A small business secures its browsers by protecting what people do in them: turn on multi-factor authentication for email and key apps, keep browsers and operating systems updated, prefer phishing-resistant sign-in such as passkeys, restrict extensions, and manage saved passwords. Most of these cost little and none needs a security team.
Why focus on the browser?
For many small firms, the browser is the workplace. Email, accounting, file storage and customer systems all live in tabs. CISA's guidance for small businesses says its advice is built around how attacks actually happen, not older folk wisdom. It gives the example that avoiding a coffee shop's wi-fi was once sensible, but is not how people and organizations are compromised today. The common path is a stolen or phished login, or unpatched software.
So the useful question is not which browser to pick. It is how to make a stolen password worthless and a bad page harmless.
What should come first?
CISA calls MFA on key systems, especially email, the most important step. It adds that any form of MFA is better than none, but phishing is consistently the most cost-effective way into systems, and the widely available phishing-resistant option it names is FIDO, which is built into current browsers and phones.
Next is patching. CISA says many attacks succeed because victims ran vulnerable software when a newer version existed, and recommends enabling auto-update where possible and watching its Known Exploited Vulnerabilities Catalog. Browsers update themselves by default, but only if they are allowed to restart. Check that your staff are not postponing restarts for weeks.
What about extensions and saved passwords?
Extensions can read and change what you see on a page. We could not verify a single authoritative statistic on how often extensions are abused, so treat this as a risk to manage rather than a number. A reasonable policy for a small firm: allow a short list of approved extensions, block the rest through the browser's management settings, and review the list when staff join or leave.
Saved passwords in a browser are better than reused passwords, but a password manager with MFA gives better control, such as sharing and revocation. The NCSC's small organisations guide covers backups, protecting devices and accounts, and spotting scams in short steps, and a related NCSC blog discusses password managers and passkeys. The NCSC also states that one in two small businesses suffer a cyber incident every year, which is its own estimate, so read it as a general indicator.
How do you handle scams in the browser?
Training matters, but short and specific beats long and general. CISA's advice for the security program manager includes training all staff on enabling MFA, updating software, avoiding suspicious links and knowing how to escalate. Make reporting easy and blame-free. A staff member who clicked and says so within minutes saves you hours.
A constructed example
An eight-person design studio does four things in one afternoon. The owner enforces MFA on email and the file sharing service, and moves two people with admin rights to hardware security keys. The studio sets browsers to auto-update and checks the version on each laptop. It limits extensions to five approved ones. And it writes a one-page note: if you enter your password on a page you doubt, tell the owner immediately, and change it. Total cost is a few hours and two security keys.
How to check or apply this
- Enforce MFA on email, file storage, accounting and the admin consoles, starting with admins.
- Use passkeys or security keys wherever the service supports them.
- Turn on automatic updates for the browser and the operating system, and check them monthly.
- Approve a short list of extensions, and remove the rest.
- Use a password manager, and end browser password saving for shared accounts.
- Test your backups, because a successful phish can still end in ransomware.
- Write down who staff tell when something looks wrong.
Quick check
Do small businesses need a managed browser product?
Not to start. Built-in browser policies, MFA and updates cover most of the risk. Consider management tools when you grow past what you can check by hand.
Is SMS or app-code MFA good enough?
It is much better than no MFA. For email and admin accounts, move to passkeys or security keys when you can, because codes can still be phished.
Sources
- CISA, Cyber Guidance for Small Businesses
- NCSC, Small organisations guide to cyber security
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 18 October 2026.
