---
title: "What Should SMBs do With Little Security Budget and No Security Staff? | DuoCircle"
description: "If you haven’t heard, cyberattacks are a big problem. They’re an even bigger problem for small companies. Why is that? Two reasons."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/email-security/what-should-smbs-do-with-little-security-budget-and-no-security-staff/"
---

Quick Answer

SMBs with little security budget and no dedicated security staff should focus on the single highest-leverage control: stopping phishing. The Verizon 2019 DBIR showed 58% of SMBs experienced a cyber incident in 2018, and 91 to 93% of cyberattacks start with a phishing email. With a survey-reported median SMB security budget under $1,000 per year and 52% lacking any security staff, on-premises hardware and software are out of reach. Cloud-based phishing protection is the practical answer: no hardware, no software install, no maintenance, sets up in minutes, and runs around 30 cents per user per month. For 500 employees, that is well under the $1,000 ceiling and removes the largest single source of SMB compromise.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-security%2Fwhat-should-smbs-do-with-little-security-budget-and-no-security-staff%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=What%20Should%20SMBs%20do%20With%20Little%20Security%20Budget%20and%20No%20Security%20Staff%3F&url=undefined%2Fblog%2Femail-security%2Fwhat-should-smbs-do-with-little-security-budget-and-no-security-staff%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-security%2Fwhat-should-smbs-do-with-little-security-budget-and-no-security-staff%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-security%2Fwhat-should-smbs-do-with-little-security-budget-and-no-security-staff%2F&title=What%20Should%20SMBs%20do%20With%20Little%20Security%20Budget%20and%20No%20Security%20Staff%3F "Share on Reddit") [ ](mailto:?subject=What%20Should%20SMBs%20do%20With%20Little%20Security%20Budget%20and%20No%20Security%20Staff%3F&body=Check out this article: undefined%2Fblog%2Femail-security%2Fwhat-should-smbs-do-with-little-security-budget-and-no-security-staff%2F "Share via Email") 

![No Security Staff](https://media.mailhop.org/duocircle/images/2019/09/SMTP-email-8317.jpg) 

_If you haven’t heard, cyberattacks are a big problem_. They’re an even bigger problem for small companies. Why is that? Two reasons. First, because there are a lot of them and second, because they aren’t very well prepared.

Small and mid-size businesses (SMB) are the target of cyber-attacks quite often. “According to the Verizon 2019 Data Breach Incident Report ([DBIR](https://www.securityweek.com/verizon-publishes-2019-data-breach-investigations-report-dbir)), 58% of SMBs experienced a cyber incident in 2018.”

_SMBs are heavily targeted by cybercriminals because their cyber defenses aren’t very good_. Their cyber defenses aren’t very good because they just don’t have the resources: staff or money. According to an [article](https://www.securityweek.com/low-budgets-limited-expertise-plague-smb-cybersecurity) on the Security Week website, a new survey from Untangle querying 300 SMBs “found that 29% of these companies have an annual **security budget** of less than $1,000 per year. _Fifty-two percent have no dedicated security professional on staff._“

_A $1000 per year and no security staff, that’s pretty lean_. Common wisdom holds that you can’t do much security-wise with those constraints. The article confirms that belief. “With such low security budgets, there is **little room to improve** security through security products.” Maybe common wisdom is wrong on this point.

So, what should an SMB do with little security budget and no dedicated security staff? In other words, what’s the biggest security bang for the buck? Well, _they should start by recognizing the source of most cyber security problems and see if they can defend against that_.

What we do know is that somewhere between [91% and 93% of all cybercrimes and cyber-attacks start with a phishing email](https://www.securityweek.com/deepphish-project-shows-malicious-ai-not-dangerous-feared). So, if they can stop phishing attacks, a lot of SMB’s cyber headaches go away. And what does it take to **stop phishing attacks**? Less than you think.

SMBs don’t have the money to purchase endpoint hardware and software security products to stop phishing attacks, nor do they have the staff to install, configure and manage it even if they did. The good news for SMBs is that there is an alternative.

