Practical security writing for small and mid-sized businesses — passkeys, MFA, endpoint hygiene, and the controls that matter when you can't afford a CISO.
Thirty years of "longer, more complex, rotated more often" produced sticky notes and password reuse. The actual move in 2026 is to stop typing passwords altogether.
Most small businesses won't have a dedicated incident response team. The playbook still works — it's just shorter.
Forcing people to change their password every 90 days makes them write it down. NIST quietly dropped the recommendation eight years ago.
Security at a 50-person company doesn't need to be exotic. It needs to be present. Here's the short list, in order of leverage.
