What are the "best" tools and tool types for small businesses? What tools and types should be avoided?

I am talking companies of less than 200 people with a few IT people and a single security guy. By "best" I mean, what tools and coverage should a company of this size have? For instance, a SIEM seems like a waste of money given the lack of resources to manage it properly. EDR seems like it may be a better option.

businesses companies cybersecurity instance people security siem single size small businesses talking tool tools types waste