7 Cyber Security Mistakes Small Businesses Keep Making (and how to fix them)
Cyber security for small businesses doesn’t need to be complicated or expensive.
Most incidents start with ordinary gaps: an old laptop, a reused password, a missed software update or a convincing email. These issues are common in busy businesses, particularly when no one has dedicated responsibility for IT.
The good news is that most can be fixed with practical steps and sensible support.
Here are 7 cyber security mistakes we regularly see in small and medium-sized businesses, and what you can do about them.
1. Relying On Passwords Alone
What the mistake looks like
Your email, cloud storage, accounts software and remote access all use a password as the only form of protection.
If someone obtains that password through a phishing email or a data breach, they may be able to access important systems straight away.
Why it matters
Passwords can be stolen, guessed or reused elsewhere. Multi-factor authentication (MFA), also called two-step verification, adds another check. This could be an authenticator app, a security key or a code sent to your phone.
Even if a password is compromised, MFA can prevent the attacker from signing in.
The practical fix
Enable MFA for:
Business email accounts
Microsoft 365 or Google Workspace
Cloud storage and customer management systems
Remote access and VPNs
Administrator accounts
Online banking and financial services
Start with email and administrator accounts, then extend it across the business.
Effort and cost: Often 1–2 hours to configure for a small team. MFA is included with many business software subscriptions, although some advanced options may cost extra.
2. Sharing Passwords Or Using The Same One Everywhere
What the mistake looks like
A team shares one login for an important system, keeps passwords in a spreadsheet or uses the same password for email, Wi-Fi and other services.
Sometimes passwords are sent through email or chat because it seems quicker.
Why it matters
A shared password makes it difficult to know who accessed an account. If someone leaves the business, you may need to change the password everywhere. Reused passwords also mean one compromised account can expose several others.
The practical fix
Use individual accounts wherever possible. This gives each person the right level of access and creates a clearer record of activity.
A password manager can create and store long, unique passwords without asking your team to remember dozens of them. You should also:
Change default passwords on routers, laptops and other devices
Use long, unique passwords for every important account
Remove accounts when staff leave
Avoid storing passwords in unprotected documents
Review who has access to shared systems
The National Cyber Security Centre’s password guidance provides a useful introduction to password managers.
Effort and cost: A small business can usually introduce a password manager in a day. Subscription costs vary, but basic business plans are often modest compared with the time spent recovering a compromised account.
3. Assuming Antivirus Is Enough
What the mistake looks like
Every computer has antivirus software installed, so the business considers its cyber security covered.
Antivirus is useful, but it is only one part of a wider security setup.
Why it matters
Antivirus can help identify and block known malicious software. It does not replace secure passwords, MFA, software updates, access controls, backups or staff awareness.
A phishing email may not contain a traditional virus. It may instead persuade someone to enter their login details on a fake website or approve a fraudulent payment.
The practical fix
Treat antivirus as one layer of protection. Check that you also have:
Secure email filtering
MFA on important accounts
Regular software and firmware updates
Firewall protection
Device encryption where appropriate
Backups that are separate from your main network
A clear process for reporting suspicious activity
Your protection should cover people, devices, accounts and data, not just the files on a laptop.
Effort and cost: Reviewing your current setup can take a few hours. Some controls may already be included in your existing Microsoft 365, Google Workspace or security subscriptions. Others may need professional configuration.
4. Delaying Updates Or Using Unsupported Devices
What the mistake looks like
A laptop keeps displaying update reminders, but they are postponed because the user is busy. An old version of Windows or a business application remains in use because it still appears to work.
Routers, printers and other network devices may also be running old firmware.
Why it matters
Updates often fix security weaknesses. Once a software weakness becomes known, criminals can look for businesses that have not installed the fix.
Unsupported software is a particular concern. When a manufacturer stops providing security updates, new weaknesses may remain open indefinitely.
The practical fix
Create a simple device and software list. It should show:
Which laptops, desktops and servers you use
The operating system on each device
Key business applications
Whether support and security updates are still available
When equipment should be replaced
Turn on automatic updates where appropriate. Arrange a suitable time for larger updates and replace unsupported devices as part of a planned budget rather than waiting for an emergency.
Effort and cost: Checking update status may take a morning for a small office. Replacing devices has a higher cost, but planned replacement is usually easier than dealing with a failed or compromised machine.
