1. Thinking “We’re too small to be a target”
What often happens:
- Owners assume cybercriminals go only after large enterprises. SMEs may be seen as “easy prey” because they often have weaker defences. Cyber Rebels+2Commercial Networks Limited+2
- This mindset leads to underinvestment in prevention, risk assessments, and security planning. Commercial Networks Limited+1
How to avoid it:
- Accept that no business is too small: probably the real risk is being “low-hanging fruit”.
- Do a simple risk assessment: What data would you lose? What is critical to operations? What would a breach cost (in money, reputation, downtime)?
- Allocate some minimum budget/time for cybersecurity—even basic measures like strong passwords, backups, basic firewalls — to cover “obvious risks”.
2. Weak or reused passwords & no multi-factor authentication (MFA)
What often happens:
- Passwords that are simple, reused across services, or shared among employees. SME One+2Commercial Networks Limited+2
- MFA not enabled, even for critical systems or remote access. smenews.digital+2Commercial Networks Limited+2
How to avoid it:
- Enforce strong password policies: unique, complex, and changed regularly. Consider using a password manager. Link ICT Services+1
- Enable MFA everywhere possible: email, cloud apps, remote desktop/VPNs. Even low effort here gives high protection. SME One+1
3. Outdated software, weak patching & ignored vulnerabilities
What often happens:
- Systems, applications or firmware are allowed to fall out of date. Known vulnerabilities are left unpatched. SME One+2Mason Infotech+2
- Legacy or unsupported software still in use. Mason Infotech+1
How to avoid it:
- Establish a patching policy: monitor for updates to OS, applications, firmware, and apply them promptly. Where possible, automate. Mason Infotech+1
- Keep an inventory of all software & hardware, note end-of-life items and plan replacements.
- Do regular vulnerability scanning (internally or via external service) to find weak spots. smenews.digital+1
4. Lack of backups & no tested incident recovery plan
What often happens:
- Poor or no backups; backups stored in the same place and vulnerable to the same loss/ransomware/deletion. SEIC+2Link ICT Services+2
- Even when backups exist, they’re not tested (so you can’t rely on them under pressure). SEIC+1
- No clear incident response plan: Who does what when things go wrong? Who do you notify? How do you recover? smenews.digital+1
How to avoid it:
- Implement the backup “3-2-1” rule: at least three copies of data, two different media, one offsite (or in cloud).
- Test recovering backups periodically, including from disaster scenarios (e.g. ransomware).
- Create a written incident response plan: roles, responsibilities, communication (both internal & to customers/regulators), how to isolate breach, recover, investigate. Run drills or tabletop exercises.
5. Ignoring the human factor / employee training
What often happens:
- Phishing, social engineering, click-bait emails etc. lead to breaches because staff aren’t trained to spot or respond. Vodafone+2SME One+2
- One-off training (e.g. when someone joins) but no ongoing refreshers. Eclarity+1
- Poor internal policies or weak enforcement (e.g. using personal devices, unsecured wifi, sharing accounts). SEIC+1
How to avoid it:
Use technical controls to reduce human error: e.g. restrict privileges, sandbox risky attachments, enforce policy via technical means (e.g. disable macros, restrict USB usage).
Regular training & awareness programs: simulated phishing, session refreshers. Make security part of company culture.
Clear policies for device use, remote working, password hygiene, data handling. Ensure people know them and there are consequences for not following.
