Picture a ten-person accounting office on a Friday afternoon. The office manager gets an email that looks exactly like the usual invoice reminder from a supplier, clicks the link, and types her Microsoft 365 password into a page that looks exactly like the usual login. By Monday, someone has quietly set up a mail rule that forwards every message containing the word "invoice" to an outside address, and two customers have paid into a bank account that belongs to neither the office nor the supplier. Nothing about this attack is sophisticated. That is the uncomfortable truth about small business cybersecurity: most incidents are not elite hackers defeating clever defences, they are ordinary tricks walking through doors nobody closed.
The good news is that the doors are well known. You do not need a security operations centre to close them. You need a handful of habits, a few settings switched on, and someone who owns the list.
Why small businesses are a target at all
Owners often assume they are too small to be interesting. Attackers do not pick targets one by one; they run automated campaigns against thousands of mailboxes and internet-facing systems and see which ones give. A small firm is attractive precisely because it usually has money moving through email, access to larger clients' systems, and nobody watching the logs.
Three kinds of attack account for most of the pain:
- Account takeover – a stolen or guessed password gets someone into email, accounting software or cloud storage.
- Business email compromise – the attacker uses a real or lookalike mailbox to redirect payments or request gift cards and transfers.
- Ransomware – files and servers are encrypted, often after data has been copied out, and the business is asked to pay for a key.
Every basic below is aimed at one or more of those three.
Cybersecurity basic 1: passwords that are long, unique and stored properly
The problem with passwords is not that people choose weak ones. It is that they reuse them. When some unrelated website leaks its database, attackers try the same email and password combination everywhere else – a technique called credential stuffing. If your staff use their work password for a shopping site, your mailbox is one breach away.
The fix is a business password manager (1Password, Bitwarden, Dashlane and Keeper all offer team plans). It generates a different long password for every site, fills it in automatically, and lets you share logins for shared accounts without pasting them into chat. Two side effects matter: when someone leaves, you can see and rotate everything they had access to, and because the manager only autofills on the real domain, it quietly refuses to fill your password into a phishing page.
Cybersecurity basic 2: multi-factor authentication everywhere it exists
Multi-factor authentication (MFA) means a password alone is not enough to log in; the person also needs a second factor, such as a code from an authenticator app, a push approval on their phone, or a hardware security key. It is the single most effective control on this list, because it turns a stolen password from a disaster into an annoyance.
Turn it on, in this order:
- Email and your identity provider (Microsoft 365 or Google Workspace) – whoever controls email can reset everything else.
- Banking and payment platforms.
- Accounting, payroll and CRM.
- Domain registrar and DNS – losing your domain means losing your email and website at once.
- Everything else that offers it.
Not all MFA is equal. SMS codes are better than nothing but can be intercepted through SIM-swap fraud. Authenticator apps are better. Push approvals are convenient but invite "MFA fatigue" attacks, where the attacker spams prompts until someone taps Approve – so enable number matching if your provider supports it. Passkeys and hardware keys are the strongest option because they are bound to the real website and cannot be phished.
Phishing prevention: train for the pause, not the quiz
Annual security-awareness slideshows do little. What works is teaching people one reflex: when a message creates urgency around money, credentials or secrecy, stop and verify through a different channel. If the "CEO" emails asking for an urgent transfer, call the CEO on the number you already have. If a supplier says their bank details changed, phone the supplier – never use the number in the email.
Back the reflex up with process and technology:
- Payment changes require a call-back to a known number and a second person's approval. Write this down; it is the cheapest control you will ever implement.
- Configure SPF, DKIM and DMARC on your domain so others cannot easily send mail pretending to be you, and so receiving servers can reject spoofed messages.
- Flag external email with a banner, so "your boss" writing from outside the company stands out.
- Make reporting easy and blame-free. The person who clicks and reports within five minutes is your best early warning. The one who clicks and stays quiet out of embarrassment is how a small incident becomes a big one.
Backups that survive ransomware
A backup is only useful if it still exists after the attack. Modern ransomware actively looks for connected backup drives and cloud sync folders and encrypts or deletes them too. Syncing tools like OneDrive or Dropbox are not backups on their own: they faithfully sync the encrypted files.
Follow the long-standing 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site. Add one modern twist – at least one copy should be immutable or offline, meaning it cannot be altered or deleted for a set retention period, even by an administrator account. Many cloud backup services offer this as object lock or immutable retention.
Then do the part almost everybody skips: test a restore. Pick a quarter, pick a folder or a mailbox, and actually bring it back. A backup you have never restored is a hope, not a plan.
Updates, devices and the boring rest
- Patch promptly. Turn on automatic updates for operating systems and browsers. For firewalls, VPNs and other internet-facing equipment, check for updates monthly – these devices are heavily targeted and often forgotten.
- Encrypt laptops with BitLocker (Windows) or FileVault (macOS), so a stolen bag is an insurance claim rather than a data breach.
- Give people the access they need, not admin rights by default. Most malware needs administrator privileges to do real damage.
- Run endpoint protection. The built-in Microsoft Defender is a reasonable baseline on Windows; managed EDR tools add monitoring and response.
- Offboard properly. Disable accounts the day someone leaves, and transfer shared logins from the password manager.
A small business cybersecurity checklist
| Control | Effort | What it stops |
|---|---|---|
| Password manager for all staff | Low | Reuse, weak passwords, some phishing |
| MFA on email, banking, DNS | Low | Most account takeovers |
| Payment-change call-back rule | Very low | Invoice and CEO fraud |
| SPF, DKIM, DMARC configured | Low | Spoofing of your domain |
| Immutable off-site backup + tested restore | Medium | Ransomware, accidental deletion |
| Automatic updates + disk encryption | Low | Known exploits, lost devices |
| Written incident contact list | Very low | Panic and delay on the worst day |
That last row deserves a sentence. Write down who you call if something goes wrong: your IT provider, your bank's fraud line, your cyber insurer if you have one, and the relevant national reporting body. Print it. During an incident, the shared drive may be the thing that is locked.
Start this week
You will not do all of this in a day, and you do not need to. Turn on MFA for email this week. Roll out a password manager this month. Set up and test an immutable backup this quarter. Each step removes a whole category of easy attacks, and attackers running automated campaigns move on to the next target the moment yours stops being easy. Good small business cybersecurity is mostly that: being a little harder to break into than the business next door, consistently, for years.
