Author: Sid Engel

Most businesses pick a Microsoft 365 plan from the price list. Do people need desktop Word and Excel? Then buy the cheapest plan that has them. That gets the productivity part right and skips the part that matters most on a bad day.

This guide breaks down Microsoft 365 Business Basic, Standard, and Premium: what each one includes, why the jump from Standard to Premium is about security and evidence rather than apps, and why we now treat Business Premium as the starting point for most small businesses.

Key Takeaways

• As of July 2026, Business Premium costs $22 per user per month, $8 more than Standard (Microsoft, 2026).
• Basic vs Standard is about apps. Standard vs Premium is about who can sign in, from where, and on what device.
• Without Premium, detailed sign-in logs last only 7 days, and upgrading later won’t bring them back.

Which Microsoft 365 Business Plan Should a Small Business Choose?

In July 2026, Microsoft raised Business Basic to $7 and Business Standard to $14 per user per month, while Business Premium stayed at $22, according to its Microsoft 365 pricing and packaging update. For any business that handles money or client data, Premium should be the default. The cheaper plans are fine as deliberate exceptions.

All three plans top out at 300 users. For a small business, the choice is never about size. It’s about what you get.

What’s the Difference Between Business Basic and Business Standard?

The gap between Basic and Standard is $7 per user per month after Microsoft’s 2026 update, and it buys one thing: the installed desktop apps. Basic users work in a browser and on a phone. Standard users get full Word, Excel, and Outlook on their computers. It’s a productivity choice, not a security one.

Basic works for someone who mostly reads email, joins Teams calls, and opens the occasional shared file. Standard fits anyone who lives in spreadsheets or builds real documents all day. That’s most office staff.

The 2026 update did give both plans a little more protection, including checking links when someone clicks them. But identity and device controls still sit one tier up.

What Does Business Premium Add Over Business Standard?

Identity-based attacks rose 32% in the first half of 2025, according to Microsoft’s Microsoft Digital Defense Report 2025. Premium is built around that problem. It uses the same apps as Standard. What you’re paying for is control over who gets into your accounts, from where, and on what device.

Per Microsoft’s Business Premium security FAQ, Premium adds four main pieces:

• Microsoft Entra ID P1 (Conditional Access). Rules about how people sign in, not just whether the password is right. Block sign-ins from other countries, shut off sign-in methods attackers abuse, or only allow company laptops to open company files. It builds on multi-factor authentication instead of replacing it.
• Microsoft Intune. Set security rules on laptops and phones and wipe company data off a lost device. It’s the tool behind mobile device management in most Microsoft offices.
• Defender for Office 365 Plan 1. Opens suspicious attachments in a safe sandbox first and flags emails pretending to be your owner or a vendor.
• Defender for Business. Endpoint protection with detection and response for your computers.

Microsoft 365 Business Premium costs $22 per user per month in 2026 and includes Microsoft Entra ID P1, Intune, Defender for Business, and Defender for Office 365 Plan 1. Business Standard includes none of those. The apps are identical, so the $8 difference pays entirely for identity, device, and threat protection.

Microsoft 365 Log Retention: Why 7 Days Isn’t Enough

The average breach took 241 days to identify and contain in 2025, according to IBM’s Cost of a Data Breach Report. Microsoft 365 Business plans without Premium keep detailed sign-in logs for just 7 days. Well before the average breach is contained, the record of how the attacker got in is gone.

Basic and Standard come with the free tier of Microsoft Entra ID, the system that handles sign-ins. Per Microsoft’s Entra data retention documentation, that tier keeps sign-in and directory audit logs for 7 days. Premium’s Entra ID P1 keeps them for 30 days and lets you export them for longer storage.

To be fair, every business plan includes Microsoft’s unified audit log, which keeps 180 days of activity like mailbox access and file changes. It shows what happened inside an account. The sign-in logs show how someone got into it, and that’s what tells you whether the hole is closed.

We saw this firsthand on an account compromise we worked this fall. An attacker used a phishing trick that got around MFA, then quietly read the mailbox for months.

On the client’s plan, the detailed sign-in logs only covered the last 7 days, so most of the timeline had to be pieced together from the less detailed audit log, and the start of the attack predated even that. We could prove what the attacker did, but never pin down exactly when they first got in.

The trick was device code phishing, a technique Microsoft’s own threat researchers documented in 2025. Microsoft’s guidance is to block that sign-in method with Conditional Access. That’s a Premium feature, so the rule that would have stopped this exact attack was never available.

Here’s the catch: log retention isn’t retroactive. Microsoft’s documentation says so directly. Upgrade today and you get 30 days of history starting now, not the month you needed. If a mailbox takeover like business email compromise worries you, the logs have to be collecting before it happens. (If it already has, start with our guide on what to do after a cyberattack.)

Is Microsoft 365 Business Premium Worth the Cost?

In 2025, Verizon’s Data Breach Investigations Report SMB Snapshot found ransomware in 88% of small and mid-sized business breaches, compared with 39% at larger organizations. When a small business does get breached, ransomware is usually part of it. Next to that, $8 per user per month is cheap. For a 10-person office, Premium costs $960 a year more than Standard.

Compare that to a single incident. The FBI’s 2025 Internet Crime Report counted more than $3 billion in reported business email compromise losses. Even a small case means hours of investigation, password resets, and calls to clients and your bank.

There’s one trap worth naming: paying for Premium and never turning anything on. None of these features configure themselves. A Premium license on default settings is mostly an expensive Standard license, which is why who manages your Microsoft 365 matters as much as which plan you buy.

When Business Basic or Standard Is Still Enough

You can mix Basic, Standard, and Premium licenses in one Microsoft 365 account, so not everyone needs the same plan. A seasonal worker who only needs email on a phone can live on Basic. A shared mailbox or room calendar usually needs no license at all.

The thing to watch: Microsoft licenses Premium’s protections per person. Anyone who handles money, client information, or admin access should be on Premium. Everyone else is a judgment call.

Not sure what plan your business is on, or whether the Premium features you’re paying for are actually turned on? A short conversation is an easy way to find out where you stand. Reach out to Engel Tech and we’ll take a look.

Frequently Asked Questions

Is Microsoft 365 Business Premium worth it for a small business?

For most businesses that handle money or client data, yes. As of July 2026, Premium costs $22 per user per month, $8 more than Standard. That buys sign-in controls, device management, stronger email protection, and 30 days of sign-in logs instead of 7.

What’s the difference between Microsoft 365 Business Basic and Business Standard?

Business Basic ($7 per user per month in 2026) includes email, Teams, OneDrive, SharePoint, and web and mobile Office apps. Business Standard ($14) adds the full desktop apps like Word, Excel, and Outlook. Their security features are nearly identical.

How long does Microsoft 365 keep sign-in logs?

On Business Basic and Standard, Microsoft Entra keeps sign-in and directory audit logs for 7 days. Business Premium includes Entra ID P1, which keeps them for 30 days. All business plans keep the unified audit log, covering mailbox and file activity, for 180 days.

