The Questions I Use to Break Down SMB Security (After 10+ Years of Audits)

Most SMB security audits look thorough on paper. In reality, they miss the same basic problems every time.

After doing this for years, I stopped using long checklists and started focusing on a few questions that expose almost everything.

1. How would someone get in from the outside?

I’m not starting with tools, I’m starting with exposure.

What services are reachable from the internet right now?

Does anything rely on just a password?

Is there anything open that nobody can clearly justify?

You’d be surprised how often this alone turns up RDP, old VPN configs, or random ports left behind from past vendors.

2. If I had one user account, how far could I go?

This is where most environments fall apart.

How many people have elevated access?

Is MFA actually enforced everywhere or just in a few places?

Are there old accounts or service accounts that nobody owns anymore?

Most of the time, you don’t need an exploit. You just need one account and a little patience.

3. If something malicious ran on a laptop, would anyone notice?

This is where the “we have EDR” conversation usually starts to break.

Is every device actually covered?

Are alerts being reviewed, or just generated?

Are systems consistently patched, or just “on a schedule”?

Having a tool and having visibility are two different things.

4. What happens if data gets encrypted tomorrow?

Backups get talked about a lot. Recovery doesn’t.

Has anyone actually restored data recently?

Can backups be deleted or modified by the same accounts used day to day?

Does the business know how long recovery would take?

A backup that hasn’t been tested is just an assumption.

5. Where would an attacker hide or communicate from?

This is something most audits barely touch.

Is outbound traffic restricted at all?

Are DNS queries logged anywhere?

Is the network segmented, or is everything reachable once you’re inside?

Once someone is in, flat networks and no visibility make their job easy.

6. Who is actually responsible for security here?

This sounds simple, but it’s usually the biggest gap.

Is anyone actively reviewing logs or alerts?

Or is security just something IT “also handles”?

Most issues I find aren’t because the company didn’t buy tools. It’s because no one owns the outcome.

What I see over and over

Access is broader than anyone realizes

Basic protections exist, but aren’t enforced consistently

Backups exist, but recovery isn’t proven

Monitoring exists, but no one is really watching

The network is wide open once you’re inside

Most SMB compromises aren’t clever. They’re just taking advantage of things nobody checked closely.

That’s what I focus on now. Not more controls — just making sure the important ones actually hold up.