I do not run a small business, but I have some thoughts on the subject.
Most viruses enter through social engineering.
An employee clicks on a email link that supposedly comes from someone they think is legitimate.
There is no stopping that, we all make mistakes.
Windows security essentials is free, unobtrusive and is updated through windows updates.
It will catch many links to suspect web sites, but not all. It depends on a history of reported bad web sites.
It will look at the most common type of attacks, primarily those which have already been discovered.
More sophisticated programs will do more, trying to find viruses "in the wild" AKA those which have not been discovered yet. They are also more resource intensive. I think Kaspersky may be one of those.
But... in the end, you need to plan for recovery regardless.
Some sort of External backup is needed, not only for viruses or malware, but for fire, theft, hardware failure, or even simple employee mistakes.
If you have adequate recovery capability, perhaps expensive antivirus programs are not so much needed.