Small businesses get attacked because they are easy, not because they are valuable. Attacks are automated and indiscriminate: software scans thousands of targets looking for a weak password or an unpatched system, and whoever answers gets hit.
The good news is that the same automation means most attacks are unsophisticated. A short list of basic defenses stops the overwhelming majority.
The four attacks that account for most damage
Phishing. An email that looks legitimate convinces an employee to enter credentials on a fake page or open an attachment. This remains the entry point for most breaches, because it targets people rather than software.
Business email compromise. An attacker gains access to a real email account, watches the conversation for weeks, then sends an invoice with changed bank details at exactly the right moment. There is no malware involved, which is why filters miss it. Losses tend to be large because the payment looks entirely routine.
Ransomware. Files are encrypted and a payment is demanded. Small businesses are targeted specifically because they are less likely to have working backups and more likely to pay quickly.
Credential stuffing. Attackers take passwords leaked from unrelated breaches and try them across other services. It works because people reuse passwords.
The defenses that matter most
1. Multi-factor authentication, everywhere
If you do only one thing, do this. Requiring a second factor beyond the password blocks the vast majority of account takeovers, including credential stuffing and most phishing.
Turn it on for email first, because email is the master key: whoever controls it can reset every other password you own. Then banking, then your website admin, then everything else.
App-based codes or hardware keys are meaningfully stronger than SMS, because phone numbers can be hijacked. But SMS is far better than nothing, so do not let the perfect option delay you.
2. A password manager for the whole team
Password reuse is the vulnerability that keeps giving. A manager generates a unique password for every service and remembers them, which is the only realistic way for a human to stop reusing.
Business plans let you share credentials without sending them over chat, and let you revoke access instantly when someone leaves.
3. Backups you have actually restored
The rule is three copies of your data, on two different types of storage, with one stored off site. Ransomware that finds your backup on a connected drive will encrypt that too, so at least one copy must be offline or in immutable cloud storage.
The part everyone skips: test a restore. A backup you have never restored is a hope, not a backup. Try recovering a file once a quarter.
4. Updates, promptly
Most successful attacks exploit vulnerabilities that were patched months earlier. Turn on automatic updates for operating systems, browsers, and any website platform you run. If you use WordPress, that includes plugins, which are the most common way sites get compromised.
5. Verify payment changes by phone
This single policy stops business email compromise. Any request to change bank details, or any unexpected invoice, gets verified by calling a number you already have on file. Never a number from the email itself. Write the rule down, tell every employee who touches payments, and apply it even when the request appears to come from you.
Train people, briefly and often
Your staff are the target, so they need to know what to look for: urgency and pressure to act fast, a request that bypasses normal process, a sender address that is subtly wrong, links whose destination does not match the text, and any unexpected request for credentials.
Most important, make reporting safe. An employee who clicked something and is afraid to say so costs you far more than one who reports it in ten minutes. Say out loud that nobody gets in trouble for reporting a mistake quickly.
Limit what an intruder can reach
Give each person access only to what their job requires. Remove access the day someone leaves, not eventually. Use separate accounts for administrative work rather than doing everything as an admin. And keep customer data only as long as you actually need it, because data you deleted cannot be stolen.
Have a plan before you need one
Write down, on paper, who to call and what to do first. Disconnect the affected device from the network. Change passwords from a clean device. Contact your bank if money or payment data is involved. Preserve evidence rather than wiping the machine immediately.
Know your notification obligations too. Many jurisdictions require notifying affected customers within a fixed window after a breach involving personal data, and the deadlines are short.
What this costs
Multi-factor authentication is free. Automatic updates are free. A calling policy for payment changes is free. A password manager and reliable backup storage cost a small amount per user per month.
Cyber liability insurance is worth pricing once you handle meaningful customer data. Read the exclusions carefully, though: many policies require specific controls, and a claim can be denied if you did not have them in place.