[![cyber criminals](https://media.mailhop.org/duocircle/images/2019/09/hosted-email-server-7358.jpg)](https://media.mailhop.org/duocircle/images/2019/09/hosted-email-server-7358.jpg)

Cloud-based [email security service](/) is the perfect solution for SMBs. There’s no upfront investment in hardware and software and no dedicated staff needed to get it up and running. More importantly, **cloud-based email security** is “fire and forget.” Once implemented, SMBs don’t have to give it another thought. It just works. No maintenance, no patching, no nothing. That’s exactly what time-strapped SMBs need.

Cloud-based email security must be expensive then. Not really. [DuoCircle](/email/phishing-protection) offers cloud-based [phishing protection](/email/phishing-protection), with real-time link click protection, for about 30₵ per employee per month. For a company with 500 employees, that’s well under the $1000 per month limitation.

Cyber-attacks are a problem. And SMBs are money and staff limited. But most cyber-attacks start with a phishing attack and SMBs can stop phishing attacks with little money and no dedicated security staff. _It’s time for SMBs to stop listening to common wisdom and protect their companies_.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

## Related Articles

[  Email Security 8m  BIMI in 2026: What the Certificate Authority Does, and What Your DMARC Tool Does  May 5, 2026 ](/blog/bimi-2026-what-the-ca-does-what-your-dmarc-tool-does/)[  Email Security 8m  Designing A Custom Dkim Architecture For High-Volume Email Senders  Apr 28, 2026 ](/blog/designing-custom-dkim-architecture-for-high-volume-email-senders/)[  Email Security 12m  DMARC, SPF, and DKIM in 2026: Why Email Authentication Is Now a Regulatory Requirement, Not Just a Best Practice  Apr 29, 2026 ](/blog/dmarc-spf-dkim-2026-email-authentication-regulatory-requirement-best-practice/)[  Email Security 5m  Email Monitoring Tools: A Complete Guide to Protecting Your Email Ecosystem  May 7, 2026 ](/blog/email-monitoring-tools-guide-protecting-your-email-ecosystem-security/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"What Should SMBs do With Little Security Budget and No Security Staff?","description":"If you haven’t heard, cyberattacks are a big problem. They’re an even bigger problem for small companies. Why is that? Two reasons.","url":"https://www.duocircle.com/blog/email-security/what-should-smbs-do-with-little-security-budget-and-no-security-staff/","datePublished":"2019-09-04T18:03:00.000Z","dateModified":"2025-05-02T17:04:23.000Z","dateCreated":"2019-09-04T18:03:00.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/what-should-smbs-do-with-little-security-budget-and-no-security-staff/"},"articleSection":"email-security","keywords":"","wordCount":481,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/09/SMTP-email-8317.jpg","caption":"No Security Staff","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Security"},{"@type":"ListItem","position":3,"name":"What Should SMBs do With Little Security Budget and No Security Staff?","item":"https://www.duocircle.com/blog/email-security/what-should-smbs-do-with-little-security-budget-and-no-security-staff/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"What Should SMBs do With Little Security Budget and No Security Staff?","item":"https://www.duocircle.com/blog/email-security/what-should-smbs-do-with-little-security-budget-and-no-security-staff/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"What Should SMBs do With Little Security Budget and No Security Staff?","description":"If you haven’t heard, cyberattacks are a big problem. They’re an even bigger problem for small companies. Why is that? Two reasons.","url":"https://www.duocircle.com/blog/email-security/what-should-smbs-do-with-little-security-budget-and-no-security-staff/","datePublished":"2019-09-04T18:03:00.000Z","dateModified":"2025-05-02T17:04:23.000Z","dateCreated":"2019-09-04T18:03:00.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/what-should-smbs-do-with-little-security-budget-and-no-security-staff/"},"articleSection":"email-security","keywords":"","wordCount":481,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/09/SMTP-email-8317.jpg","caption":"No Security Staff","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```