an honest hour and you'll learn more about your exposure than most tools will tell you.

If you'd rather someone just do it properly, that's what I do at Nathans protek.

I run external security audits for companies with no in-house security team. Same three things come up over and over, and none of them need a budget to fix.

1. An admin account nobody owns anymore

Someone left 14 months ago. Their email is disabled, but their account in the billing portal, the DNS registrar, or the CRM is still active, still admin, still using the password they picked in 2021. Nobody disabled it because nobody knew it existed.

Fix: list every system that has a login. Not just the ones IT manages, all of them. Then check who has admin on each. Most owners find at least one ghost.

2. The domain registrar has no 2FA

Companies lock down email and forget the registrar. If someone takes your domain, they take your email, your password resets, and your site. It is the single highest-leverage account you own and it is usually protected by one password.

Fix: turn on 2FA at your registrar today. It takes four minutes.

3. Reused passwords already sitting in breach data

Staff reuse a work password on some random service, that service gets breached, and the credentials end up in a dump that attackers search by company domain. The password still works on your systems because nobody rotated it.

Fix: search your domain in a breach database. If anything shows up, rotate those accounts and turn on 2FA.

None of that requires hiring anyone. Do those three and you have closed the paths most small companies actually get hit through.

If you want an outside look at what is publicly exposed about your company, I do a free check. You give me a domain, I send back what I find ranked by severity, and I tell you honestly if a paid audit would be a waste of your money.

I keep seeing the same pattern when we audit companies with no security hire.

The website looks fine. The SaaS stack looks modern. Then we find a former contractor still in Google Workspace, a production database exposed to the internet, or the same admin password on three tools.

Attackers do not need zero-days for that. They need a password dump and twenty minutes.

If you do not have someone whose job is to look for this, you do not have a security program. You have hope.

A useful first pass is ugly and specific: list every tool that holds customer data, who still has admin, and what is reachable from the public internet. That list is more valuable than a policy PDF.

That is the work we do at Nathans Protek. Audits for companies that cannot staff a team yet. A retainer if you want someone watching after the report.