Do I have to migrate anything to upgrade to Business Premium?

No. Moving from Basic or Standard to Premium is a license change in the admin center, and email, files, and settings stay put. Just remember that upgrading only starts the 30-day log window from that day. It doesn’t recover the 7-day logs that already expired.

Does Business Premium replace my antivirus?

It can. Business Premium includes Microsoft Defender for Business, which adds detection and response to endpoint protection. Some businesses run it as their main protection. Others keep a separate endpoint tool and use Premium for its identity and email security.

The email looks completely normal. It comes from a vendor you’ve paid for years, in the same thread as last month’s invoice, with a short note: “We’ve changed banks, please use the account below going forward.” Your bookkeeper updates the payment details, the invoice gets paid, and nobody notices anything until the real vendor calls asking where their money is.

That’s business email compromise (BEC). It has no virus, no suspicious attachment, and often no link at all. It’s simply a believable request to send money somewhere it shouldn’t go. This guide covers how the scam works, the one business rule that stops most of it, and what to do in the first hour if your business already paid.

Key Takeaways

• In 2025, the FBI received 24,768 BEC complaints, with reported losses of more than $3 billion.
• The control that saves the money is a process, not a product: verify any payment change by phone, using a number you already have.
• If you’ve already sent the money, call your bank’s fraud line right away. Speed decides whether you get it back.

What Is Business Email Compromise?

Business email compromise is a scam where criminals pose as someone you trust, by email or text, to get your business to send money or sensitive information. In its 2025 Internet Crime Report, the FBI counted 24,768 BEC complaints and $3.05 billion in reported losses, up from $2.77 billion in 2024. That makes it the second most costly crime type the FBI tracks. Closer to home, Coloradans filed 18,847 internet crime complaints with the FBI in 2025, reporting $355 million in losses across all scam types.

Most BEC attempts fall into a few patterns:

• Fake invoices or “new bank details” from a vendor. Often sent from the vendor’s real, hacked mailbox, so it lands inside a real conversation.
• Owner or executive impersonation. “I’m in a meeting, I need this wire sent before 3:00, don’t call.”
• Payroll diversion. An “employee” asks HR to switch their direct deposit to a new account.
• Gift card requests. A message that appears to come from the boss asks someone to buy gift cards for a client and send the codes.

If you’ve read our overview of phishing and small business email security, BEC is the variant that does the most financial damage. It’s also the one email filters catch least often, because there’s nothing technically malicious to catch.

Why Does BEC Fool Smart, Careful People?

In 2025, the FBI found businesses lost more than $30 million to BEC scams that used AI, including AI-written emails and cloned voices. But most BEC doesn’t need AI at all. It works because it borrows trust that already exists. An attacker inside a real mailbox reads old emails, learns who pays whom, and waits for the right moment.

Three things make it convincing:

• Real threads and lookalike domains. The message is either from the real account or from a domain that’s one letter off (acmesupp1y.com instead of acmesupply.com), which is nearly impossible to spot on a phone.
• Urgency and authority. The request comes from the owner or a key vendor, and it’s due today.
• Hidden inbox rules. Once inside a mailbox, attackers often create rules that quietly move or delete replies, so the real vendor’s “we never sent that” message never gets seen. Microsoft’s guidance on compromised accounts lists suspicious inbox and forwarding rules as one of the main signs a mailbox has been taken over.

And with cloned voices in the mix, “it sounded just like him” no longer proves anything. This isn’t a careless-employee problem. The people who fall for BEC are usually the ones doing their job quickly and well.

How Do You Prevent Business Email Compromise?

The most effective defense against BEC wire fraud is a simple business rule: never change payment details or send an unusual payment based on an email alone. The FBI’s own guidance for BEC victims says the same thing: never make payment changes without verifying with the intended recipient.

Here’s what that looks like as an office policy you could adopt today:

1. Call back on a known number. Confirm any change to bank details, routing numbers, or payment method by phone. Use the number on file or from a past invoice. Never use the one in the email.
2. Two people for big payments. Set a dollar threshold, say $5,000, above which a second person approves the payment.
3. Same rule for payroll. Confirm direct deposit changes with the employee, in person or by phone.
4. Urgency is a reason to slow down. Tell your team, in writing, that no one will ever get in trouble for pausing a payment to verify it. Including you.
5. No gift cards by email request. Ever. Real bosses and real clients don’t pay in gift card codes.

Why does this work when technology alone doesn’t? Because a phone call to a number the attacker doesn’t control breaks the scam completely. Even if the email came from a real, compromised mailbox, the real vendor on the other end of the call will say “we didn’t change anything.”

What Technology Makes BEC Harder to Pull Off?

In 2025, phishing and spoofing was the most-reported crime type in the FBI’s Internet Crime Report, with 191,561 complaints. That’s usually how attackers get into a mailbox in the first place. The right settings lower those odds, and most are already included in Microsoft 365 or Google Workspace. They just have to be turned on and checked.

• MFA on every mailbox. Mailbox takeovers usually start with a stolen password. Multi-factor authentication means a stolen password alone isn’t enough to get in. It has to cover every account, including old ones nobody uses anymore.
• Email authentication on your domain. SPF, DKIM, and DMARC make it much harder for someone to send email that appears to come from your exact domain. Our guide to email authentication for small businesses walks through it.
• External sender warnings. A banner that says “this message came from outside your organization” makes a fake “owner” email stand out.

Two more settings close the gaps attackers count on. Alerts on new forwarding and inbox rules tell you the same day if someone starts hiding or copying a mailbox’s mail. Prompt offboarding shuts down former employees’ mailboxes, which often keep receiving invoices behind an old password. None of these replace the callback rule. They make it less likely you’ll ever need it.

What Should You Do If You Already Sent the Money?

Act within the hour. In 2025, the FBI’s Recovery Asset Team froze $679 million in stolen funds through its Financial Fraud Kill Chain. In this process, the FBI works directly with banks to freeze the receiving account before the money moves again. For transfers to U.S. accounts, it froze 61% of reported losses. That only works if the report comes in fast.

1. Call your bank’s fraud line now. Don’t email. Tell them it’s a fraudulent wire or ACH and ask for a recall or reversal.
2. File a complaint at ic3.gov. Include full banking details for both accounts. The FBI uses them to contact the receiving bank.
3. Lock down the mailbox. Reset the password, sign the account out of all sessions, confirm MFA is on, and remove any inbox or forwarding rules you didn’t create.
4. Warn the other party through a known channel. Call the vendor or customer. If your mailbox was compromised, your customers may be getting fake invoices from you right now.
5. Call your cyber insurer. Many policies cover funds transfer or social engineering fraud under a separate, smaller limit. Most also require prompt notice.

If the attacker was inside your systems, the response goes beyond the payment. Our guide on what to do after a cyberattack covers the broader steps. Our post on cyber insurance requirements for Colorado businesses explains the state’s 30-day notification clock if customer data was exposed.

