Five Common Security Risks at a Small Business (and How to Check Each One)
What you will need: A list of your employees and admin access to your email, computers, and key business accounts.
Before you start
You don't need to be technical for this. For each risk, you'll find what it is, why it matters, and a few steps to check where you stand. Nobody expects you to know all of this already.
These five risks are in an order that's easy to read, not a ranking of which is biggest. Work through them in whatever order suits you.
Risk 1: Phishing emails
What it is: Phishing is a fake email, text, or message that pretends to be someone you trust (a bank, a vendor, your boss) to trick you into clicking a link, opening a file, or sending money or information.
Why it matters: It takes one click from one person. Small teams often have no one double-checking messages.
What to do:
- Tell your team that it's always okay to pause and ask, "Does this look right?" Make it normal to ask.
- Check the sender's actual email address, not just the display name. "Pat Smith" can be sent from any address.
- Hover your mouse over a link (don't click) to see where it really goes.
- Treat any request involving money, gift cards, or changed bank details as a reason to confirm by phone, using a number you already have, not one in the email.
- Decide now who employees should tell if they clicked something they shouldn't have, and make clear that nobody will be in trouble for speaking up quickly.
Risk 2: Weak or reused passwords
What it is: Using simple passwords, or the same password on many accounts. If one site is breached, attackers try that same password everywhere else.
Why it matters: A password is the key to an account. If one key opens many doors, a single leak can put your email, banking, and other business accounts at risk all at once.
What to do:
- List your most important accounts: email, banking, accounting software, payroll, website admin.
- Make sure each one has its own long, unique password. A passphrase of several unrelated words is easier to remember and harder to guess than a short, complicated one.
- Consider a password manager, an app that creates and remembers strong passwords for you so you only need to remember one.
- Turn on multi-factor authentication (MFA) wherever it's offered. MFA means you need a second proof of identity in addition to your password, often a code sent to your phone or shown in an app.
- Where you can, choose the strongest kind of MFA. CISA (the U.S. Cybersecurity and Infrastructure Security Agency) now recommends phishing-resistant MFA as the best option. This means a security key (a small physical device you plug in or tap) or a passkey (a sign-in method that uses your device's own unlock, such as a fingerprint, face scan, or PIN, instead of a typed password). If a service doesn't offer those, use whatever MFA it does offer. Any MFA is better than none.
- Start with email. If someone takes over your email, they can often reset the passwords for everything else.
Risk 3: Out-of-date software
What it is: Software makers release updates (also called patches) to fix security holes. If you skip them, the hole stays open, and attackers know about it.
Why it matters: Updates are one of the simplest ways to close known weaknesses, and they cost you little more than a restart.
What to do:
- Make a simple list of every computer, phone, and tablet used for work, including personal devices that touch work email.
- Check each computer's operating system (the main software that runs it, such as Windows or macOS):
- Windows 11: Select Start > Settings > Windows Update, then select Check for updates.
- Mac: Open the Apple menu > System Settings > General > Software Update, then select the More Info button next to Automatic Updates to review your automatic update choices. On some macOS versions, the button is labeled Info instead.
- For iPhones, iPads, and Android phones and tablets, menus differ by device and version. Look up the steps for your model on the maker's support page, and turn on automatic updates if the device offers them.
- Update the programs you use daily, such as your web browser, office software, and accounting software.
- Check your router (the box that connects your office to the internet) and any other network equipment. These are easy to forget. The steps vary by brand, so search for your router maker's support page to see how to check for updates on your model.
- Retire anything the maker no longer supports. If a device can no longer receive updates, plan to replace it.
Risk 4: No reliable backups
What it is: A backup is a separate copy of your files, kept somewhere safe. Without one, a failed hard drive, a spilled coffee, or ransomware (malicious software that locks your files until you pay) can mean losing your business data for good.
Why it matters: If your files disappear, a good backup is what lets you carry on.
What to do:
- Write down what you can't afford to lose: customer records, financial files, contracts, photos, email.
- Check where that data lives today. Is it on one computer, in a cloud service, or both?
- Aim for the common 3-2-1 approach: three copies of your data, on two different types of storage, with one copy kept off-site (for example, in the cloud or in a different building).
- Make sure at least one backup copy isn't constantly connected to your computers. Ransomware can encrypt backups that are always plugged in or shared on your network.
- Test a restore. Pick one file, delete a copy, and try to get it back from the backup. A backup you've never tested is a guess.
Risk 5: Too much access, for too many people, for too long
What it is: When everyone has access to everything, or when former employees and old vendors still have working logins, there are more ways in. Mistakes get bigger, too.
Why it matters: Every working login is a possible way in. The fewer people and companies who have access, the fewer chances for a mistake or a stolen password to cause damage.
What to do:
- List every person and outside company with access to your systems: staff, contractors, your web developer, your bookkeeper.
- For each one, ask: "Do they still need this?" and "Do they need all of it?"
- Remove access for anyone who has left. Do this on their last day, not weeks later.
- Keep admin accounts (the ones that can change settings and add users) to as few people as possible. Everyday work should be done from a regular account.
- Avoid shared logins where you can. When several people use one account, you can't tell who did what or remove just one person.
- Put a reminder on your calendar to repeat this check every few months.
Where to go from here
You don't have to fix everything today. Pick one risk, work through its steps this week, and move to the next. The first pass through each risk will take longer than later check-ins. If a step doesn't make sense or you're not sure how to do it on your systems, that's a normal place to get stuck, and a good time to ask someone. Get in touch.