How to protect your business against cyber attacks

Most of what protects a small business from attack isn't expensive or complicated. It's a handful of habits, done consistently, on every computer and every account. When we take over a new environment, we regularly find the same gaps: shared passwords, computers months behind on updates, no second step at sign-in, and backups nobody has ever tested. Here's how to close them.

1. Put a second step on every important sign-in

Start with email. Whoever controls your email can reset the password on almost everything else. Turn on two-step sign-in, where a code from an app or a prompt on your phone is needed as well as the password, for email, banking, payroll and anything holding client data. Microsoft 365 and Google Workspace both support it. Make it required for everyone, not optional.

2. Stop reusing and sharing passwords

A password used on one site and leaked from another is an open door. So is a shared login in a spreadsheet that never changes when someone leaves. Give every person their own accounts, use long, unique passwords, and keep them in a password manager the whole team uses, so sharing is controlled and access can be removed in one place.

3. Keep every computer updated

Updates close the holes attackers use. Turn on automatic updates for the operating system and the applications on top of it, then check they're actually installing. A machine that hasn't been restarted in weeks often hasn't finished updating either. That includes the laptops that travel and the spare in the drawer.

Replace machines that can no longer get security updates. Windows 10 reached end of support in October 2025, so any computer still running it belongs on that list. We wrote about upgrading business computers on a budget.

4. Use protection that someone actually watches

The antivirus that came with the computer is better than nothing, but if nobody looks at it, a warning just sits on a screen. Business protection should be set up the same way on every machine, block known attacks, and flag suspicious behavior to a person who can investigate and contain it before it spreads to the rest of the office. That's what managed security is for.

5. Back up so an attack costs hours, not years

Ransomware locks your files and demands payment. With a good backup, you restore instead of negotiating. A backup worth having is automatic, kept off-site and separate from the computers it protects, and tested by actually restoring something. See cloud backup.

Your Microsoft 365 or Google Workspace email and files need their own backup too. Neither keeps deleted or compromised data forever. That's cloud app backup.

6. Slow down on money and access requests

Some attacks don't involve breaking into a computer at all. An email that looks like it's from a vendor, a client or the boss asks someone to change bank details, pay an invoice urgently, or share a login. If a request involves money, payment details or passwords, confirm it by calling a number you already have, not one in the email.

Tell your team plainly that nobody will ever be in trouble for stopping to check whether an email is real.

7. Remove access the day someone leaves

Former staff with working logins are a risk, even when they left on good terms. Keep a short checklist and run it on their last day: email, shared files, the password manager, banking, and any outside services they used. If a company laptop doesn't come back, device management lets it be locked and wiped remotely.

8. Know what you'll do in the first hour

If a screen demands payment, or someone clicks something and immediately regrets it:

• Disconnect that computer from the network. Unplug the network cable or turn off its Wi-Fi.
• Stop using it, and don't try to clean it up yourself.
• Don't pay, and don't reply to whoever is demanding payment.
• Call whoever looks after your IT, and write down what happened while it's fresh.

Decide now who that call goes to, and make sure everyone in the office knows.

None of this makes a business impossible to attack. It makes you a much harder target, and it means that when something does get through, it's caught early and you have something to recover from.