Ask a small business owner about cybersecurity and a common answer surfaces: “We’re too small to be a target.” The attackers’ spreadsheets disagree. Automated campaigns do not care about your headcount; they scan for open doors, and small organisations — rich in data, poor in defences — are exactly the doors that open. The good news is that most real-world breaches still exploit basics that are cheap to fix.
Passwords, then something better
The single highest-value change is multi-factor authentication on everything that offers it, starting with email — because email resets every other password. Guidance from the Cybersecurity and Infrastructure Security Agency consistently puts MFA at the top of the list for organisations of every size, ideally using authenticator apps or passkeys rather than texted codes. A password manager for the whole team kills the sticky-note economy and the reused password that links a breached hobby forum to your invoicing system.
Patching, backups and the human layer
Second: turn on automatic updates everywhere. The window between a vulnerability being announced and being exploited at scale is now measured in days, sometimes hours. Third: backups that are tested, offline or immutable, and boring — ransomware loses its leverage the moment a restore actually works. Fourth: the human layer. The UK’s National Cyber Security Centre runs free guidance and exercises for small organisations precisely because phishing remains the top entry route, and a team trained to report suspicious mail is a sensor network money cannot buy.
Fifth, and most neglected: know what you have. An inventory of devices, accounts and who has admin rights to what takes an afternoon and prevents the classic disaster — the forgotten server, the ex-employee’s active login. We publish plain-English security guidance for non-specialists in our Blog section, because the basics, done consistently, are what separate the teams that get breached from the teams that get tried and passed over.
There is a sixth discipline that ties the others together: rehearsed response. When — not if — a suspicious email is clicked or a laptop is lost, the first hour decides the damage. Who gets called? Which accounts get frozen first? Where is the backup, and who has actually restored from it? A one-page plan, printed and pinned where people can find it during a bad morning, outperforms any policy document in a shared drive nobody opens.
It is also worth retiring a comforting myth: that attackers choose victims by studying them. Most small-team breaches begin with automation — credential stuffing from old breach dumps, scanners probing for unpatched software, phishing sent by the million. The attacker did not choose you; your open door chose you. That is genuinely good news, because doors can be closed by ordinary diligence rather than genius.
Set a monthly thirty minutes: check updates applied, review who still has admin access, test one restore, read one new scam alert. Security for a small team is not a product you buy once. It is a habit you keep — and habits, unlike firewalls, cannot be unplugged by accident.