Why I Tell Every Small Business to Get a Password Manager Before Antivirus

If you ask most IT companies what to buy first, they'll say antivirus. Maybe a firewall. Something they can point at on a quote and explain.

I say get a password manager first. Every time.

That's not a hot take for its own sake. It's just where the actual risk is for a small construction or trades company. And after working with enough of these businesses in the Willamette Valley, I've gotten pretty comfortable saying it out loud even when it sounds backwards.

The Antivirus Problem

Antivirus protects you from malware that tries to sneak onto your machine. Files, downloads, phishing links that drop something bad.

What it doesn't protect you from is someone logging into your accounts with a password you've been using since 2014.

For a 10-person framing crew or a small GC, that's a far more common threat. Nobody's writing custom malware to target a residential remodeler in Lebanon, Oregon. But credential stuffing attacks hit everybody. They're automated, they run constantly, and they don't care who you are. All they need is a username and password from one of the thousand data breaches over the last decade. If you've been reusing passwords, there's a real chance something you use is already out there.

What Actually Happens When Credentials Get Compromised

It usually doesn't look like a movie scene. Nobody locks your screen and demands Bitcoin at 2pm on a Tuesday.

What tends to happen is quieter. Someone gets into an email account, watches for a few days, learns who the vendors are, who owes money, what job is closing. Then they redirect a payment. Wire fraud is a big problem in construction specifically because the payments are large and the communication is usually informal.

Or they get into QuickBooks. Or they start using your Microsoft 365 account to send spam until you get blocklisted.

Antivirus doesn't stop any of that if they have the right password.

Why It's Not as Hard as It Sounds

You hand someone new software and tell them they need to change how they log into everything, and it feels like a big lift. Especially when the office manager is wearing five hats and the owner is out walking a bid half the day.

But here's what it actually looks like. You set up Keeper for the company, everyone gets a vault, and you pick the five or six most critical accounts to start. Email. QuickBooks. Bank portal. Project management software. Get those moved over and that's week one done.

Then it just becomes the way things work. The manager stops keeping a sticky note on the monitor. The new hire gets access to what they need without someone having to text them a password. And when someone quits, you reset one vault instead of wondering what accounts they knew.

Where Antivirus Fits

I'm not saying skip antivirus. I'm saying do it in the right order.

Once you've got credentials locked down, unique passwords on everything important, and multi-factor authentication turned on for email and banking, then yes, get endpoint protection. Especially if your crew is using personal laptops or working on job site networks you don't control. Our full cybersecurity service covers both layers once the foundation is in place.

But the password situation is almost always more urgent. And it's almost always the one that gets skipped because it feels like a process problem, not a security problem.

It's both.

Where to Start

Keeper is what I put most of my clients on. It works across every device, the business version has shared vaults and admin controls, and the offboarding workflow alone is worth the subscription price.

If you want to start this week, here's a reasonable first pass: set up an account, add your five most critical logins, and turn on multi-factor authentication for your email. That alone puts you ahead of most small businesses I walk into for the first time.

The rest we can build from there.