Is Your Business Set Up to Catch This?

Most businesses we talk to have never written down a payment verification rule, and very few have looked at the inbox rules in their own mailboxes. Does MFA cover every account? Would anyone notice a new forwarding rule? Would your team pause on a “new bank details” email? If you’re not sure, a short conversation is an easy way to find out where you stand. Reach out to Engel Tech and we’ll take a look.

Frequently Asked Questions

What is business email compromise in simple terms?

It’s a scam where a criminal pretends to be someone you trust, like a vendor, your boss, or an employee, to get you to send money or change payment details. It usually arrives as an ordinary-looking email with no virus or link, which is why spam filters often miss it.

How do I know if a vendor’s email has been hacked?

You often can’t tell from the email itself, because it may come from the vendor’s real account. Treat any request to change bank details as suspicious by default, and confirm it by calling the vendor at a number you already have on file.

Can I get my money back after a wire fraud scam?

Sometimes, if you move fast. Call your bank’s fraud department immediately to request a recall, and file a report at ic3.gov with the full banking details. In 2025, the FBI’s Recovery Asset Team froze about 58% of the funds it tried to stop, and speed is the biggest factor.

Does Microsoft 365 or Google Workspace protect against BEC?

Both include tools that help, like MFA, email authentication, external sender warnings, and alerts on suspicious inbox rules. But many of these have to be configured, and none of them can stop an employee from paying a convincing fake invoice. A payment verification policy covers that gap.

Does cyber insurance cover business email compromise?

Many policies do, but often under a separate “social engineering” or “funds transfer fraud” limit that may be much lower than the main coverage. Some policies also require proof that you had verification procedures in place. Check your policy before you need it.

Who is responsible if we pay a fake invoice?

It depends on the contracts and whose mailbox was compromised, and it often ends up as a dispute between the two businesses. That’s another reason to verify payment changes by phone: it protects you whether the breach happened on your side or the vendor’s.

Most Google Workspace vs Microsoft 365 comparisons are giant feature grids. They all say the same thing: both do email, file storage, video calls, and documents. That’s true, but it doesn’t help you decide.

Google Workspace is Google’s business suite: Gmail, Drive, Docs, Sheets, and Meet, running under your own domain. Microsoft 365 is Microsoft’s version: Outlook, OneDrive, SharePoint, Teams, and the Office apps. This guide skips the spec sheet and covers the few differences that actually matter for a small business.

Key Takeaways

• As of October 2026, both platforms cost $7, $14, and $22 per user per month at their three small business tiers. As a result, price no longer decides it.
• How your team works, and what your other software expects, should drive the choice.
• Serious security controls live in the $22 tier on both sides, and neither platform backs up your data for you.

Isn’t Google Workspace Cheaper Than Microsoft 365?

Not anymore. For years, Google was the budget option. However, after Microsoft’s price change on July 1, 2026, the two lineups match dollar for dollar on annual billing:

These prices come from Google’s Workspace pricing page and Microsoft’s business plan comparison. They assume an annual plan. Google charges more if you pay month to month, and both companies run intro discounts that expire.

In other words, the decision comes down to three things a pricing page won’t show you. How does your team work? What does your other software expect? And what do you actually get at the tier you’ll buy?

How Does Your Team Actually Work?

Google Workspace was built for the browser. Docs, Sheets, and Drive live online, and several people can edit the same file at once. There’s nothing to install. As a result, teams that write together and work from a mix of devices tend to find Google simpler.

Microsoft 365, on the other hand, is built around the desktop Office apps: Word, Excel, Outlook, and PowerPoint. They also run in a browser, but the desktop versions are where Microsoft is strongest. For example, if your business lives in complex spreadsheets or Excel macros, Microsoft is usually the better fit. Similarly, heavily formatted Word documents shared with clients tend to behave better there.

One trap catches a lot of people here. In our experience, it’s the most common licensing mistake we see. Microsoft’s cheapest tier, Business Basic, does not include the desktop Office apps. It’s web and mobile versions only, as Microsoft’s Office apps service description shows. Businesses buy Basic because it looks like the obvious starter plan. Then, for instance, the bookkeeper finds out they can’t install Excel. If your team needs desktop Office, start at Business Standard.

Storage is the other practical difference. Specifically, Microsoft gives each user 1 TB of OneDrive storage plus a separate mailbox. In contrast, pooled storage is how Google does it: one shared allowance for the whole business. That works out to 30 GB per person on Starter and 2 TB per person on Standard. As a result, Google’s entry tier gets tight fast if your team stores large files. For more on organizing files either way, see our guide to the best way to store small business files.

What Do Your Other Software and Clients Expect?

This is the factor most owners don’t think about. In fact, it’s often the one that decides it.

Start with the software your business already depends on. For instance, some accounting and industry-specific apps are built to work with Outlook or Excel. Others assume Windows computers that sign in through Microsoft. However, many connect just as well to Google. Either way, check before you choose, not after.

Then think about who you swap files with. If clients, lenders, or partners send Excel workbooks and Word files with tracked changes, Microsoft will save you formatting headaches. On the other hand, if your clients mostly share Google Docs links, the reverse is true.

Finally, consider your industry. Businesses that handle health, financial, or legal information can meet their requirements on either platform. That said, it takes the right tier and the right setup. If a client, auditor, or insurance carrier will ask how your email and files are protected, make sure your plan can answer.

Which One Is More Secure for a Small Business?

Neither, by default. Both platforms are secure at the right tier, and both are weaker than most owners assume at the entry tier. So the comparison that matters is between the plans you’ll realistically pay for.

Here’s what a small business should look for, whichever platform it picks:

• Enforced multi-factor authentication (MFA). Both platforms support it at every tier, and Google lets admins enforce 2-Step Verification for everyone. That said, what matters is whether it’s required or left optional. Our guide to MFA covers why this is the first setting to check.
• Device management. This lets you require a passcode, encrypt a laptop, and wipe company data from a lost phone. Microsoft includes it with Intune in Business Premium. Google includes basic device management in every business tier, with advanced controls in Business Plus.
• Sign-in rules. These block sign-ins from unexpected countries or unmanaged devices. On Microsoft, this is called Conditional Access, and it comes with Business Premium. Google’s version, Context-Aware Access, isn’t in any Business plan. It requires an Enterprise plan.
• Endpoint protection. Business Premium adds Defender for Business, which protects the computers themselves, not just the inbox. Google, however, focuses on protecting Gmail and Drive and leaves computer protection to separate tools.
• Retention and search. This means keeping and searching email and files for legal or compliance reasons. Google includes Vault starting at Business Plus. Similarly, Microsoft’s top small business tier includes its own retention tools.

The pattern is the same on both sides: the $22 tier is where the serious security controls live. In contrast, a $7 plan with default settings doesn’t get much protection from either company. In particular, someone has to turn these features on and keep them configured. That’s the real question behind who should manage Microsoft 365 for your business, and it applies to Google too.