5. Keeping Backups That Have Never Been Tested
What the mistake looks like
Your files are copied to an external drive or cloud service, so you assume they are safe. Nobody has checked whether the backup completed successfully or tried restoring a file.
In some cases, the backup is permanently connected to the same network as the main systems.
Why it matters
A backup is only useful if you can restore the information when you need it. Ransomware may encrypt files and any connected backup at the same time.
You should also consider accidental deletion, hardware failure, theft and fire. These are everyday risks, not just cyber security concerns.
The practical fix
Back up critical data automatically and keep at least one copy offline or separately protected from your normal network. Important business information may include:
Accounts and financial records
Customer and supplier details
Contracts and project files
Shared documents
Email and cloud data
Operational systems and databases
Test a restore regularly. Start with one file, then work towards restoring a complete folder or system. Record how long recovery takes and who is responsible.
The NCSC’s guidance on backing up important data is a useful starting point.
Effort and cost: Setting up automated backups may take 1–2 days, depending on the systems involved. A quarterly restore test can take less than an hour, but it can identify serious problems early.
6. Giving Staff No Practical Phishing Guidance
What the mistake looks like
Staff are told to “be careful” with emails, but nobody explains what to look for or what to do when something seems suspicious.
The team may not know whether to delete a message, report it or ask for help.
Why it matters
Phishing messages are designed to look ordinary. They may appear to come from a customer, supplier, colleague or director. Some ask for a password, while others request an urgent payment or contain a harmful attachment.
People are not the problem. Without clear guidance, it is difficult to know which emails deserve a second look.
The practical fix
Run short, regular awareness sessions covering:
Checking the sender’s full email address
Hovering over links before opening them
Treating unexpected payment requests carefully
Being cautious with attachments
Checking unusual requests through a separate channel
Reporting suspected phishing quickly
Create a simple reporting route, such as forwarding the message to a monitored IT address. Make clear that staff will not be blamed for reporting something that turns out to be harmless.
Effort and cost: A 45-minute briefing each quarter is a realistic starting point. Some businesses also use short online training modules or simulated phishing exercises. The important point is to make training regular and practical.
7. Having No Plan For Lost Devices Or Ransomware
What the mistake looks like
A laptop is lost, a phone is stolen or ransomware appears on a shared drive. Nobody knows who to contact, which accounts to disable or whether the business should disconnect its network.
The team starts making decisions under pressure.
Why it matters
A clear response can limit disruption. A delayed response may allow an attacker to access more accounts or systems.
You don’t need a lengthy technical document. You need a short plan that people can follow.
The practical fix
Write down:
Who staff should contact first
How to report a lost or stolen device
Who can disable accounts and reset passwords
When to disconnect an affected device or network
Where clean backups are held
Who communicates with customers, suppliers and insurers
When to contact the police, the ICO or specialist support
Make sure laptops and phones can be locked or wiped remotely where suitable. Review the plan annually and after any significant change to your systems.
The NCSC’s Small Organisations Guide to Cyber Security includes practical advice on accounts, devices, backups and scams. It also links to response and recovery guidance if you think an incident has already happened.
Effort and cost: A basic plan can be written in half a day. Technical controls such as remote management, device encryption and monitored backups may require additional setup or ongoing support.
A Sensible Starting Point For Your Business
If you’re not sure where to begin, focus on these five actions:
Turn on MFA for email and administrator accounts
Replace shared and reused passwords with individual logins
Check that software and devices are still supported
Set up separate, automated backups and test a restore
Give staff a clear way to report suspicious emails and lost devices
You may also want to work towards Cyber Essentials. It is the UK Government-backed minimum standard for protecting against common online threats. The scheme covers firewalls, secure configuration, security updates, user access control and malware protection.
Cyber Essentials is not a replacement for every security measure, but it gives your business a practical baseline to work from.
Need A Straightforward Review?
At NEBS, we provide cyber security, IT support for SMEs and managed IT services tailored to the way your business works.
We’re independent, so we’re not tied to one manufacturer or security product. We’ll assess your current setup, explain the priorities in plain English and recommend only what you need.
Get in touch with NEBS for a free, no-pressure review. We’ll help you understand what is already working, what needs attention and which improvements can be made first.
You can also call us on 0191 691 3300. Our team is based in Northumberland and supports businesses across the North East and the wider UK.