Cybersecurity grants for small business: what's free in 2026

Are there cybersecurity grants for small businesses in 2026?

Very few go straight to a business. The Small Business Administration says it plainly: "SBA does not provide grants for starting and expanding a business."¹

Its cybersecurity pilot money goes to state agencies, which then offer training and counseling.² The 2026 round accepted applications only from Delaware, Michigan and Ohio, and it closed on October 1.³

What does exist is free help: scanning, advice and assessments from federal agencies, state programs and local centers. Many owners never use it. A 2021 House report put it this way: "small businesses are often unaware or reluctant to pursue federal assistance."⁴

1. Grants to you: rare. SBA's cyber money goes to states
2. Free from CISA: internet-facing scans and weekly reports, if you qualify
3. Free or low-cost locally: state programs, MEP centers, SBDCs, university clinics
4. Not free: actually fixing or moving your website

Four lines on one card. Each one is explained below.

Help, not cash.

Jeensuk's takeIf someone promises you a "guaranteed" cybersecurity grant for a fee, that's the first red flag. More on that in section 05.

What does CISA offer small businesses for free?

CISA, the federal cybersecurity agency, runs Cyber Hygiene services, which "are available at no cost."⁵ Its vulnerability scanning checks your internet-facing systems and sends "weekly reports of all findings." A separate web application scan looks at public websites for weaknesses and misconfigurations.⁵

Who can sign up is the fine print. CISA's page lists governments and "public and private sector critical infrastructure organizations."⁵ The SBA's guide, on the other hand, says "DHS also offers free cyber hygiene vulnerability scanning for small businesses."⁶ If you make things, you may fit: CISA's Critical Manufacturing sector includes "Machinery Manufacturing" and "Primary Metals Manufacturing."⁷ Whether your shop counts is CISA's call, so ask.

Two honest caveats. First, CISA's outreach staff has shrunk: Axios reported in 2025 that many employees who handled small business outreach "have either taken buyouts or been laid off."⁹ Replies may be slow. Second, if your website sits on shared hosting, the server's address belongs to your host, so talk to the host before you list it.

Jeensuk's takeOne email costs you nothing. The worst answer is "you don't qualify," and then you move on to section 03.

What help does my state or local MEP center offer?

It depends on the state, so start with NIST's Small Business Cybersecurity Support Programs Finder. It lists nonprofit programs that provide services directly, such as "conducting risk assessments and penetration tests, compliance services."¹⁰

When we checked on October 26, it listed 91 programs, most of them MEP centers (Manufacturing Extension Partnership) and university clinics. NIST adds that it "does not vouch for or validate the programs listed."¹⁰

A few examples show how different states are:

MEP centers are built for manufacturers. NIST describes their role as helping you "assess your business's current risk posture, identify any gaps, and implement solutions."¹⁵ Prices vary by center, so ask what's free before you start.

Jeensuk's takePick up the phone. Local centers are used to owners who say, "I don't know what I need yet."

How does this help with my cyber insurance renewal form?

Insurers ask about exactly this. One carrier's application asks: "Does the Applicant use any operating system, hardware or software that is no longer supported or is considered End-of-Life (EoL) by the manufacturer?"

It also asks how often you run external scans.¹⁶ A free CISA scan, if you get one, gives you a factual answer for that second question. It doesn't promise a lower premium.

Insurers ask because old software shows up in claims. Coalition, a cyber insurer, found "policyholders using EOL software were three times more likely to experience a cyber insurance claim."¹⁷ On October 21, 2026, it alerted policyholders running PHP and noted that "PHP 8.1 and older will not get an official patch."¹⁸ Your company website counts as software, and PHP is the engine under most WordPress sites.

Most commercial property and general liability policies do not cover cyber risks, and cyber insurance policies are highly customized for clients. — NAIC, "Insurance Topics: Cybersecurity"¹⁹

Your agent is the right person to talk to. In Nationwide's July 2026 survey, 42% of small businesses had cyber insurance, and 90% of agents said clients see them as "a credible source of cybersecurity information."²⁰ Answer the form truthfully. If you don't know, say so and find out; application forms warn that false information can be insurance fraud.²¹

Jeensuk's take"I'll check and get back to you" is a perfectly good answer to give your agent. A guess is not.

How do I apply for free cybersecurity help, step by step?

Do these four things this week. Steps 1 to 3 can run at the same time.

1. Email CISA. Send the email in section 02 and ask whether your business qualifies for Cyber Hygiene scanning.
2. Find your state's programs. Search the NIST Finder for your state, then call the MEP center or SBDC it lists.
3. Check your website. Find out whether it runs PHP and which version. Our free 30-second check shows whether it runs PHP from the outside, and your web designer or host can tell you the exact version.
4. Talk to your agent. Bring what you found and answer the renewal form with facts, not guesses.

Watch for scams along the way. The SBA warns: "Scammers may contact you promising "guaranteed" approval for an SBA loan or grant if you pay a fee upfront," and "Official SBA communications only come from email addresses ending in @sba.gov."⁶ CISA also notes that it "does not endorse any commercial product or service."²²

Jeensuk's takeFour steps, one week. Most of it is emails and phone calls you can make between jobs.

What won't free cybersecurity help do for my website?

It won't fix anything. CISA is clear that its scanning "cannot make any changes."⁸ You get a report and recommendations. Updating PHP, replacing an old plugin or moving the site is still work someone has to do.

The calendar matters here. Security support for PHP 8.2 ends on December 31, 2026, and 8.1 and older have already reached end of life.²³ WordPress recommends "PHP version 8.3 or greater."²⁴ If your site runs an older version, that's the "unsupported software" the insurance form is asking about.

Keep it in proportion, too. Coalition's own alert notes that most WordPress sites sit with hosting providers that roll out patched PHP, and that such sites can usually be restored quickly.¹⁸ For many owners, the fix is a short conversation with their host, not a big project.

Jeensuk's takeFree help finds the problem. Deciding who fixes it, and by when, is the part that's still yours.