The Monthly IT Security Check Every Small Business Needs

Most owners only look at their IT when something has already gone wrong. A file won't open, a laptop won't start, or an invoice gets paid into a scammer's account. Fixing it at that point costs more than preventing it would have. Almost none of it happens without warning. The backup that fails when you finally need it had been failing for weeks. The account a scammer used belonged to someone who left last year. A monthly IT security check is usually enough to catch that kind of thing before it becomes expensive.

The 30-Minute Monthly IT Security Check: What Small Businesses Should Review

The check covers six things that tend to go wrong quietly: updates sitting uninstalled, backups that stopped running, accounts belonging to people who left, multi-factor authentication not turned on, devices nobody recognizes, and software subscriptions nobody is using. The goal is not to become your own IT department. It is to notice the warning signs while they are still cheap to fix, and to know what to hand off to your IT provider before it becomes a real problem.

🔑 Key Takeaways

• Unpatched software is now the top way attackers get in, ahead of stolen passwords, according to the 2026 Verizon Data Breach Investigations Report.

• The median time to patch a known vulnerability has risen to 43 days, giving attackers more room to exploit the gap.

• A 30-minute monthly check covers updates, backups, user access, MFA, devices, and subscriptions.

• Most problems caught in this check are small and fixable in minutes; the ones that aren't go straight to your IT provider.

Why a Monthly Look Is Worth the Time

Verizon's 2026 Data Breach Investigations Report found that 31 percent of breaches now start with attackers exploiting software that had not been patched. That makes unpatched software the most common way in, ahead of stolen passwords. The same report found the median time to fully fix a known problem has risen from 32 days to 43 days, a 34 percent increase. Most attacks use a problem that was already known, with a fix already available. Nobody had installed it yet.

This check is not about replacing your IT provider. It is about catching the business-side problems that monitoring tools cannot know: who left, which subscription nobody approved, and whose laptop is whose.

✅ The Check

1. Updates

Check whether Windows updates are installing on your computers, or sitting at "restart required" week after week. Do the same for phones and for the software you use most, like your browser and your accounting app. If people keep clicking "remind me later," that is something to fix.

2. Backups

Open your backup tool and look at the last few runs. You want recent successful backups, not a list of errors. Then check when anyone last restored a file from it. If it has never been tested, you do not know whether it works.

3. Who Has Access

Pull up the list of user accounts in Microsoft 365 or Google Workspace and read through it. Every name should be someone who still works for you. Look for people who left, contractors who finished months ago, and shared logins like "office" or "admin" that several people use. Switch off anything you do not need.

4. Multi-Factor Authentication

Check that MFA is switched on, and that it is on for everyone, not just the people who set it up first. Pay closest attention to admin accounts and anyone who handles money. Microsoft's research shows MFA blocks 99.9% of account compromise attacks.

5. Devices

Look at what is connected to your systems. If there is a laptop or phone you do not recognize, find out whose it is. While you are there, check that laptops are encrypted and that any phone with company email on it has a passcode or fingerprint lock.

6. Subscription and Licenses

Open your billing page and read what you are paying for. Businesses regularly pay for licenses belonging to people who left, or for two tools that do the same job. It is also how you find software somebody signed up for without telling anyone.

Make It a Routine

Put it in the calendar on a fixed day, like the first Monday of the month, and give it to the same person each time. That is you or whoever handles the admin side.

Keep a running note of what you checked and what you found. After a few months you will see whether the same problem keeps coming back. If it does, it needs fixing properly instead of clearing each time.

Thirty minutes only works if you do not stop to fix things along the way. Write down what you find and deal with it afterward.

Who Fixes What

Most of it is small, like a laptop that needs restarting, a license to cancel, or an account to switch off. Handle those yourself.

Send the rest to your IT provider: backups that keep failing, MFA that won't turn on for someone, a device nobody recognizes, or updates that fail on the same machine every month. Those usually mean there is a bigger problem behind them.

What This Check Doesn't Do

It is not monitoring. A good IT provider has tools watching your systems all day and flagging things you would never spot from a monthly glance.

The check covers what those tools cannot know. You know who left, which subscriptions you approved, and whose laptop is whose.

Frequently Answered Questions (FAQs)

How often should a small business check its IT?

Once a month is enough for this list. Backups are worth a quick look more often if losing a day's work would seriously hurt, since that is the item most likely to fail quietly.

Who should do it?

You or whoever runs the admin side of the business. Most of the list needs no technical skill, just someone who knows who works there and what the business pays for.

What if I don't know where to find any of this?

Ask your IT provider to walk you through it once and write down where each thing lives. Many will also send you a monthly summary covering most of it..

Isn't this my IT provider's job?

They handle the monitoring, the patching, and the fixing. The check is the part that depends on knowing your business, like who left last month or which subscription nobody approved.

If I only have ten minutes, what matters most?

Backups and updates. Without working backups you can lose everything you have stored, and unpatched software is now the most common way attackers get in.

Does this apply if everything we use is in the cloud?

Yes. Cloud tools still need updated devices, working backups, MFA switched on, and access lists that match who actually works for you.

ABOUT THE AUTHOR

DeLano Hornbuckle

President & Chief Security Consultant - DH Solutions

DeLano Hornbuckle is the President and Chief Security Consultant at DH Solutions. A former Westland City Council member with a lifelong commitment to the Metro Detroit community, DeLano bridges the gap between public-sector accountability and elite technical defense.

He holds advanced industry certifications including Fortinet NSE 1-7, EC-Council Certified Network Defender, and Cisco CCNA. Guided by the mission to help local firms "do more with less" through smarter IT, DeLano is dedicated to defending your digital world with enterprise-grade protection tailored for the small business scale.

---

Republished with Permission from The Technology Press

Image Source