Cybersecurity often gets treated as an enterprise problem — something for large organisations with dedicated security teams and big budgets. In reality, smaller businesses are frequently more exposed, not less: fewer resources dedicated to defence, and attackers who know it. The good news is that the fundamentals that prevent the large majority of incidents aren’t expensive or exotic — they’re mostly a matter of consistency.
The Basics That Prevent Most Incidents
Multi-factor authentication, everywhere it’s available. A stolen or guessed password stops being enough to access an account when a second factor is required. This single measure blocks the large majority of account-takeover attempts, and it’s free or low-cost on nearly every major platform.
A real patching routine. Outdated software with known, unpatched vulnerabilities is one of the most common ways attackers get in — not through sophisticated novel attacks, but through gaps that were publicly known and simply never closed. A regular, scheduled process for applying updates — operating systems, software, plugins, firmware — closes this gap far more reliably than an ad hoc “we’ll get to it” approach.
Proper access control. Not everyone in the business needs access to everything. Reviewing who has access to what, removing access when someone leaves or changes role, and avoiding shared logins all limit how much damage a single compromised account can do.
Backups that are actually tested. A backup you’ve never tried to restore from isn’t a real backup — it’s an assumption. Regular, automated backups, stored somewhere separate from your main systems (so a single incident can’t take out both), and periodically tested restores, are what actually protects a business from ransomware and data loss, not just the existence of a backup file somewhere.
The Human Element
Most successful attacks on smaller businesses don’t involve breaking through a firewall — they involve convincing a person to click a link, open an attachment, or hand over credentials. Phishing remains effective precisely because it targets people, not infrastructure.
Practical, low-cost measures that meaningfully reduce this risk:
- Regular, brief staff awareness training — not a one-off session years ago, but something refreshed periodically as tactics evolve
- A clear, low-friction process for reporting a suspicious email, so people flag things rather than quietly ignoring or, worse, clicking them
- A verification step for financial requests that arrive by email — a quick phone call to confirm before transferring money or changing payment details catches a significant share of business email compromise attempts
What This Costs, Realistically
None of the above requires enterprise-level budget. Multi-factor authentication is typically included with most business software at no extra cost. A patching routine is a process change, not a purchase. Access reviews take a few hours periodically. Backup solutions scaled for a small business are inexpensive relative to the cost of losing data entirely. Staff awareness training can be a short internal session rather than an expensive external programme.
The businesses that get hurt worst by cybersecurity incidents are rarely the ones that invested heavily and still got breached — they’re overwhelmingly the ones that had none of the basics in place at all. Getting the fundamentals right consistently closes off the overwhelming majority of realistic attack paths a small or medium business is likely to actually face.
Where to Start
If none of this is currently in place, the highest-value first steps, roughly in order, are: enable multi-factor authentication on anything that supports it, confirm backups exist and actually test restoring from one, and set a recurring time to review and apply pending software updates. Each is achievable within a day, and together they address the large majority of how smaller businesses actually get compromised.
