Endpoints, Patching & Privilege for Small Business
Section updated .
Small-business endpoint security is four jobs: patch known exploited vulnerabilities first, know what you expose to the internet, remove local administrator rights from everyday accounts, and switch on the protection already built into your operating system. The order matters: a flaw that attackers are already using is more urgent than a higher-scored flaw that nobody has used.
The Cybersecurity and Infrastructure Security Agency keeps a public catalogue of vulnerabilities known to be exploited in the wild. For a small business with limited time, that list is the most useful patching priority there is, because it removes the guesswork about which flaws are real threats.
These guides show how to use it, how to find the devices on your own network edge that attackers scan first, how to limit damage when a laptop is compromised, and which built-in protections to turn on before buying anything.
Guides in this section
Patching known exploited vulnerabilities
Use the CISA KEV catalogue to decide what to patch first, and what to do when you cannot patch today.
Read the guide →Internet-facing exposure
List the VPNs, firewalls, remote-access tools and servers visible from outside, and decide what should not be.
Read the guide →Local admin rights and privilege
Take administrator rights away from daily accounts and keep admin work on separate, protected accounts.
Read the guide →Endpoint protection hardening
Switch on and verify the antivirus, firewall and exploit protections already built into Windows and macOS.
Read the guide →How to work through this section
Start with patching known exploited vulnerabilities. Then list your internet-facing exposure, because that is where urgent patches matter most. Remove standing rights with the local admin guide, and finish with endpoint protection hardening using the controls you already own.
Thursday is endpoint day in the daily briefing: check the KEV list against your inventory every week.
Frequently asked questions
What is the CISA KEV catalogue?
The Known Exploited Vulnerabilities catalogue is a list maintained by CISA of vulnerabilities with evidence of active exploitation. It is free, public and available as a feed.
If I patch a vulnerable device, am I safe?
Patching stops new attacks through that flaw. It does not remove an attacker who got in before the patch. For an exploited flaw on an internet-facing device, also check for signs of compromise.
Do small businesses need to remove local admin rights?
Yes where practical. Daily work rarely needs administrator rights, and removing them limits what malware or a stolen session can change.
Is built-in antivirus enough?
For many small businesses, a properly configured built-in product plus monitoring is a sound baseline. What matters is that it is on, updated, centrally checked and backed by the other controls.
Be first when the email edition starts
The briefing is published on this site every morning. The email edition is not sending yet — leave your address and you’ll be among the first told when it starts. Nothing is sent in the meantime.