Small businesses do not get hit because they are targeted. They get hit because they are easy — automated attacks sweep thousands of addresses and find whichever lacks the basics.
The good news: the basics are few, cheap, and cover the overwhelming majority of incidents.
Want a check of the fundamentals?
Tell us what systems you use and we will tell you what is missing, without the jargon.
The seven measures, in priority order
| # | Measure | Time | Cost |
|---|---|---|---|
| 1 | Two-factor on email and banking | 30 minutes | €0 |
| 2 | A password manager for the team | 2 hours | €3–6/user |
| 3 | Backups with a tested restore | 3 hours | €5–40/month |
| 4 | Updates on the site and machines | Ongoing | €0 |
| 5 | Separate accounts per person | 1 hour | €0 |
| 6 | Phishing awareness training | 1 hour | €0 |
| 7 | A “what do we do if” plan | 2 hours | €0 |
Start with the first, today. Two-factor on email is the single highest-impact action — because email is the key to resetting the password on every other system.
Passwords: what actually holds
The old rules (“change it every three months”, “add symbols”) have been replaced by simpler and more effective ones:
- Length over complexity. A four-word phrase is stronger than
P@ss1!. - A different password per service. One shared password means one leak opens everything.
- Change only on suspicion of a leak, not on a schedule.
- A password manager rather than a notebook or a spreadsheet.
The last one also solves an operational problem: when somebody leaves the team, you remove access in a minute instead of working out which passwords they knew.
How to spot phishing
Most breaches at small businesses start with a message, not a technical attack.
The five signs:
- Urgency with a threat. “Your account will close within 24 hours.”
- A sender address that does not match the displayed name.
- A link pointing elsewhere. Hover over it before clicking.
- A request for a password or one-time code. No legitimate service asks.
- A change of bank details on a supplier invoice.
The fifth is the most expensive for small businesses. The rule: every change of bank details is confirmed by phone, on a number you already hold — not the number written in the email.
Backups: the 3-2-1 rule
Three copies, on two different media, one of them off site.
| What | Where |
|---|---|
| The live data | On the computer or server |
| Copy 1 | On a second disk or NAS |
| Copy 2 | In the cloud, automatically |
And the test. A backup that has not been tested is not a backup — it is a hope. Restore one file every quarter and note the date.
The same logic applies to your website: automatic backups and a tested restore are part of maintenance. If you are considering a move to the cloud, security is one of the main arguments — see the comparison in cloud migration.
Want us to check your backups?
Send us what you use today and we will tell you whether your business would survive a failure.
What to do if you are breached
The first hours matter. In this order:
- Disconnect the affected machine from the network, without switching it off.
- Change passwords from a clean device, starting with email.
- Notify your bank and providers if payments are involved.
- Write down what happened and when. You will need it.
- Check whether personal data of customers or staff is involved.
The fifth carries a legal dimension: if personal data was exposed, there is an obligation to notify within a short deadline, and in some cases to inform the individuals themselves. The procedure and deadlines need checking for your case — the framework is in GDPR and your website and with the data protection authority.
What you do not do: pay a ransom without speaking to a specialist first, and delete files “to clean up”.
What it costs in total
| Size | Realistic monthly |
|---|---|
| 1–3 people | €15 – €40 |
| 4–10 people | €40 – €120 |
| With an e-shop and customer data | €80 – €250 |
Those figures cover a password manager, cloud backups and basic endpoint protection. They are less than the cost of one day offline — and almost always less than recovering after an incident.
Frequently asked questions
We are too small to be attacked.
Most attacks are automated and do not choose a target. They look for weaknesses, not names.
Do we need antivirus software?
Modern operating systems include protection that suffices for most small businesses, provided it is switched on and up to date.
Who is responsible on the team?
One person, by name. Security belonging to everybody belongs to nobody.
What about staff phones?
A screen lock, encryption, and the ability to remotely wipe company accounts.
How often should we review?
A full review once a year, and immediately whenever somebody leaves the team.
The first step
Open your main company email account and switch on two-factor authentication. Now, not tomorrow.
It is free, it takes ten minutes, and it neutralises the overwhelming majority of automated attacks. The rest goes into your annual plan — see how in digital strategy.
Next step
Book a free 30-minute call with the team at The Dev Alley. We will look at your systems and give you a prioritised list.