Neither One Backs Up Your Data for You

This surprises a lot of owners. Microsoft and Google keep their services running and protect against their own hardware failing. However, they don’t promise to bring back a file deleted three months ago. The same goes for a mailbox removed when someone left, or data encrypted by ransomware that synced to the cloud.

Both platforms have recycle bins and version history, but they have time limits. For example, Google Drive empties its trash after 30 days. Microsoft’s SharePoint and OneDrive recycle bins hold items for 93 days. In other words, neither is a backup. If your business can’t afford to lose its email and files, you need a separate backup either way. We go into detail in are your business backups actually backing anything up?

Already Picked One? When Switching Is Worth It

If you’re already on one platform, the bar for switching should be high. Moving means migrating every mailbox, file, calendar, and shared permission. In addition, it means updating your domain’s email settings and retraining staff. It’s very doable, but it’s a project, not an afternoon.

Switching makes sense when the platform is actively fighting how your business works. For example, your team is constantly converting files, or a key app only works with the other platform. Similarly, watch for half the office quietly using the other one on the side. It’s also worth a look if you’re on Microsoft through a reseller plan that limits what you control. We cover that in why GoDaddy 365 holds businesses back.

In our experience, most requests to switch are really about something else: spam, lost files, messy permissions, or people not knowing where things live. Those are setup problems. As a result, they follow you to the new platform. Configuring what you have is almost always the cheaper fix.

Google Workspace or Microsoft 365: Which Should You Pick?

If your team works mostly in the browser and shares documents, Google Workspace is likely the simpler fit. If your business runs on desktop Office, complex Excel, or software that expects Microsoft, Microsoft 365 is likely the better one. Still unsure? The software you already use and the files your clients send will usually settle it.

That said, either platform is only as good as its setup. If you’re choosing a platform, thinking about switching, or unsure your current one is set up right, a short conversation with Engel Tech is an easy way to find out where you stand.

Frequently Asked Questions

Is Google Workspace cheaper than Microsoft 365?

Not anymore. On annual plans, both cost $7, $14, and $22 per user per month at their three main small business tiers, as of October 2026. Google charges more if you pay month to month, and both run introductory discounts, so compare the price you’ll pay after the first year.

Which is better for a small business, Google Workspace or Microsoft 365?

Neither is better across the board. Google Workspace tends to fit browser-based teams that collaborate on shared documents. Microsoft 365 tends to fit businesses that rely on desktop Excel and Word, or on software built around Microsoft. The apps your business already uses usually decide it.

Does Microsoft 365 Business Basic include Word and Excel?

Only the web and mobile versions. Business Basic does not include the installable desktop Office apps. If your team needs desktop Word, Excel, and Outlook, you need Business Standard or Business Premium.

Can I use Gmail with Microsoft 365, or Outlook with Google Workspace?

You can open Google Workspace email in the Outlook app, and you can view Microsoft 365 email in other mail apps. But your mailboxes, files, and calendars still live on one platform. Running both platforms side by side usually means paying twice and keeping files in two places.

How hard is it to switch from Google Workspace to Microsoft 365, or the other way?

It’s a real project, but a common one. Email, files, calendars, and sharing permissions all have to be moved, your domain’s email records have to be updated, and staff need a little retraining. With planning, most small businesses can switch with little or no downtime.

Do I need a separate backup for Google Workspace or Microsoft 365?

Yes, if your business can’t afford to lose its email and files. Both platforms protect against their own outages, but recycle bins and version history have time limits and won’t cover every deletion, departed employee, or ransomware event. A separate backup covers what they don’t.

Someone in your office probably drafted an email in ChatGPT this week, and nobody decided that should happen. Microsoft’s 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work. An AI acceptable use policy for small business puts a few simple rules around something that’s already helping, without shutting it down.

Is Your Team Already Using AI at Work?

Almost certainly. In most small offices, AI showed up the way any free app does. One person tried it to clean up an email or summarize a contract, it saved them twenty minutes, and they told a coworker. A few months later, half the office uses it, mostly on personal accounts they signed up for with their own email.

That’s not a crisis on its own. The problem is that with no rules, everyone makes their own. One person won’t paste anything with a client’s name in it. Another pastes the whole file. IT people call this shadow AI: AI tools used for work that the business never approved and can’t see. At a small business, shadow AI is usually just people trying to get their work done.

It tends to come up when someone asks about it. A client security questionnaire or a cyber insurance application starts asking how your team uses AI. Or an employee asks, “Am I allowed to use this?” and nobody has an answer.

Same Tool, Different Rules: Personal vs. Business Accounts

Here’s the part a lot of owners miss: the same AI tool follows different rules depending on which account you’re signed into. The screen looks identical. What happens to what you type does not. Three differences matter.

Training. Personal ChatGPT accounts can use your conversations to improve models unless the setting is turned off. OpenAI’s help page on model training explains where that setting lives. OpenAI’s business plans, like ChatGPT Business and Enterprise, don’t train on your data by default.

Control. A business account sits under the company’s admin. You decide who has access and what’s turned on. A personal account belongs to the employee. You can’t see it, set rules for it, or shut it off.

Offboarding. When someone leaves, a personal account leaves with them, along with every chat that had client details in it. A business account gets closed as part of your normal employee offboarding process.

You May Already Own the Safe Version

Many small businesses already pay for a business AI tool and don’t realize it. If you’re on Microsoft 365, Copilot Chat comes with enterprise data protection at no extra cost when people sign in with their work account, and Microsoft says prompts and responses aren’t used to train foundation models. If you’re on Google Workspace, Gemini in qualifying paid plans isn’t used for AI model training outside your domain without permission.

So a good AI policy for small business is less about banning tools and more about steering people onto the account the business already controls. Those admin controls only help if someone actually keeps an eye on them, which is why it matters who manages your Microsoft 365 setup. And if you’re planning to add the paid Copilot that works across your company files, run a permissions audit before you turn on Copilot. That post covers what AI can reach on its own. This one covers what your people hand to it.

What Actually Goes Wrong With AI at Work?

The real risks are ordinary: everyday shortcuts that go sideways.

Sensitive data in personal accounts. An employee pastes a client’s tax return into a personal chatbot to “summarize it.” It works great. But now that return sits in an account the business doesn’t control, and it’ll still be there after that employee moves on.

Confident, wrong output. AI writes smoothly whether it’s right or wrong. A staff member sends a customer an AI-drafted email with the wrong price, the wrong date, or a policy you don’t actually have. The customer doesn’t care that a chatbot wrote it. Your name is on it.

Browser extensions and add-ons. AI extensions and “assistant” add-ons often ask for permission to read every page you visit. That can include email, your banking portal, and client files. Someone installs one to summarize articles and never thinks about what else it can see.

IBM’s 2025 Cost of a Data Breach Report found that one in five organizations it studied reported a breach due to shadow AI. Organizations with high levels of shadow AI saw an average of $670,000 in higher breach costs than those with little or none. The takeaway for a ten-person office is simple: the risk comes from the AI nobody’s managing, not from AI itself.

