Most small and mid-sized businesses are still running Microsoft 365 and Windows with weak defaults: no enforced MFA for everyone, legacy sign-in methods still allowed, open file-sharing, and basic email protections only half set...