Small and medium businesses often assume they’re too small to be a target. Attackers see it differently. Smaller businesses tend to have fewer defences, less monitoring and money in the bank, which makes them an easy return.
The good news: you don’t need an enterprise budget to be much harder to breach. Most successful attacks exploit the same handful of gaps.
1. Turn on multi-factor authentication everywhere
Stolen and reused passwords remain one of the most common ways in. MFA on email, Microsoft 365 or Google Workspace, banking, remote access and admin accounts blocks most of these attacks outright. Start with email and admin accounts this week.
2. Patch and update, on a schedule
Unpatched laptops, servers, firewalls and VPNs are open doors. Set a monthly patch routine, switch on automatic updates where you can, and replace equipment that no longer gets security updates.
3. Back up properly, and test the restore
Ransomware turns a bad day into a business-ending week if you can’t recover. Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy offline or immutable. Then test a restore. A backup you’ve never restored is only a hope.
4. Train your people to spot phishing
Most attacks still start with an email, a fake invoice or a “please update your banking details” request. Short, regular awareness training, plus a simple rule (verify payment changes by phone, using a number you already have), stops a lot of fraud.
5. Watch your network, 24/7
Attackers often sit inside a network for days before they strike, and they like to strike at night and over weekends. Endpoint protection with 24/7 monitoring and response means someone notices, and acts, before the damage is done. For most SMBs, a managed SOC or MDR service is far more affordable than building an in-house team.
Don’t forget POPIA
Under the Protection of Personal Information Act, a business that suffers a security compromise involving personal information must notify the Information Regulator and the affected people. Good basics reduce the chance of ever having to make that call. Our compliance services page explains what POPIA and the other recent laws require.
Where to start
If you only do one thing this month, switch on MFA. If you do two, test your backups. If your firm is regulated by the FSCA or the Prudential Authority, take our free 3-minute JS2 readiness check. And if you’d like a clear picture of where your business stands, book a consultation with iCloudz.