"We're too small to be a target" is one of the most expensive beliefs in business. Modern attacks are automated. Bots scan the internet for open doors, mass phishing campaigns hit thousands of inboxes at once, and ransomware crews choose victims by how likely they are to pay, not how famous they are.
The good news is that a small set of inexpensive habits blocks most real-world attacks. Here are the seven threats we see most often, how each works and exactly what to do.
Key points
- Per Verizon's 2026 Data Breach Investigations Report, software vulnerabilities are now the top way attackers get in (about 31% of breaches), and ransomware appears in roughly 48% of breaches.
- Multi-factor authentication, patching, backups and a password manager stop most common attacks.
- People are part of your defence. Short, regular training beats a yearly lecture.
1. Ransomware
What: malware that encrypts your files and demands payment for the key, often while also stealing data to threaten publication.
How it gets in: phishing attachments, exposed remote-access services, unpatched servers, stolen credentials.
Prevent it:
- Offline or immutable backups, and test restoring them quarterly. Backups connected to your network can be encrypted too.
- Patch internet-facing systems quickly.
- Turn off or protect remote desktop access. Require MFA and VPN.
- Endpoint protection with ransomware detection.
- Limit admin rights so malware can't spread easily.
2. Phishing and social engineering
What: deceptive emails, texts, calls or chats that trick staff into clicking, opening a file, sharing a password or paying a fake invoice.
Warning signs: urgency ("pay today or service stops"), unexpected attachments, slightly wrong sender domains, requests to change bank details, a "CEO" asking for gift cards.
Prevent it:
- Short training and simulated phishing every quarter.
- SPF, DKIM and DMARC so criminals can't easily spoof your domain.
- A rule: any change to bank details is confirmed by phone on a known number.
- A one-click "report phishing" button, and thanks for using it.
See also how to spot phishing emails.
3. Stolen and weak passwords
What: attackers log in with passwords leaked in earlier breaches (credential stuffing) or guess weak ones.
- MFA everywhere possible, starting with email, banking and admin accounts.
- A password manager so every account has a long unique password. Our password manager guide explains how, and the free password generator makes strong ones.
- Modern NIST guidance: favour length, check against known-breached lists, avoid forced periodic changes unless compromise is suspected.
4. Unpatched software
What: attackers exploit known flaws in operating systems, plugins, routers, VPNs or web apps nobody updated. In Verizon's 2026 report, exploiting vulnerabilities overtook stolen credentials as the most common initial access method.
- Automatic updates for operating systems, browsers and apps.
- An inventory of everything exposed to the internet: websites, plugins, VPN gateways, cameras, routers.
- Remove plugins and software you no longer use.
- Patch critical internet-facing flaws within days, not months.
- Scan your website and servers regularly.
5. Business email compromise and invoice fraud
What: criminals hijack or imitate an email account to redirect payments or request sensitive data. No malware needed, so tools struggle to spot it.
Prevent it: MFA on all mailboxes, mailbox-rule alerts, dual approval for payments above a threshold, and a call-back procedure for payment changes.
6. Insider mistakes and lost devices
What: accidental sharing, misdirected emails, a laptop left in a taxi, a departing employee who still has access.
- Encrypt laptops and phones, enable remote wipe.
- Least privilege: access only to what's needed.
- A joiner, mover, leaver checklist so accounts go the day someone leaves.
- Shared drives with permissions instead of emailing sensitive files.
7. Third-party and supply-chain risk
What: a vendor, plugin, agency or SaaS tool you rely on gets breached and the attacker pivots to you.
- A list of vendors with access to your data or systems.
- Ask vendors about their security practices and breach notification.
- Give each integration only the permissions it needs and review them twice a year.
- Prefer well-maintained, widely used software. Avoid abandoned plugins.
A 10-point checklist
- MFA on email, finance, admin and cloud accounts.
- A password manager for the whole team.
- Automatic updates on devices, scheduled patching for servers and websites.
- 3-2-1 backups (three copies, two media types, one offline) and a tested restore.
- Endpoint protection on every computer.
- Email security with SPF, DKIM and DMARC.
- Quarterly phishing awareness training.
- Least-privilege access and a leaver checklist.
- A written incident response plan with phone numbers, roles and first steps.
- An annual review or external security assessment.
The first hour of an incident
- Isolate affected devices from the network (unplug or disable Wi-Fi), but don't switch them off if you can avoid it.
- Change passwords for affected accounts from a clean device and revoke active sessions.
- Contact your IT or security partner and, where required, your insurer.
- Preserve logs and evidence.
- Assess what data was involved and your legal duty to notify customers or regulators.
- Restore from known-clean backups and close the entry point before reconnecting.
How attackers pick small targets
Most attacks on small firms are opportunistic and automated:
- Scan: bots search for exposed login pages, outdated software and open services.
- Harvest: breached credentials from earlier leaks are tried against your email, VPN and cloud.
- Phish: convincing emails sent in bulk, then refined for those who respond.
- Foothold: one weak account or unpatched server is enough.
- Expand: they look for backups, finance systems and shared drives.
- Monetise: encrypt files, steal data, redirect payments or resell access.
Every step is a chance to stop them, and the controls above map onto these stages.
A programme by company size
| Size | Priorities |
|---|---|
| 1 to 10 people | MFA everywhere, password manager, automatic updates, cloud backups with a test restore, email security records, a written incident contact list |
| 10 to 50 people | All of that plus endpoint protection, device encryption, central user management, quarterly phishing training, offboarding checklist, annual external assessment |
| 50+ people | Add logging and monitoring, vulnerability scanning, role-based access reviews, a vendor risk process, tested incident-response exercises, cyber insurance review |
Email security records, simply
Criminals can send emails that look like they come from your domain unless you publish records proving which servers may send for you:
- SPF lists the servers allowed to send your email.
- DKIM adds a digital signature to each message.
- DMARC tells receivers what to do with messages that fail, and sends you reports.
Start DMARC in monitoring mode, read the reports, fix legitimate senders, then move toward quarantine or reject. Check your records with our free DNS lookup tool.
Backups that actually save you
Many small businesses find out mid-attack that backups were missing, outdated or encrypted too.
- 3-2-1 rule: three copies, two types of storage, one offline or immutable.
- Automatic and frequent: daily for important data, more often for transaction systems.
- Separate credentials: backup admin accounts shouldn't match everyday admin accounts.
- Restore tests: a file, then a full system, at least quarterly, and record how long it takes.
- Protect SaaS data too. Cloud email and files aren't automatically backed up the way you assume.
Awareness that works
- Short and frequent: ten-minute sessions each quarter beat a long annual presentation.
- Real examples: show actual phishing emails your company received.
- No blame. Staff who report mistakes quickly save the company. Punishing mistakes hides them.
- Clear procedures: who to call, what to do, what not to do. Print it and pin it up.
- Simulations show where training is needed.
Myths
- "Antivirus is enough." It helps with known malware but does nothing about stolen passwords or unpatched servers.
- "We have nothing worth stealing." Your email, customer list and ability to pay a ransom all have value.
- "The cloud provider handles security." They secure the platform. You secure accounts and configuration.
- "Strong passwords are enough." Without MFA, one phished password still opens the door.
Get expert help
Security doesn't have to be overwhelming. Our cybersecurity and cloud services include assessments, hardening, monitoring and incident response planning for growing companies. If your systems also live in the cloud, read our plain-English guide to cloud migration, then book a free security consultation.