Banning AI usually doesn’t fix that. It tends to push the activity onto personal phones, where you can’t see it at all.

What to Put in Your AI Acceptable Use Policy for Small Business

For a 10-person office, an AI acceptable use policy is one or two pages, not a governance binder. Write it as an AI policy for employees: plain language that answers the questions your team is already asking. If your office mostly uses ChatGPT, this is your ChatGPT policy. Here’s a copy-ready outline:

1. Purpose. One line: we use AI to work faster without putting client or company data at risk.
2. Approved tools and accounts. Which AI tools are approved, and that work happens only on the business account, never a personal one.
3. Data that never goes in. Client personal information, financial and tax records, health information, passwords, and anything under a confidentiality agreement.
4. Human review. A person checks AI-written work for accuracy before it reaches a customer, a client, or an official document.
5. Disclosure. When staff should say AI helped, such as client deliverables where the client would reasonably expect to know.
6. Add-ons and extensions. No AI browser extensions, plugins, or app connections without approval first.
7. Who to ask. One named person for questions and for reporting mistakes, with no penalty for speaking up quickly.
8. Review date. When the policy gets revisited, at least every six months.

The “data that never goes in” list is the heart of it. Make it specific to your business. A bookkeeping office and a dental office will have different lists, and examples from your own work stick better than generic categories.

The “who to ask” line matters more than it looks. If someone pastes the wrong thing into the wrong tool, you want to hear about it that afternoon, not months later. A policy that punishes honest mistakes teaches people to hide them.

How Do You Make an AI Policy Stick?

A policy only works if following it is easier than ignoring it.

Start by giving people the approved tool. If the business account is harder to use than the personal one, people will keep using the personal one. Set it up and sign everyone in before you hand out the policy.

Training can be short. Fifteen minutes at a staff meeting is enough to walk through the “never goes in” list with real examples from your own work. While you’re at it, review the settings your business account offers and pick them on purpose, instead of living with defaults nobody chose.

Then put a date on the calendar. AI tools change their plans and settings often, so a quick look every six months keeps the policy honest.

One more note for Colorado businesses. Colorado’s SB 26-189 applies starting January 1, 2027, and covers AI used in consequential decisions such as hiring. If you use AI to screen applicants or make similar calls, talk to your attorney about what it means for you. Our overview of IT compliance requirements for Colorado businesses covers the broader picture.

Not sure which AI tools your team is using, or whether you already pay for a business version? That’s a quick thing to sort out together. If you’re in the Denver/Aurora area, a short conversation is an easy place to start.

Frequently Asked Questions

Does my small business really need an AI policy?

If anyone on your team uses AI for work, yes, and they probably do. Microsoft’s 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work. A one-page policy gives everyone the same rules instead of each person making up their own.

Is it safe to use ChatGPT for work?

It can be, if three things are in place: staff use a business account, sensitive data stays out, and a person checks the output before it goes anywhere. The biggest risk is usually personal accounts the business can’t see or control.

Does ChatGPT train on what my employees type into it?

On personal accounts, it can. Personal ChatGPT accounts can use your conversations to improve models unless the setting is turned off. OpenAI’s business plans, such as ChatGPT Business and Enterprise, don’t train on your data by default.

Do we already have a business AI tool through Microsoft 365 or Google Workspace?

Quite possibly. Copilot Chat signed in with a Microsoft 365 work account includes enterprise data protection at no extra cost. Gemini in qualifying paid Google Workspace plans doesn’t use your content for AI model training outside your domain without permission. Check what your current plan includes before buying something new.

What should employees never paste into an AI tool?

Client personal information, financial and tax records, health information, passwords, and anything covered by a confidentiality agreement. Even on an approved business account, share only what the task actually needs. When in doubt, leave it out or ask first.

Should I just ban AI at work?

Usually not. Bans tend to push AI use onto personal phones and accounts where you can’t see it at all, which is the problem you were trying to solve. Giving people an approved tool and a few clear rules works better.

Your HIPAA compliance consultant has you covered on policies, staff training, and the paperwork binder. But when was the last time anyone checked whether your access logs would actually hold up if HHS came asking? HIPAA compliance splits into two halves, and the technical half, the one that lives in your IT rather than your policy binder, is where small medical and dental practices most often have a real gap. Here’s what that half actually covers, and what’s worth checking in your own practice.

HIPAA Compliance Has Two Halves — and Most Practices Only Have One Covered

Most practices treat “HIPAA compliant” as one thing: a binder of policies, a staff training module, maybe a consent-form update. That’s real work, and it matters. It’s also only half the law. HIPAA is actually two separate rules. The Privacy Rule governs how patient information is used and disclosed, which is where policies and training live. The Security Rule is a different, more technical requirement: it governs how electronic patient health information, usually shortened to ePHI, is actually protected on the systems that store and move it.

A compliance consultant typically owns the Privacy Rule side. The Security Rule side is IT’s job, and it’s the half a generic IT setup usually misses entirely, because nobody framed it as a HIPAA requirement in the first place. A stolen laptop with an unencrypted patient database, an old employee’s EHR login still active six months after they left, a scanner vendor with standing remote access and no signed agreement — none of these show up in a policy binder. They’re ordinary IT gaps that become HIPAA problems the moment patient data is involved. General Colorado business compliance requirements layer on top of this, but healthcare has its own, more specific bar to clear.

The Technical Safeguards a Generic IT Setup Usually Misses

The Security Rule doesn’t hand practices a shopping list of products to buy. It sets standards and leaves the implementation to the practice, which is exactly why it’s easy to under-deliver on without realizing it. NIST’s implementation guide for the Security Rule is the closest thing to a plain-English translation of what regulators actually expect, and a handful of items come up again and again as the ones small practices miss.

Access control is the biggest one. It’s not enough to have a password on the EHR system. The real question is whether the list of people who can open patient records matches the list of people who currently work there. Role-based access controls keep that list accurate as staff join, change roles, and leave, instead of accumulating logins nobody remembers to remove. Layered on top of that, multi-factor authentication on anything touching patient data is close to table stakes at this point; a password alone is a thin barrier around records this sensitive.

Beyond access, the Security Rule expects audit controls, meaning a system that actually records who accessed what record and when, not just a login screen with no memory behind it. It expects encryption for patient data both at rest, on laptops and servers, and in transit, when it moves between systems. And it expects basics like automatic logoff on shared workstations, so a computer at the front desk doesn’t sit open to the last patient’s chart after the staff member steps away. None of this is exotic. It’s the kind of thing a healthcare-aware IT setup builds in by default, and a generic one usually doesn’t, simply because nobody asked for it specifically.

Business Associate Agreements: The IT Piece Nobody Signs

Any vendor that can access, store, or transmit patient data on a practice’s behalf is what HIPAA calls a business associate, and the law requires a signed Business Associate Agreement, or BAA, with every one of them. This isn’t a formality or a box-checking exercise. It’s a real, legally binding contract, and it’s also the single piece of HIPAA IT compliance practices most often skip entirely.

