Every week, I walk into a new small business in the Tampa Bay area and find the same problems. Not because these are bad business owners. They just have not had anyone explain what good security looks like.
Windows Defender is not endpoint protection. It is a speed bump. We run Bitdefender GravityZone across every client device. It catches things that consumer antivirus does not even know to look for.
I cannot count the number of SonicWalls I have seen still running out-of-the-box configs. Default admin passwords. No intrusion prevention. A firewall that is not configured is not a firewall.
A backup that has never been tested is not a backup. It is a hope. And hope is not a disaster recovery plan.
When every employee has administrator access, a single phishing click can compromise your entire network. Principle of least privilege means people get exactly the access they need and nothing more.
The most dangerous setup is where Steve in accounting is also the IT guy. Steve is doing his best, but patches fall behind, alerts get ignored, and backups stop running for months without anyone noticing.