Small businesses spend 13.2% of IT budgets on cybersecurity. Experts suggest focusing on employee training, MFA,and practical defenses over costly tech.