Cybersecurity for small business: The 10 biggest mistakes to fix

When it comes to cybersecurity for small business, most failures start small: a password reused from a personal account, a laptop that missed six months of updates, a former employee whose login still works. Attackers run automated tools that look for those gaps across thousands of organizations at once, and size doesn’t enter into it.

The most common mistakes are also the most fixable. We’d fix the ten we see most often roughly in the order listed.

The 10 biggest cybersecurity mistakes

1. Assuming you are too small to be a target. Small organizations hold the same valuable data as large ones, such as client records, bank access, health and tax information, with fewer defenses. If your office would struggle to work for a week without its computers, you are worth targeting.
2. Relying on passwords alone. A 2023 Microsoft Research study found MFA reduced the risk of account compromise by 99.22%, and by 98.56% even when the password had already leaked. Turn it on for email, remote access, banking, payroll and every cloud app, starting with admin accounts.
3. Weak and reused passwords. A business password manager gives everyone long, unique passwords and you a record of who has access to what.
4. Too much access for too long. Everyday users with admin rights can install anything, malware included, and former staff and vendors with live accounts are open doors. Give people the access their job needs and remove it the day they leave. For our clients, access is disabled the same day the client asks.
5. Falling behind on updates and running unsupported systems. Verizon’s 2026 report found exploiting vulnerabilities was the way in for 31% of breaches, more than stolen credentials. Organizations took a median of 43 days to fully fix known exploited vulnerabilities, and only 26% of the critical ones were fully fixed. Windows 10 reached end of support on October 14, 2025, and Extended Security Updates can be bought one year at a time through October 2028 at most, with the cost rising each year. Most of our clients have moved to Windows 11. We want every computer we support on it, and we’re working with the rest to upgrade or replace what’s left. A lifecycle plan keeps this from becoming an emergency.
6. Backups that won’t save you, because they sat on the same network and got encrypted too, or nobody had tested a restore in years.
7. Treating training as a once-a-year chore. Verizon found a human element in 62% of breaches in its 2026 report. Our clients get phishing simulations all year, and a click triggers a short lesson on the spot.
8. No written policies or incident response plan, so every employee decides alone how to handle client data, personal devices and AI tools, and the first hour of an attack goes to figuring out who to call.
9. Antivirus with nobody watching. Endpoint detection and response only helps when someone reviews the alerts and can isolate a device at any hour.
10. Ignoring vendor risk. Third-party involvement showed up in 48% of breaches in Verizon’s 2026 report, up 60% from the year before. Know which vendors reach what, require MFA on their accounts, and for healthcare, sign a business associate agreement.

What we find in new client environments

When we take on a new client, the Microsoft 365 tenant usually explains several of the mistakes above at once.

• 01Microsoft’s default settings everywhere, with nothing tightened.
• 02Auditing turned off, so there is no record to investigate if something happens.
• 03No conditional access policies controlling who can sign in from where.
• 04Intune licensed and paid for, but never set up.
• 05Licenses underused, or Standard licenses where Premium features are needed.

None of those take a new purchase to fix. They take someone sitting down with the settings. Departures deserve their own look too, and our post on the goodbye gap covers offboarding in detail.

Where to start with small business cybersecurity

1. Turn on MFA everywhere, starting with email and admin accounts.
2. Roll out a business password manager.
3. Confirm every device is supported and receiving updates. Our post on Windows 10 end of support covers the most common gap.
4. Test a full restore from a backup that sits outside your network.
5. Remove admin rights from daily-use accounts and clean up old logins.
6. Put endpoint detection and response in place with 24/7 monitoring. For our clients, a 24/7 security operations center watches it and can isolate a compromised device.
7. Start regular security training and phishing simulations.
8. Write a one-page incident plan and walk through it with your team. Our guide to business continuity planning covers what else to plan for.

Extra steps if you keep sensitive records

For healthcare practices, accounting and financial firms, law offices and nonprofits handling sensitive data, these mistakes are also compliance gaps. The HIPAA Security Rule requires an accurate and thorough risk analysis and security measures that reduce risks to a reasonable level. The FTC Safeguards Rule requires covered financial firms to use MFA for anyone accessing their information systems, train staff and keep a written incident response plan. You also need the paperwork that proves it, which is where our compliance services come in.

Book a 15-minute call with a cybersecurity provider that does this every day, and you’ll get a straight answer on which of these ten apply to you and a sensible order to fix them.

Frequently asked questions