Small Business Cyber Resilience in Houston: Plan the Recovery

Most attacks start with a login, so the login is the first thing to lock.

Multi-factor authentication (MFA) means a password alone is not enough to sign in; the user also confirms with a phone app, key or code. Microsoft reports that MFA can block over 99% of identity-based attacks, which makes it the cheapest resilience step a small business can take.

Attackers prefer logins because a working password looks like a normal employee. Sophos found a lack of MFA in 59% of the cases it investigated for its 2026 report, and Microsoft says more than 97% of identity attacks are password attacks such as spraying common passwords across many accounts.

The Colonial Pipeline attack in 2021 is the best-known example. Colonial's CEO told a U.S. Senate committee that the attackers got in through a legacy VPN that used a compromised password and did not require multifactor authentication.

• Turn on MFA for email and Microsoft 365 first, then the VPN and any remote access tool.
• Give admin accounts the strongest option, such as an authenticator app with number matching or a hardware key. CISA calls this phishing-resistant MFA.
• Find the accounts that cannot do MFA, such as old shared logins, and retire or replace them.

A multi-factor authentication deployment for a 10-200 person office usually takes a few days, most of it spent helping staff enroll their phones.

A backup the attacker can reach is a backup the attacker can delete.

A ransomware-safe backup is one that a stolen admin login cannot change or delete. CISA's #StopRansomware Guide tells organizations to maintain offline, encrypted backups of critical data and to test them regularly, and an immutable offsite copy, locked for its retention period, meets the same goal.

Many small businesses have a backup that sits behind the same admin login as everything else. When an attacker takes that login, they can delete the backup before they launch the ransomware, and the business finds out only when it tries to restore.

Houston adds a second reason to keep a copy somewhere else. A backup in the same building, or the same flood-prone part of the Gulf Coast, can be lost to the same storm that takes the office down. CinchOps keeps Microsoft 365 backups and server backups as immutable, offsite copies outside the Gulf Coast flood zone, and verifies them.

The test for this step is one question to whoever runs IT: if someone stole our admin password tonight, could they delete our backups? If the answer is yes, fix that this week.

Attackers move in hours. Most small offices check in days.

Detection speed decides how much an attacker can do before someone stops them. In Sophos's Active Adversary Report 2026, attackers reached the Active Directory server a median 3.4 hours after getting in, while the median dwell time before discovery was three days.

That gap matters most for smaller companies. In the Sophos State of Ransomware 2026 survey, only 34% of organizations with 100 to 250 employees stopped the attack before encryption or extortion, compared with 46% of organizations with 3,001 to 5,000 employees.

A small office cannot staff a security team overnight, and it does not need to. Managed detection and response puts trained eyes on the alerts 24/7, so a login from an unusual place at 2 a.m. gets a response before the attacker reaches the server. CinchOps provides 24/7 threat monitoring; its office and help desk hours are Monday to Friday, 8 to 6.

Five steps, in order, agreed on by the owner before the attack.

A recovery order is a short, written list of what a business brings back first after a cyberattack. CISA advises restoring systems based on a predefined critical asset list, by priority of critical services, and for most small businesses that means contain, identity, email and files, revenue systems, then everything else.

• Contain and call: disconnect affected machines, then call the IT provider, the cyber insurer and FBI Houston at (713) 693-5000. Keep the phone list on paper, since email may be down.
• Identity next: reset every admin password, sign out all sessions and confirm MFA is back on before anyone logs in to anything else.
• Bring back email and files from a clean backup taken before the attack, so the restore does not bring the attacker back.
• Then the revenue systems, such as accounting, billing and the line-of-business app, in the order the owner chose in advance.
• Everything else comes last: printers, secondary laptops and the tools nobody misses for a day.

Texas law is one more reason to have the list ready. Under Texas Business and Commerce Code Section 521.053, a business must notify affected individuals no later than 60 days after it determines a breach occurred, and the Texas Attorney General within 30 days when 250 or more Texans are affected. The recovery order belongs inside a written incident response plan, and a tabletop exercise is the cheapest way to find out whether it works.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

• Identity: MFA deployment for email, Microsoft 365, VPN and admin accounts, with help enrolling every user.
• Backups: Microsoft 365 backup and backup and disaster recovery with immutable, offsite copies outside the Gulf Coast flood zone.
• Detection: managed detection and response and cybersecurity services with 24/7 threat monitoring.
• Recovery planning: tabletop exercises and CTO/CIO services help the owner set the recovery order and the call list.
• Local coverage: CinchOps works with businesses in Houston, Katy and The Woodlands, including law firms, CPA firms and manufacturers.

No small business can promise an attacker never gets in, but every one can decide what happens next. Turn on MFA this week, check that one backup sits out of reach, and talk to CinchOps about writing the recovery order.