TL;DR:

  • Meaningful cybersecurity doesn’t require a big budget — several genuinely useful tools are completely free
  • Have I Been Pwned, Bitwarden, and Cloudflare 1.1.1.1 address three major risk areas at zero cost
  • The NCSC provides free resources, assessments, and alerts specifically designed for small UK organisations

A small business doesn’t need to spend thousands on cybersecurity to be meaningfully protected. The tools below address credential compromise, password hygiene, DNS-based threats, browser-based attacks, and organisational awareness — all for free or near-free. None require technical expertise to set up. Work through the list and you’ll have addressed a substantial portion of your risk before spending a penny.

1. Have I Been Pwned (haveibeenpwned.com)

What it does: Checks whether your email address has appeared in a known data breach — and which breach it came from.

Why it matters: Stolen credentials from old breaches are used in automated attacks against business accounts constantly. If your email address (or your team’s) appears in a known breach, that password should be considered compromised everywhere it was used.

Go to haveibeenpwned.com and enter your business email address. If results appear, change that password immediately on every account where you used it. Then enable the free domain monitoring feature — it alerts you any time any email address at your domain appears in a new breach.

Time to set up: 5 minutes.

2. Bitwarden (bitwarden.com)

What it does: A free, open-source password manager. Generates and stores a unique, random password for every account. Available on all platforms with browser extensions and mobile apps.

Why it matters: Password reuse is the root cause of most credential-based attacks. One breached site unlocks a dozen accounts if you use the same password everywhere. Bitwarden eliminates this.

The free tier is genuinely usable — unlimited passwords, all devices, browser extensions, and the core vault features are free for personal accounts. The Teams plan adds admin controls, sharing, and reporting for around £2–3 per user per month. Even the free version is a significant step up from no password manager at all.

Create an account at bitwarden.com, install the browser extension, and start adding accounts. Use the “Generate Password” feature when setting new passwords.

Time to set up: 15 minutes for you, then share the link with your team.

3. Google Workspace Security Centre (for Google Workspace users)

What it does: A free dashboard inside Google Workspace admin that shows security health — suspicious sign-ins, devices accessing your account, users without MFA, and potential data exposure.

Access it via Google Admin Console → Security → Security health. Run the Security Health Checkup wizard. Key things to review: users with MFA disabled, apps with excessive permissions, and external sharing settings for Google Drive.

Time to review: 20 minutes initially, then quarterly.

4. NCSC free resources (ncsc.gov.uk)

What it does: The UK’s National Cyber Security Centre provides free assessments, guides, checklists, and alert subscriptions specifically designed for small and medium businesses.

The NCSC’s Cyber Essentials scheme is particularly valuable — it’s a government-backed certification that costs from around £300 and signals to clients, insurers, and the ICO that you’ve got baseline security controls in place. Many UK insurers offer lower premiums for Cyber Essentials-certified businesses.

The Early Warning service (free) alerts you when NCSC detects malware or data compromises associated with your IP addresses. The NCSC’s Exercise in a Box tool lets you run a free simulated incident response exercise with your team.

Sign up at ncsc.gov.uk — all free, all written for UK businesses.

Time to set up: 30 minutes to review and sign up for alerts.

5. Cloudflare 1.1.1.1 (1.1.1.1)

What it does: A free DNS resolver that’s faster than most ISP-provided DNS, privacy-respecting, and — via Cloudflare Gateway — can block malicious domains before your devices even try to connect.

DNS is the phonebook of the internet — every website visit starts with a DNS lookup. Malicious domains (phishing sites, command-and-control servers for malware) can be blocked at the DNS layer before any harmful content is loaded.

1.1.1.1 for Families blocks malware and adult content at no cost, just by changing your router’s DNS settings to the provided addresses. Cloudflare Gateway (free for up to 50 users) gives you more control, logging, and policy options.

Log into your router admin panel and change the DNS settings to 1.1.1.1 and 1.0.0.1. This protects every device on your network instantly.

Time to set up: 10 minutes.

6. uBlock Origin (browser extension)

What it does: A free, open-source browser extension that blocks ads, trackers, and malicious scripts. Available for Chrome, Firefox, Edge, and Safari.

Malvertising — malicious advertisements embedded in legitimate websites — is a common way malware is delivered to business devices. uBlock Origin blocks the vast majority of these, along with the tracking scripts that build profiles of your browsing behaviour.

Search for “uBlock Origin” in your browser’s extension store, install it, and leave the default settings in place — they’re already well-configured.

Time to set up: 2 minutes per browser.

7. Authy (authy.com)

What it does: A free authenticator app for MFA codes, with encrypted cloud backup and multi-device support.

An authenticator app is strongly preferred over SMS codes for MFA. Authy adds encrypted backup so you can recover your codes if you lose your phone, and lets you access codes on multiple approved devices.

Download Authy on your phone and use it when setting up MFA on any account that supports an authenticator app.

Time to set up: 5 minutes.

8. Firefox Monitor (monitor.mozilla.org)

What it does: Mozilla’s breach monitoring service — similar to Have I Been Pwned, but with a persistent monitoring dashboard and integration with the Firefox browser.

Use both: haveibeenpwned.com for domain monitoring, Firefox Monitor for an ongoing personal dashboard. Both are free and draw from overlapping but not identical breach databases. More monitoring is better.

Your setup checklist

  • Check your email at haveibeenpwned.com and enable domain monitoring
  • Install Bitwarden and start adding passwords
  • Change your router DNS to 1.1.1.1 and 1.0.0.1
  • Install uBlock Origin in every browser you use for work
  • Download Authy and set up MFA on your email account
  • Sign up for NCSC alerts and Early Warning at ncsc.gov.uk
  • Run the Google Workspace Security Health Checkup if you use Google Workspace

Bottom line

A meaningful security baseline is achievable with zero budget. The tools above cover credential monitoring, password management, DNS filtering, browser protection, MFA, and threat intelligence — the foundations of a solid security posture. Set them up this week, then look at paid options where the gaps are largest.