The obvious candidate is a practice’s IT provider, since they can typically reach anything on the network, patient records included. But the list is longer than that: cloud backup services, the EHR hosting company, and yes, the copier or scanner vendor with a remote-support agreement that lets their technician log in from off-site. If any of them touch patient data and haven’t signed a BAA, that’s a gap, regardless of how good their actual security is. It’s worth asking every vendor with system access a direct question: can you show me our signed BAA? A vendor that hesitates or doesn’t know what that is has already answered it.

What a Breach Looks Like From the IT Side

A stolen laptop, a compromised login, or a ransomware incident is a bad day for any small business. When patient data is involved, it’s also a legal clock. HIPAA’s Breach Notification Rule requires notifying affected individuals without unreasonable delay, and in no case later than 60 days from the date the breach was discovered. That clock starts the moment the practice knew, or reasonably should have known, something happened, whether or not the full picture is clear yet. The immediate response steps after any cyberattack still apply here; HIPAA just adds a firm deadline and a specific notification process on top of them.

Detection speed is where this gets serious. Healthcare has been the costliest industry for data breaches for fourteen years running, according to IBM’s 2025 Cost of a Data Breach Report, averaging $7.42 million per breach and, more relevant here, taking 279 days on average to even identify and contain. That gap between when something happens and when anyone notices it is exactly what audit logging and access monitoring are for. A practice that can’t quickly answer “who accessed this record, and when” isn’t just missing a technical safeguard, it’s the reason breaches run long and get expensive before anyone even knows to start the 60-day clock.

What to Actually Ask When You’re Evaluating IT Support for a Healthcare Practice

Nobody hands out an official “HIPAA compliant” certification to IT providers, no matter what a sales pitch implies. Compliance isn’t a stamp you buy once; it’s an ongoing practice, verified through what an IT provider actually does. A few direct questions cut through the marketing:

• Do they know what counts as PHI? If they can’t distinguish patient health information from any other business data, they’re not thinking about your practice’s specific risk.
• Will they sign a BAA? A “yes” without hesitation is the baseline. A provider who’s never been asked before is a sign they haven’t worked with healthcare clients.
• Can they show you an access log on request? If access controls and audit logging aren’t already something they can demonstrate, they’re not built in, they’re an afterthought.
• Do they support encryption and automatic logoff as standard, not as an upsell? These are baseline expectations for a healthcare-aware setup, not premium add-ons.

If you’re not sure how your current IT setup would answer those questions, that’s worth a short conversation before a compliance questionnaire, an insurer, or an actual incident asks them for you. Reach out here.

Frequently Asked Questions

What’s the difference between HIPAA’s Privacy Rule and Security Rule?

The Privacy Rule governs how patient information can be used and disclosed, and typically lives in a practice’s policies, staff training, and paperwork. The Security Rule is a separate, more technical requirement covering how electronic patient health information is actually protected on the systems that store and move it, things like access controls, encryption, and audit logging. A compliance consultant usually handles the first half; IT handles the second.

Does my regular IT provider need to be HIPAA compliant?

Any IT provider with access to systems containing patient data needs to operate in a way that meets HIPAA’s Security Rule requirements and sign a Business Associate Agreement. There’s no official certification that makes a provider “HIPAA compliant” on paper; what matters is whether their actual practices, access controls, encryption, logging, and BAA included, hold up.

What is a Business Associate Agreement and who needs to sign one?

A Business Associate Agreement, or BAA, is a legally required contract between a practice and any vendor that can access, store, or transmit patient data on its behalf. That includes an IT provider, cloud backup services, EHR hosting companies, and any vendor with remote access to systems touching patient records, such as a copier or scanner company. If a vendor touches patient data without a signed BAA, that’s a compliance gap regardless of how secure their systems otherwise are.

How quickly do I have to report a HIPAA breach?

HIPAA’s Breach Notification Rule requires notifying affected individuals without unreasonable delay, and no later than 60 days after the breach is discovered. That 60-day clock starts when the practice knew, or reasonably should have known, that a breach occurred, not when the full scope is understood. Breaches affecting 500 or more people in one state also require media notification.

Can an IT company be “HIPAA certified”?

No official federal HIPAA certification exists for IT providers or any other vendor. Compliance is an ongoing practice, not a one-time credential. Be cautious of any provider that markets itself as “HIPAA certified” as if it were a fixed accomplishment rather than something maintained through actual access controls, encryption, logging, and a signed BAA.

What technical safeguards does HIPAA actually require?

The Security Rule requires access controls limiting who can reach patient data, audit controls that log who accessed what and when, encryption for patient data at rest and in transit, and safeguards like automatic logoff on shared workstations. NIST’s implementation guide for the Security Rule translates these into concrete practices a small practice’s IT setup should already include.

Somewhere right now, a stranger could send an email that looks like it came from your business. It could reach one of your customers or vendors, without ever touching your inbox or your website. Most business owners assume their email provider blocks this automatically. It partially does. The missing piece is usually a policy. That policy tells other mail servers what to do when someone fails the check. It also decides whether to tell you it happened at all. That policy has a name: DMARC. Together with SPF and DKIM, it makes up what’s called email authentication. So here’s what each piece does, and what having them actually in place looks like.

What Happens When Nobody’s Watching Your Domain

Email was never built with a way to verify who actually sent a message. Anyone can type any “from” address into an outgoing email, the same way anyone can write any return address on a paper envelope. Most of the time nothing comes of it. But it means your business domain can be used to send email you never wrote. That email can reach people you actually do business with. For example, a vendor might get an invoice that looks like it’s from you. Or a customer might get a payment request that looks like it’s from your billing address.

It’s easy to assume this doesn’t apply if you don’t send marketing email or bulk newsletters. That’s a different question. This isn’t about how much email you send. It’s about whether anything stops someone else from sending email as you at all. A business that sends five emails a day is exactly as exposed to domain spoofing as one that sends five thousand.

This is also a different problem from the phishing emails that show up in your inbox. That’s its own topic, worth understanding on its own. Instead, this is about your domain being used against someone else. Often, you won’t find out until they call to ask why you’re sending them strange invoices.

SPF, DKIM, and DMARC: The Building Blocks of Email Authentication

These three sit on top of each other, and each one covers something the others don’t.

SPF (Sender Policy Framework) is a list. It’s a record published in your domain’s DNS settings. It names exactly which mail servers are allowed to send email on your behalf. That includes your email provider, and anything else you actually use to send mail. Think of it as a guest list at the door. If a server isn’t on the list, receiving mail systems get suspicious of anything claiming to be from your domain.

