Walk into any small business after a breach and you will find a good firewall, still running, still patched, still doing its job. That detail surprises owners every time. The perimeter held. The problem walked through the front door with a valid password.
How incidents actually start
Across the incident work we see, the opening move is almost never a defeated appliance. It is a password reused from a site that got breached two years ago. It is an email that looked enough like the bookkeeper’s to get a reply. It is the account of an employee who left in March and could still log in come October. None of those are technology failures. They are habit failures, and no box on a shelf fixes a habit.
The habits that do the work
Offboard on the day someone leaves, not at the end of the quarter. Their accounts, their VPN, their saved sessions, their shared passwords, all of it, same day. Enforce MFA everywhere it exists, including the systems that feel too small to matter, because attackers specifically hunt for the ones you skipped. Review admin rights on a calendar, not on a hunch; the number of people with domain admin should make you slightly uncomfortable and then get smaller. And rehearse the phishing conversation until reporting a click feels routine instead of shameful, because the difference between a Tuesday report and a Friday confession is often the difference between an incident and a headline.
Where the firewall fits
Keep it. Patch it. Let it do the job it is genuinely good at, which is being one layer among several. But when the budget conversation happens, remember that the cheapest security improvements available to you are behavioral: an offboarding checklist, an MFA mandate, a quarterly access review. They cost hours, not thousands.
The uncomfortable summary: your network is probably defended better than your routines are. Fix the routines and the hardware you already own gets dramatically more effective.
The firewall is one layer. Habits are the rest.
If this sounds like your shop, start with a one-page routine: same-day offboarding, MFA everywhere, quarterly access reviews, and a no-blame phishing report button. Our security and compliance practice builds exactly that discipline into managed environments, and CISA’s Secure Our World guidance backs every one of those basics for small businesses. The firewall keeps its job. It just stops working alone.
Want to know which habits your environment is missing? The free assessment maps them in plain English — no obligation, no lecture.
