A small business rarely gets breached by a zero-day nobody has heard of. Far more often it is a server that has been missing patches since last spring, an admin console still sitting on default credentials, or a plugin someone installed for a campaign and forgot about. None of it is exotic. It is simply unmanaged.

A monthly routine fixes the unmanaged part. It does not require a security team, a large budget, or a platform migration. It requires a calendar entry, a list, and the discipline to keep both current.

Why Monthly Beats Quarterly

Quarterly reviews sound manageable until the pile is three months deep. A single cycle then turns into a two-week project nobody has time for, so it slips, and the pile grows again. Monthly keeps batches small enough to finish in an afternoon.

Twelve cycles a year also gives you twelve chances to improve the process. The first month will be messy: duplicate hosts, stale entries, findings you do not understand. The third will be faster. By the sixth you will know your network well enough to notice the one asset that does not belong.

Step 1: Keep a Living Asset List

Every scan is only as good as the list underneath it. You cannot patch what you do not know exists, and unlisted systems are where the surprises live. Start with a spreadsheet and these columns:

• Hostname or asset name
• Owner, meaning a person rather than a department
• Business function, described in plain language
• Operating system and version
• Internet-facing: yes or no
• Data sensitivity: public, internal, confidential
• Last patched or last reviewed date

Twenty to fifty rows is a reasonable starting point for most small companies. Pull candidates from DHCP leases, DNS records, your cloud console, and your endpoint management tool, then reconcile the duplicates by hand once. After that, update the list whenever something is added, retired, or rebuilt.

Step 2: Scan on a Fixed Schedule

Pick a date and repeat it. For most offices, an evening in the second half of the month works well, after the vendor patch releases have landed and before the next round arrives.

Scan with credentials

Unauthenticated scans report what a stranger sees. That is useful, but shallow. Authenticated scans log into the host and report installed software versions, missing updates, and local configuration. If you only do one, do the credentialed one, scoped to assets you own.

Look beyond missing patches

Patch gaps are one category of finding. Misconfigurations are the other, and they are often more urgent: a storage bucket open to the internet, a management interface reachable from anywhere, file sharing still enabled at the perimeter, an outdated TLS version, a service account with more rights than the job requires. A scanner will flag some of this. A short manual checklist on your internet-facing systems catches the rest.

Make the scan window boring. Same time, same scope, a note to staff the day before, and a named contact if something wobbles.

Step 3: Prioritize by Exploitability and Exposure

Sorting by severity score alone gives you a wall of red and no obvious place to start. The score describes the flaw, not your situation. Ask a short set of questions instead:

• Is this being exploited in the wild right now?
• Is there a public exploit, or only a theoretical one?
• Is the asset reachable from the internet?
• Does it hold regulated, financial, or customer data?
• If it failed, what stops working?
• Which other systems trust it?

Then sort into four buckets: fix within a few days, fix this month, plan for next quarter, and accepted with a documented reason. That last bucket is a legitimate option, not a failure, as long as someone signs off and the entry carries a review date.

Step 4: Remediate in Waves

Work the top bucket first, and give each item the cheapest effective fix. That is not always a patch. Disabling an unused service, moving an appliance behind a VPN, adding a firewall rule, or removing a plugin entirely can close a finding faster and with less risk than updating a system nobody is ready to reboot. Retiring a system that no longer earns its keep is the cleanest fix of all.

Before you touch anything, take a snapshot or confirm a working backup, and test on one representative machine where you can. Schedule the work in a maintenance window, tell the people affected, and write the rollback step down before you start. For anything internet-facing and actively exploited, skip the window and act immediately.

Step 5: Verify and Record

Rescan the specific finding rather than the whole estate. A closed ticket is not evidence; a clean scan of that host is. For each item, record the finding, the action taken, who did it, the date, and the evidence.

Exceptions deserve the same treatment. Write down why you are not fixing something, what compensating control is in place, who accepted the risk, and when it must be reviewed again. An exception with an expiry date forces a fresh decision instead of quietly becoming permanent.

Making It Stick

A realistic budget for a small team is a few hours a month across the five steps, plus whatever remediation the findings require. Protect it with a recurring calendar entry and one named owner, even if that is half of someone's Friday afternoon. If the owner is on leave, the cycle still runs.

Track three numbers and nothing more: assets scanned versus assets known, open critical findings past their due date, and average days from discovery to fix. Send a one-page summary to whoever signs the budget, written in plain language. Numbers trending the wrong way get attention far faster than a technical report.

The goal is not a clean report. It is a shorter list each month and a written reason for every item still on it. If your business handles regulated data, check with legal counsel or a compliance adviser about whether your obligations require a documented program with specific remediation timeframes.

Photo: Beate Vogl / Pexels