DKIM (DomainKeys Identified Mail) is a digital signature. Your mail server signs each outgoing message with a private cryptographic key. The receiving server then checks that signature against a public key published in your DNS. If the message was altered in transit, or wasn’t actually signed by your legitimate mail server, the signature doesn’t match. Think of it as a wax seal on an envelope. It’s proof the message wasn’t tampered with, and that it genuinely came from where it claims to.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the instructions. It tells receiving mail servers what to do when a message fails SPF, fails DKIM, or both. The options are to let it through anyway, send it to spam, or reject it outright. DMARC also asks receiving servers to send you reports on what they’re seeing sent from your domain. For many businesses, that’s the first time they discover someone has been impersonating them. Using the same analogy, DMARC is what tells the doorman what to do when someone’s not on the list. It also tells him to let you know it happened.

A domain can have SPF without DKIM, DKIM without a real DMARC policy, or a DMARC record that only watches and never blocks anything. Having some of these pieces isn’t the same as having all three working together.

Why Most Small Businesses Have This Half-Configured

Most small businesses already have SPF, usually without ever setting it up on purpose. Microsoft 365 and Google Workspace both publish a baseline SPF record automatically, as part of getting your account working. That’s so outgoing mail doesn’t immediately land in spam. That’s often where setup stops. DKIM frequently isn’t turned on. DMARC, if it exists at all, is commonly set to monitor-only. That means it collects reports, but doesn’t actually block or flag anything that fails.

This isn’t negligence. It’s the natural result of setup that was done to get email sending, not to get the domain protected. Nobody sat down and decided to skip DMARC enforcement — it just wasn’t part of the original checklist. This gets worse when domain and email management are split across different providers. That’s exactly the situation a GoDaddy-plus-Microsoft-365 setup tends to create. DNS records live in one place. Mail flow is managed in another. Nobody has a clear view of both.

In practice, this is one of the first gaps we find when reviewing a new client’s domain. SPF is present from day one, because the email platform put it there automatically. DKIM is never turned on. DMARC is either missing entirely, or quietly set to monitor-only. Nobody did anything wrong. Nobody ever finished the job.

Why This Is Becoming Harder to Ignore

This used to be treated as an enterprise-only concern. That’s no longer true. Since February 2024, Google has required this for high-volume senders. Any business sending 5,000 or more daily messages to Gmail addresses needs SPF, DKIM, and at least a baseline DMARC record in place. Otherwise, those messages risk being rejected outright. Google tightened that enforcement further in November 2025. Yahoo and Microsoft have followed similar paths. The practical effect: email authentication has quietly become table stakes across the entire email system. It’s no longer a checkbox reserved for large companies with dedicated IT security teams.

The stakes on the impersonation side are real too. The FBI’s 2025 Internet Crime Report recorded phishing and spoofing as the single largest category of complaints that year, at 191,561. That’s more than any other crime type tracked, including extortion and investment fraud. Business email compromise, a category closely tied to look-alike and spoofed sender addresses, accounted for just over $3 billion in reported losses. Phishing that reaches your business is one side of that threat. Your own domain being used to phish someone else is the other side. It’s the side SPF, DKIM, and DMARC are built to close off.

What Getting This Set Up Actually Looks Like

This is a small number of DNS record changes, not new software or hardware to buy. If you’re on Microsoft 365 or Google Workspace, whoever manages that environment can typically confirm and complete SPF and DKIM in well under an hour. Most of the groundwork is already provided by the platform. Microsoft publishes its own step-by-step DMARC setup guide for exactly this scenario.

DMARC is the step worth doing carefully rather than quickly. The realistic path starts with a monitor-only policy. It does nothing but collect reports on what’s being sent from your domain, including anything you didn’t send. After a few weeks of watching those reports, you confirm every legitimate sender is accounted for. Then the policy moves to actually rejecting or quarantining anything that fails. Jumping straight to full enforcement, without that monitoring step, risks silently blocking a legitimate tool you forgot about. That could be an invoicing platform, or a marketing tool sending mail on your behalf.

If you’ve never checked whether your domain has all three of these in place, that’s worth a quick look. The same goes if you’re not sure what your current DMARC policy actually does when something fails. Better to find out now, before it’s your customers fielding the fake invoice instead of you fielding the report. Reach out here.

Frequently Asked Questions

What is DMARC and does a small business actually need it?

DMARC is a DNS record that tells receiving mail servers what to do when an email fails SPF or DKIM checks, and asks them to report that activity back to you. Any business with a domain that sends or receives email is a potential target for spoofing, regardless of how much email it sends. Without DMARC, a business typically has no visibility into whether someone else is sending email pretending to be them.

What’s the difference between SPF, DKIM, and DMARC?

SPF lists which mail servers are allowed to send email for your domain. DKIM adds a cryptographic signature proving a message wasn’t altered and genuinely came from an authorized server. DMARC sets the policy for what happens when a message fails either check, and provides reporting on spoofing attempts. They work together — SPF and DKIM do the checking, DMARC decides the consequence.

Can someone spoof my domain even if I use Microsoft 365 or Google Workspace?

Yes. Microsoft 365 and Google Workspace both publish a basic SPF record automatically, but that alone doesn’t fully protect your domain. Without DKIM and an enforced DMARC policy, someone can still send email that appears to come from your domain, and you likely won’t know it happened unless a recipient tells you directly.

Will setting up DMARC stop phishing emails from reaching me?

Not directly. DMARC protects outbound trust in your own domain — it stops (or exposes) someone using your domain to send email to others. It doesn’t screen the phishing emails landing in your own inbox from other spoofed or malicious domains; that’s a separate problem handled by email filtering and user awareness.

Is setting up SPF, DKIM, and DMARC expensive?

No. These are DNS record changes, not paid software or hardware. For most businesses on Microsoft 365 or Google Workspace, the time investment is the main cost — typically well under an hour for SPF and DKIM, plus a few weeks of monitoring before moving DMARC to full enforcement.

How do I check if my business already has SPF, DKIM, and DMARC set up?

Free online lookup tools can check your domain’s DNS records for all three in seconds. The harder part isn’t checking whether they exist — it’s confirming DKIM is actually signing outgoing mail correctly and that your DMARC policy is set to actually act on failures, not just silently monitor them.

Your guest WiFi has its own name and its own password. But is it on a separate network from the computer running your books, your point-of-sale system, and your files? Most owners assume so. The honest answer, once you check, is usually “I’m not sure.” That gap is where a surprising amount of small business risk hides. Closing it is what’s called network segmentation. Here’s what it actually does, what it protects against, and what putting it in place looks like. You don’t need an IT department to follow along.

The Network Most Small Businesses Actually Have

Most small business networks grow the same way. One router, or one set of wireless access points, ends up running everything. Devices get connected to it as the need comes up. The office computers. The shared drive or file server. The point-of-sale system. A couple of security cameras. Maybe a smart thermostat. And, eventually, a guest WiFi network for customers or visitors, added on top of whatever was already there.

Nobody sits down and designs this. It accumulates, one device at a time. Eventually a dozen different systems are running on a single flat network. That means every device on it can, in principle, see and reach every other device on it. A different WiFi name and password for guests feels like a separation. But unless the network is actually split into isolated sections, it isn’t one. A guest’s phone and the computer running payroll can still be neighbors on the same network. Neither one has to realize it.

