Cybersecurity basics founders should fund first

Cybersecurity basics for startups are the few controls you pay for first because they block the attacks that close early companies: phishing, stolen passwords, unpatched software, and missing backups. Fancy frameworks can wait. Funded basics cannot.

This post ranks what to buy and enforce in early paid-customer months of serious customer data or paid access. It is orientation for operators, not a penetration test.

Cybersecurity basics for startups: fund these controls first

CISA tells small and medium businesses to start with four essentials: teach people to avoid phishing, require strong passwords, require multifactor authentication, and update business software (CISA, Secure Your Business, checkedOn 2026-11-01).

Scene: a five-person team turns on MFA for Google Workspace admins on Monday, rolls a firm secret store on Wednesday, and runs a single-folder restore drill on Friday. That week beats a sixty-page policy nobody funded.

Refuse to buy a "security suite" before those five rows are green. Suites do not replace missing MFA.

Make MFA mandatory, not optional

CISA recommends requiring multifactor authentication wherever possible, starting with admin accounts and people who handle sensitive data, and preferring phishing-resistant methods when available (CISA, Require Multifactor Authentication, checkedOn 2026-11-01).

Turn MFA on for email, cloud admin consoles, code hosts, and finance systems first. Those four open the rest of the firm if stolen.

Prefer authenticator apps or security keys over SMS if the product allows it. SMS is better than nothing and weaker than app-based or key-based methods on CISA's own ordering.

Verify enrollment weekly for month one. Mandates that rely on faith leave gaps for new hires and phone upgrades.

Write a break-glass rule for lost phones: who can reset MFA, how identity is checked, and how the reset is logged. Without that rule, founders open accounts over chat and erase the audit trail.

Scene: finance MFA fails on a travel day; the break-glass owner verifies identity on a video call, resets the factor, and writes the ticket number in the same hour. No private DM resets.

Count MFA coverage as a percentage of accounts that can touch customer data. Publish the number in the weekly ops note until it stays at 100 for a month.

Pay for unique secrets the firm can revoke

CISA asks businesses to require strong passwords that are long (at least 16 characters), random, and unique, and notes that a company-wide password manager makes those habits realistic (CISA, Require Strong Passwords, checkedOn 2026-11-01).

Fund a firm-owned place for secrets in week one of paid customers. Personal browser saved passwords do not survive a stolen laptop cleanly.

Nautis Credentials Vault is one option for shared logins with access control (Credentials Vault). Whatever product you pick, the funded outcome is the same: unique secrets, known owners, and a revoke path.

Kill shared "team@" logins for production systems. One reused mailbox password becomes the incident write-up.

When a contractor leaves, revoke vault items the same day as chat access. Delayed revokes are unpaid risk.

Patch software on a boring schedule

Outdated software is a common entry path. CISA lists updating business software among the four essentials and separately urges small businesses to patch and to prioritize vulnerabilities that attackers already exploit (CISA, Secure Your Business; CISA Cyber Guidance for Small Businesses, checkedOn 2026-11-01).

Turn on automatic updates for operating systems and browsers on every work laptop. Manual "I'll do it Sunday" queues fail during launches.

Inventory admin-facing cloud admin consoles once a month: which products still exist, who is admin, and whether MFA is on. Orphan admin accounts outlive the people who created them.

CISA Known Exploited Vulnerabilities catalog triage

CISA's Known Exploited Vulnerabilities catalog (KEV) lists security flaws that agencies and researchers have seen used in real attacks (CISA, Known Exploited Vulnerabilities catalog, checkedOn 2026-11-01). CISA's small-business guidance also urges teams to prioritize those items when patching (CISA Cyber Guidance for Small Businesses, checkedOn 2026-11-01). Even a tiny firm can skim catalog titles monthly and ask whether any listed product sits in the environment.

Remove local admin rights from day-to-day laptop users if you can. CISA notes that malware installs get easier when every user can install anything (CISA Cyber Guidance for Small Businesses, checkedOn 2026-11-01).

Keep a short exception list for people who truly need local admin, with an expiry date on each exception. Permanent exceptions become the silent majority.

Patch routers and meeting-room devices on the same calendar as laptops. Forgotten hardware on the office network is still your problem.

