"Small business cyber security does not require an IT department or an enterprise budget. It requires a short list of controls done consistently: strong authentication, updated software, tested backups, protected devices and staff who can recognise a phishing attempt. This guide covers each one and the order to tackle them.
Why are small businesses targeted?
Because attacks are automated. Criminals scan for weak configurations and reused passwords at internet scale and take whatever responds; the size of the business behind the vulnerability is irrelevant. Small firms also make attractive stepping stones into larger customers and suppliers, which is why supply chain security questionnaires now land on very small companies.
Where should a small business start with cyber security?
Start with identity. Turn on multi factor authentication for email, banking, and every cloud service that supports it; compromised email is the root of most small business losses because it enables invoice fraud. Next, updates: set operating systems and applications to update automatically and retire anything no longer supported. Third, backups: automatic, off site or cloud based, and restored as a test at least twice a year, because an untested backup is a hope rather than a plan.
What about devices and Wi-Fi?
Every laptop, desktop and phone that touches business data needs a screen lock, disk encryption and active malware protection, all of which are built into modern systems and mostly need switching on. Separate guest Wi-Fi from business Wi-Fi, change default router passwords, and keep an eye on what is actually connected.
How do I protect against phishing?
Assume some messages will always get through, and build for that. Train staff with realistic examples, encourage reporting without blame, and add technical backstops: email filtering, sender authentication on your own domain, and bank payment processes that verify new account details by phone before money moves. Our guide to phishing testing covers how simulated campaigns work.
What should be in place as standard?
The highest value controls are configuration rather than products: multi factor authentication, automatic updates and sensible access rights. The technical layer, endpoint protection, email filtering and backup, should come packaged with your support arrangement rather than bought piecemeal. Our small business IT support plans include the security baseline as standard, because separating IT support from security stopped making sense years ago.
When do I need outside help?
When you cannot answer who has access to what, when backups were last tested, or what would happen in the first hour after ransomware. A structured review answers all three: our cyber security team runs baseline assessments sized for small businesses, and certification schemes such as Cyber Essentials turn the baseline into something you can show customers.
Frequently asked questions
Is antivirus enough for a small business?
No. Malware protection is one control of five or six that matter, and identity protection through multi factor authentication now prevents more real world losses than antivirus does.
Do I need cyber insurance?
Increasingly yes, and insurers will ask evidence of the controls in this guide before they quote. Good security lowers premiums; missing basics can void claims.
We use a bookkeeper and cloud apps. Are we still at risk?
Yes. Cloud providers secure their platforms, but your accounts, passwords and staff remain your responsibility, and invoice fraud through compromised email targets exactly this setup.
What is the single most important thing to do today?
Turn on multi factor authentication for your email. It is free, takes minutes per person, and blocks the attack path behind most small business losses.
LeapIT provides managed IT and cyber security for small businesses across Birmingham and the West Midlands, with the security baseline built into every support plan. If you want the honest picture of where you stand, start with a baseline assessment.
