Many small companies assume they are too small to be targeted. In practice they are often an easy target: no IT department, reused passwords and backups nobody checks. A phishing email, ransomware or a hijacked mailbox can stop work for days and damage client trust.
1. Two-factor authentication everywhere
The single most effective step is enabling two-factor authentication for email, Microsoft 365 or Google Workspace, banking, accounting software and remote access. Even if a password leaks, an attacker cannot sign in without the second factor.
2. Updates and supported software
Operating systems, browsers, office software, routers and firewalls need regular security updates. Devices that no longer receive vendor support should be replaced. Centrally managed computers make updates far easier to control.
3. Backups that have actually been tested
The best defence against ransomware is a backup the attacker cannot reach and a restore you have already tested. Follow the 3-2-1 rule: three copies, on two types of media, one off-site.
4. Password manager and unique passwords
Reusing one password across services is a leading cause of breaches. A password manager lets the team use long unique passwords and share access securely instead of sending passwords by email.
5. User permissions and leavers
Give each employee only the access they need, and never use admin rights on an everyday account. When someone leaves, close their accounts and access on the same day using a simple checklist.
6. Email protection and phishing
Configure SPF, DKIM and DMARC for your domain so spoofed emails are filtered out. Train staff to spot suspicious invoices, links and requests to change payment details, and always confirm bank detail changes by phone.
7. Devices, network and an incident plan
Use up-to-date antivirus and disk encryption, separate guest WiFi and change default router and camera passwords. Write down who to notify, how to lock accounts and where to restore data from. Our IT support team can run a short security review — contact us.