Backups you have restored, not only scheduled

CISA describes backups as secure copies stored separately from primary systems and recommends the 3-2-1 pattern: three copies, two media types, one off-site, plus tests of full and partial restores (CISA, Back Up Business Data, checkedOn 2026-11-01).

List the systems that would stop revenue if wiped: source code, customer database, email, billing, and the identity provider. Back those first.

Schedule automatic backups. Then schedule a restore drill. An untested backup is a hope file.

Keep at least one copy offline or immutable so ransomware that hits the live disk cannot encrypt every replica in one pass.

Write the restore owner and the last drill date on a short status page the founding team can see. Hidden backup dashboards do not help at 2 a.m.

Scene: the restore drill restores one customer project database into a scratch environment in under an hour. The write-up lists what broke and who owns the fix. Untimed drills do not count.

Fund immutable or offline copies before you fund decorative SIEM trials. Recovery beats detection if the team is five people.

Restore RTO note

Write the target hours to restore email and the billing system. If the drill overshoots that target, fund runbook fixes ahead of new monitoring seats.

Encrypt portable devices and shrink the blast radius

CISA guidance for small businesses includes enabling disk encryption on laptops because lost and stolen devices are common (CISA Cyber Guidance for Small Businesses, checkedOn 2026-11-01).

Turn on full-disk encryption for every work laptop before the first customer dataset lands on it. Modern OS tools usually make this a settings change, not a new purchase.

Separate admin accounts from daily browsing accounts on the machines that can change production. One browser session should not hold both social tabs and root cloud keys.

Limit who can export the full customer list. Exports are how "we only use trusted people" becomes a CSV on a cafe laptop.

If a device is lost, have a wipe path ready: who calls the vendor, who rotates vault secrets, who notifies counsel if personal data may be exposed.

Label work devices in a simple inventory: owner, serial, encryption on or off, last check-in. Inventories built during an incident are too late.

Laptop intake checklist

Before a new laptop joins email, confirm disk encryption, auto-update, MFA on the identity account, and removal of personal admin where policy requires it. Intake beats cleanup after the first phishing week.

Refuse to store production exports on personal machines. If an export is required, put it in a company-controlled folder with an expiry.

Fund the basics before polished security decks

Buy training that people finish, not posters. A thirty-minute phishing lesson with a report button beats a unread PDF.

Skip annual "maturity model" slideware until MFA, vault, patching, backup drills, and disk encryption are live. Polished security decks consume budget that should buy licenses and security keys.

Revisit spend each quarter with three numbers: percent of accounts with MFA, days since last restore drill, and open admin accounts without unique owners. Those numbers decide the next purchase.

Add a fourth if you have contractors: days since the last access review. Access reviews catch the account that should have ended with the contract.

If a supplier pitches "AI threat hunting" before your MFA coverage is complete, park the pitch. Hunting without locks is entertainment.

Train people to report phishing to a real inbox that a human reads the same day. Reporting without response teaches people to stop reporting.

Phishing report SLA

Acknowledge every report within one business day, even if it is a false alarm. Silence trains people to forward scams to friends instead of to security.

Keep a tiny tally of report types for a month: fake invoice, fake login, fake shipping. The tallest bar tells you which example to use in the next short training.

For shared login storage workflows, see Credentials Vault. Plan limits live on pricing. Nautis does not replace your laptop disk encryption, OS patching, backup product, or identity-provider MFA.

Fund ladder review

Each month, walk the fund-order table top to bottom. Any red row blocks spending on rows below it. That rule stops boutique monitoring while MFA is still optional.

Publish a short spend note: what you funded this month, what you refused, and which metric moved. Refused spend is a feature when basics are incomplete.

Incident hour card

Print a single-page card with: who declares an incident, who talks to customers, who rotates secrets, and where the restore runbook lives. Tape it where the team already looks. Searching Notion during an outage wastes the opening hour.

Supplier onboarding gate

New suppliers that touch customer data must show MFA on their admin path ahead of pasting production secrets into them. A sales deck is not a control.

If a supplier cannot support MFA on admin seats, park the evaluation. Your funded basics are not optional for their convenience.

Cybersecurity basics for startups stay boring on purpose. Boring controls, funded early, are what keep a small team in business after a bad click.