The Cyber Threats Actually Hitting Small Businesses — and What Stops Them

1. Business email compromise

Someone gets into an email account — usually through a phished password — and then does nothing for a while. They read. They learn how your invoices are worded, who approves payments, when your bookkeeper is on holiday. Then they send a payment instruction that looks exactly right, because it was written by someone who has read three months of your correspondence.

This is the one that produces the largest single losses in businesses of this size, and it does not involve malware at all. Your antivirus will never see it.

• Phishing-resistant multi-factor authentication on email, above everything else. Note that SMS codes and push approvals are increasingly bypassed — app-based codes are better, hardware keys or passkeys better still.
• A verification rule for payment changes: any change to bank details gets confirmed by phone, on a number you already had, never a number in the email.
• Alerting on mailbox forwarding rules. Attackers set them to hide replies; a new auto-forward to an outside address should page someone.
• Blocking legacy authentication protocols that skip MFA entirely.

2. Ransomware through remote access

The common entry point is not a clever exploit. It is a remote access service exposed to the internet with a weak or reused password, or a VPN appliance missing a patch that was published months ago.

The damage is decided by your backups, not your defences. Everyone has backups. Far fewer have backups that are offline or immutable, and fewer still have ever restored from them under time pressure to find out how long it takes.

• No remote desktop exposed directly to the internet, ever. Put it behind a VPN or a zero-trust access layer.
• MFA on the VPN and on remote access, not just on email.
• Patch internet-facing appliances on a schedule you can evidence — firewalls, VPN concentrators, anything with a public IP.
• One backup copy that ransomware cannot reach: offline, or immutable with separate credentials.
• A restore test with a stopwatch. If nobody knows the recovery time, you do not have a recovery plan.

3. Credential reuse and infostealers

An employee uses the same password on a personal site that gets breached, or picks up information-stealing malware on a home machine that also has work logins saved in the browser. Those credentials end up in bulk lists and get tried against everything.

The fix is unglamorous and effective: make passwords unique and make a stolen one insufficient on its own.

• A password manager issued to staff, so unique passwords are the path of least resistance.
• MFA everywhere it is available — the stolen password then buys the attacker nothing.
• Screening new passwords against known-breached lists at the point they are set.
• Single sign-on where you can, so there are fewer passwords in existence to steal.

4. The unmanaged device and the forgotten account

Two versions of the same problem. A laptop nobody is patching, or an account belonging to someone who left eight months ago and still has access to the file share.

Neither is exciting. Both come up in almost every audit we run, and the leaver's account is a particular favourite of attackers because nobody is watching it for unusual behaviour.

• An actual inventory of devices with access to company data, including personal phones with email on them.
• Automated patching with reporting, so you can see what did not apply rather than assuming it did.
• An offboarding checklist tied to the payroll exit, not to somebody remembering.
• A quarterly review of who has administrative rights. The list is usually longer than the owner expects.

5. The third party you forgot was connected

Your bookkeeper's remote access. The vendor who installed the phone system and kept a login. The marketing agency with access to the website. Each is a door into your environment maintained by somebody whose security you do not control.

You cannot audit every supplier, but you can limit what a compromised one reaches.

• List every external party with a login and what it can reach.
• Time-bound access rather than standing access, wherever the relationship allows it.
• Separate accounts per vendor, never a shared one, so activity is attributable.
• Remove access when a project ends — the same day, as part of closing the job.

Where to start if you can only do three things

Everything else on this page is worth doing. But if you are a 25-person business with no security staff and a limited budget, those three are where the risk actually concentrates — and none of them require a new product.

1. 1Phishing-resistant MFA on email and remote access. This single control removes the majority of realistic paths in.
2. 2One backup copy that is offline or immutable, and one timed restore test to prove it works.
3. 3Written payment-change verification by phone. It costs nothing and stops the most expensive attack on this list.

A note on compliance

If you handle health records, card payments or client financial data, some of the above stops being optional. HIPAA, PCI-DSS and similar regimes prescribe specific controls, and the documentation matters as much as the control itself. Doing the right thing without being able to evidence it does not help you in an audit or a claim.