The problem security solutions solve
Most small businesses are not hit by a targeted attack but by the mass, random kind: phishing mail, ransomware in an attachment, stolen passwords and an unprotected laptop left somewhere. A feeling of being too small to matter is no defence.
The second common problem is protection that exists on paper. Antivirus has been bought but is missing on half the devices, nobody reads the alerts, and restoring from backup has never been tested.
Security works only alongside tidy access rights. If user management is unclear, look at IAM solutions first.