That’s not a hypothetical edge case. It’s the default state of most small business networks. Plenty of them already have strong passwords, current software, and antivirus in place. Segmentation isn’t a sign something else is broken. It’s a layer those other protections don’t cover.

What Network Segmentation Actually Means

Network segmentation means splitting one network into separate, isolated sections. These are often called VLANs, short for virtual local area networks. Rules then control what’s allowed to cross between them. Devices in one section can be walled off from devices in another. That’s true even when they connect through the same physical equipment.

Here’s a useful way to picture it. Picture an office with one big open room, compared to one with separate rooms and locked doors. A flat network is the open room. Anyone who gets in can walk anywhere. A segmented network has walls instead. Guests get the lobby. Staff get the offices. The server room has its own door, and only certain people can open it. Everyone is still in the same building, on the same internet connection. But what each person can reach is controlled.

This is usually a configuration decision, not a hardware purchase. Most business-grade WiFi equipment already supports multiple isolated networks out of the box. Ubiquiti’s UniFi line, common in small business setups, is one example. It typically just hasn’t been set up that way, because nobody flagged it as something that needed attention.

The Groups Most Small Businesses Should Separate

For a typical small business, segmentation usually comes down to separating a handful of groups:

• Business systems: office computers, shared drives or file servers, and line-of-business software. This is the network that needs the tightest access.
• Guest WiFi: customers, visitors, and anyone who isn’t staff. This network should reach the internet and nothing else on the business’s systems.
• IoT and smart devices: security cameras, smart thermostats, smart locks, and networked printers. These are usually the quietest source of risk. Nobody thinks of a thermostat as “a computer on the network,” but it runs software. It can be compromised, and by default it often sits right next to the file server.
• Point-of-sale systems, where applicable: payment processing carries its own compliance expectations and generally shouldn’t share a network with anything else.

This split shows up constantly at retail storefronts and franchise locations around Denver and Aurora. Picture a business handing out guest WiFi to customers up front. A few feet away, a POS system and back-office computers run on the exact same equipment. Coworking and shared-office setups push this even further. The network there is often shared with other businesses that have no relationship to each other at all.

Why This Matters More Than It Used To

Segmentation has always been good practice. It’s become a more pressing one for a specific reason. Modern ransomware doesn’t stop at the first device it infects. Once it has a foothold, it moves across the network looking for file servers, backups, and anything else worth encrypting. That lateral movement is exactly what segmentation is built to stop. Without a network path between them, a compromised guest device or IoT camera can’t reach the file server at all.

Federal guidance treats this as current, active advice, not a legacy checklist item. A 2025 CISA ransomware defense advisory recommends it directly: “segment networks to restrict lateral movement from initial infected devices and other devices in the same organization.” CISA also released dedicated zero-trust segmentation guidance as recently as July 2025. The numbers back this up too. Verizon’s 2025 Data Breach Investigations Report found extortion malware in 88% of small and medium-sized business breaches. That category covers ransomware and similar attacks. It compares to just 39% at larger organizations. The median ransom demand was $115,000.

Small businesses aren’t a secondary target anymore. In some ways they’re the primary one. They typically have fewer layers of defense standing between an initial compromise and real damage. The pressure to fix this is showing up well above the small business level, too. Cisco’s 2025 Segmentation Report found that 79% of security professionals at larger organizations now rank segmentation a top priority. Only about a third have it fully in place. The same logic applies at a much smaller scale. Separate what doesn’t need to talk to each other, and a single infected device stops being a business-wide problem.

It’s also becoming a checklist item rather than just a technical nicety. Cyber insurance applications increasingly ask directly whether a business’s guest, IoT, and business networks are separated. That question now sits right alongside ones about multi-factor authentication and backups.

What Getting This Set Up Actually Looks Like

For most small businesses already running business-grade access points, this is a configuration project, not a hardware overhaul. It typically starts with defining the separate networks: business, guest, IoT, and point-of-sale if applicable. From there, it’s a matter of setting rules for what each one can and can’t reach. Existing devices then move onto the right network. Network performance problems often get noticed before the security gap does. It’s worth checking both while the network is already being looked at.

None of this replaces device-level protection. Managing the devices themselves and controlling the network they connect to are two different layers. A business needs both. Segmentation limits where a compromised device can go. Device management limits what can happen to the device in the first place.

A basic segmentation setup on existing hardware is usually a matter of days, not weeks. What takes longer is configuring it correctly for the business’s specific mix of devices. The goal is not to quietly break something like a point-of-sale terminal or a networked printer in the process. Doing it once, correctly, is worth more than doing it fast.

Guest WiFi, cameras, and business systems should all be on separate networks, not just separate names. If you’ve never checked whether yours are, that’s worth a short conversation. Better to have it now than after something worse than a customer asking for the password puts it to the test. Reach out here.

Frequently Asked Questions

What is network segmentation and does a small business actually need it?

Network segmentation splits one network into isolated sections, commonly called VLANs, with rules controlling what can communicate between them. Most small businesses run everything on a single flat network without realizing it. That means a compromised guest device or smart camera can potentially reach business systems. Once a business has more than a handful of devices, a guest WiFi network, or any smart or IoT devices, segmentation becomes worth putting in place.

Is a separate guest WiFi name and password the same as network segmentation?

No. A different WiFi network name and password controls who can join the network, not what that network can reach once someone’s connected. Without true segmentation, a guest network and a business network can still see and communicate with each other behind the scenes. They just look separate to the person connecting. Segmentation adds the actual isolation between them.

Does network segmentation stop ransomware?

Segmentation doesn’t prevent an initial infection, but it limits how far that infection can spread. Modern ransomware relies on moving across a network after gaining a foothold, reaching file servers and backups along the way. CISA’s own ransomware defense guidance specifically recommends segmentation to restrict that lateral movement. It’s one layer among several, working alongside endpoint protection and backups rather than replacing either.

Do I need new equipment for network segmentation, or can I use what I have?

Most business-grade WiFi and networking equipment already supports segmentation. It’s more often a configuration change than a hardware purchase. Ubiquiti’s UniFi line, common in small business setups, supports multiple isolated networks out of the box. Older consumer-grade routers are more likely to need a hardware upgrade to support it properly.

How long does setting up network segmentation take for a small business?

On existing business-grade equipment, a basic segmentation setup typically takes a matter of days. That includes separating business systems, guest WiFi, and IoT devices. The larger time investment is making sure it’s configured correctly for the business’s specific device mix, so nothing like a point-of-sale system or networked printer breaks in the process.

What’s the difference between network segmentation and device management (MDM)?

They control different layers. Network segmentation manages what a device can reach once it’s connected: the network path. Mobile device management controls the device itself, enforcing encryption, pushing settings, and wiping it if it’s lost or an employee leaves. A well-protected small business network typically uses both. Segmentation limits where a compromised device can go. Device management limits what can happen to the device in the first place.