Emily Hartley
Why Small Businesses Are Targeted More Than You Think
There is a stubborn myth that cyber criminals only bother with large corporations. In reality, a two-person consultancy or a five-person workshop is an ideal target. You hold client data, you move money, and you rarely have an IT department watching the door. Most attacks are automated and indiscriminate — a script scanning thousands of addresses at once does not care about your turnover.
The encouraging part is that the overwhelming majority of incidents rely on a handful of simple weaknesses: a reused password, a missing second layer of login security, or a member of staff who clicks before they think. Close those gaps and you will see off the bulk of what lands in your inbox. None of it demands a big budget. It demands a couple of focused afternoons and a habit of checking.
Sort Out Your Passwords Once and For All
If you take one thing from this article, make it this: stop reusing passwords. When a website you barely remember is breached, criminals take that email and password combination and try it everywhere else. That is how a leaked login for a forgotten forum becomes a compromised business bank account.
- Use a password manager to generate and store long, unique passwords for every account. You then only need to remember one strong master passphrase.
- Make that master passphrase long rather than complicated. Four or five unrelated words strung together will beat "P@ssw0rd1" every time, and you can actually recall it.
- Give every member of staff their own login. Shared accounts make it impossible to trace who did what, and impossible to revoke access cleanly when someone leaves.
- Prioritise your email, banking and cloud storage accounts first, then work through the rest over the following few weeks.
Turn On Two-Factor Authentication Wherever It Is Offered
Two-factor authentication, often shortened to 2FA, adds a second step at login: something you have as well as something you know. Even if a criminal steals your password, they still cannot get in. It is the single highest-value setting you can switch on, and it usually takes under two minutes per account.
- Start with email. Your inbox is the master key to everything else, because password resets land there.
- Choose an authenticator app or a hardware key over text messages, as codes sent by SMS can be intercepted or stolen through SIM-swapping.
- Save the recovery codes somewhere offline — a printed sheet in a locked drawer is perfectly sensible.
- Apply 2FA to administrator accounts first, including your accounting and payroll software, then roll it out to the whole team.
Teach Your Team to Spot a Phishing Email
Phishing remains the most common way small firms are breached, because it targets people rather than technology. The emails are often genuinely convincing: a supplier with a slightly altered address, a "remittance advice" attached as a document, a message from a director asking for an urgent favour while they are "in a meeting".
- Watch for urgency and secrecy. Legitimate requests rarely demand immediate action or ask you to keep quiet.
- Check the full sender address, not just the display name, and hover over links before clicking to see where they really lead.
- Treat any request to change bank details as suspicious by default. Verify it by phoning the supplier on a number you already hold, never one supplied in the email.
- Make reporting easy and blame-free. Someone who admits a mistake quickly saves you far more than they cost, and early reports let you reset passwords and warn clients straight away.
A five-minute reminder in your monthly team meeting, plus the occasional simulated test, keeps everyone sharp without turning the office into a surveillance zone.
Keep Devices Updated and Backups Tested
Software updates are unglamorous but they matter, because most updates include fixes for security holes that criminals already know how to exploit. Switch on automatic updates for operating systems, browsers and any business applications you rely on, and let them install overnight.
- Encrypt laptops and phones, and set automatic screen locks after a few minutes of inactivity.
- Give visitors a separate guest Wi-Fi network so their devices never sit on the same network as your files.
- Remove accounts and access for former staff and contractors the day they leave, including cloud storage and any shared subscriptions.
- Follow the 3-2-1 rule for backups: three copies of your data, on two different types of media, with one kept off-site or offline.
Crucially, test a restore. An untested backup is a hopeful guess, and you want to discover it is corrupted on a quiet Tuesday rather than in the middle of a crisis.
Have a Plan for the Day Something Goes Wrong
Assume you will face an incident at some point, and decide now how you will respond. A one-page plan, printed and kept somewhere offline, is worth more than a lengthy policy nobody has read.
- List who to call, including your IT support, bank, insurer and key clients, with phone numbers rather than email addresses.
- Disconnect affected devices from the network, but do not wipe them — evidence helps insurers and investigators.
- Report the incident to the National Cyber Security Centre and, for fraud, to Action Fraud, so others benefit from what you have learned.
- Change passwords from a different, trusted device, and tell anyone whose data may have been exposed.
Run through the plan once a year with your team. Rehearsal turns panic into a checklist, and that is exactly what you want when the pressure is on.
