Ask HN: IT security apps for small businesses

Hi there, I've had a few friends ask me about securing their businesses. One is in the health industry, and another in finance, and so both are fairly mindful they need to take security seriously.

They also don't have a lot of money to spend, so are keen to pick some SaaS apps that can help them rather than spend thousands on consultants.

Typically Their client records are stored in specialist vertical SaaS apps (out of scope), so they are mostly worried about cryptolocker type threats that will lock them out of their local desktops (Windows 7, 8 and 10). One has his web site on Wordpress/godaddy, the other uses Squarespace. Both just have standard-issue ISP modem/routers with default configuration (admin passwords changed).

What are your top security apps that I should be recommending to them? Is it sufficient to just recommend something like McAfee?