How to Reduce Cybersecurity Risks: The Basics Every Business Should Know

Here’s the unglamorous truth about how most small businesses get hacked: it usually isn’t a genius in a hoodie. It’s a password someone reused, a VPN box nobody patched, or an invoice email that looked just real enough.

Verizon’s 2024 Data Breach Investigations Report found that most breaches involved an ordinary person making an honest mistake: clicking a link, misconfiguring something, or believing a convincing story. The same report saw break-ins through unpatched vulnerabilities more than double in a single year.

So before you buy anything new, get these five things right. None of them need a security team, and most of them fit in a weekend.

1. Turn on MFA, then fix your passwords

If you do one thing this week, make it multi-factor authentication. Microsoft says MFA stops almost all automated attempts to take over an account. It’s the cheapest big win there is.

Start where a break-in would hurt most:

• Email (Microsoft 365 or Google Workspace). Your inbox is the reset button for every other account you have.
• Banking and payroll.
• Your domain registrar and DNS. Lose those and someone else controls your website and your email.
• Admin accounts for anything in the cloud.

Use an authenticator app or a hardware key instead of text messages where you can. SMS codes beat nothing, but SIM swapping is real.

On passwords, the old rules are out. You know the ones: eight characters, one capital, one symbol, change it every 90 days. NIST’s current guidance (SP 800-63B) drops forced complexity and scheduled changes. What matters is length, never reusing a password, and blocking passwords that already show up in breach dumps. A password manager handles all three for you. Give everyone on the team one, and pay for the business plan so you can take access back the day someone leaves.

2. Patch what faces the internet first

You won’t patch everything on day one, and that’s fine. Go in this order:

1. Anything reachable from the internet: firewalls, VPNs, remote access tools, your website’s CMS and its plugins.
2. Laptops and phones, with automatic updates switched on.
3. Everything else.

For that first group, keep an eye on CISA’s Known Exploited Vulnerabilities catalog. It’s a free, public list of bugs attackers are actually using right now. If something you run is on it, that patch jumps the queue.

The step people skip is the inventory. You can’t patch the storage box in the closet that everyone forgot about. A simple spreadsheet of devices, software and who looks after each one is enough to start.

3. Make phishing easy to report

A yearly training video doesn’t change much. Making it easy and safe to say “this looks weird” does.

• Give people one obvious way to report a suspicious email: a button in the mail client, or one channel everyone knows.
• Thank people who report, even when it turns out to be nothing. Especially then.
• Never punish someone for clicking. If they’re scared, they’ll keep quiet, and the first hour after a click is the one that matters.
• Make it a rule that any request to change bank details or pay a new invoice gets checked with a phone call, on a number you already had. Not the one in the email.

That last rule alone shuts down most business email compromise, which the FBI’s Internet Crime Complaint Center ranks year after year among the costliest crimes reported to it.

4. Back up like ransomware is coming

The classic rule is 3-2-1: three copies of your data, on two kinds of storage, with one copy offsite. It still holds. But ransomware crews now go after backups first, so add two things:

• One copy they can’t touch. Keep it offline, or turn on the immutable (object lock) setting most cloud backup services offer. Even with admin rights on your network, an attacker shouldn’t be able to delete it.
• Proof it works. A couple of times a year, actually restore something: a folder, a mailbox, a whole laptop. A backup you’ve never restored is a guess.

While you’re at it, check what’s really covered. Microsoft 365 and Google Workspace keep your data available, but that isn’t the same as a backup you control. Look at the retention settings and decide whether you need a separate backup service.

5. Stop putting everything on one network

On a flat network, one infected laptop can reach everything else: the file server, the accounting PC, the cameras. Splitting things up limits how far an attacker gets.

You don’t need anything fancy to start:

• Guest Wi-Fi on its own network. Most business routers do this out of the box.
• Printers, cameras and smart devices on their own segment. They rarely get updates.
• Finance and customer data behind extra rules, so not every machine on the network can reach them.

A realistic first month

If this feels like a lot, here’s an order that works:

• Week 1: MFA on email, banking and your domain registrar. Password manager rolled out.
• Week 2: Automatic updates on every laptop. Internet-facing gear listed and patched.
• Week 3: Phone check for payment changes. Reporting process announced to the team.
• Week 4: Immutable backup set up and one test restore done.

Network segmentation can come after that. None of this is exciting, and that’s kind of the point: boring, finished basics stop more attacks than shiny tools that never get set up.

When it’s worth calling someone

You can do most of this yourself. It’s worth bringing in help when:

• You handle health, payment or other sensitive customer data, or you need to meet HIPAA, PCI DSS or SOC 2.
• You think something has already happened.
• You’re about to make a big change, like a cloud migration or a product launch.