Small Business Cybersecurity: Where to Actually Start

Most small-business owners who call us about cybersecurity start the same way: they know they should be doing something, every vendor they talk to has a product, and they have no idea which of it matters. The result is usually paralysis, or a tool bought because it was the last one pitched.

Here's the honest version. The large majority of attacks on small businesses are not sophisticated. They're stolen passwords, phishing emails, unpatched computers and fake invoices. The defences against those are well understood, mostly cheap, and best done in a particular order. This is that order.

1. Turn on multi-factor authentication for email

If you do only one thing, do this. Email is the account that resets every other account, and a stolen email password is how most small-business compromises begin. Multi-factor authentication — a code or prompt on your phone as well as the password — stops the large majority of those attacks. It's included in Microsoft 365 and Google Workspace at no extra cost.

Then extend it to banking, payroll, accounting software, and anything that allows remote access to your network.

2. Make sure your backups would actually save you

Ransomware is a backup problem as much as a security problem. If you can restore everything from a clean copy, an attack is a bad week; if you can't, it's a ransom negotiation. That means at least one copy kept off-site or offline where ransomware can't reach it, and a restore that someone has actually tested. Our backup guide covers what "backed up" should really mean.

3. Keep everything updated

Most attacks exploit vulnerabilities that already had a fix available. Turn on automatic updates for operating systems and browsers, and check they're actually installing. Retire anything that no longer gets security updates — including any computer still on Windows 10, which stopped receiving them in October 2025.

4. Teach people the new phishing tells

The old advice — look for bad spelling — no longer works, because AI writes flawless phishing emails for free. What still works is structural: check who actually sent it, be suspicious of anything urgent that involves money or passwords, and verify by phone, on a number you already have, before changing anyone's payment details. Our free spot-the-phish quiz is a good ten-minute team exercise.

5. Stop sharing accounts, and close old ones

Shared logins mean you can't tell who did what, and you can't remove one person's access without changing it for everyone. Give each person their own account, and disable accounts the same day someone leaves. Former employees with working passwords are one of the most common findings in any security review.

6. Encrypt laptops

A stolen laptop with encryption turned on is a hardware loss. Without it, it's a data breach. BitLocker on Windows and FileVault on Mac are built in and free. Our guide to securing remote workers' laptops goes further.

7. Stop people sending email as you

Criminals can send email that appears to come from your domain unless your SPF, DKIM and DMARC records are set up correctly. That's how fake invoices reach your customers with your name on them. Our free email spoofing check shows whether your domain is exposed in seconds.

If you're in a regulated industry

Medical and dental practices have a specific legal framework on top of this — HIPAA requires a written risk analysis, staff training and business associate agreements. Our HIPAA checklist for a new practice covers that side, and the free HIPAA self-check takes two minutes.

Many other businesses meet similar expectations through contracts instead of regulation: a larger client's security questionnaire, or a cyber insurance application. The seven items above answer most of what either will ask.

When to get help

All seven are achievable without outside help if someone in the business has the time and the patience. If nobody does, or you want someone to check what's actually in place rather than what's supposed to be, our free IT audit is a good first look, and our security advisory service turns it into a short, ordered plan.