Originally published on Grayline Post.
Small businesses most commonly underestimate their risk and fail to implement basic protections. 21 of 50 experts emphasize that weak or shared passwords without multi-factor authentication (MFA) are the costliest mistake, while 13 of 50 experts stress that unpatched software and outdated plugins remain open doors for attackers. The consensus is clear: attackers don't target by company size—they scan for the easiest entry points.
Key takeaways
- Enable multi-factor authentication on every email, admin, and payment account before any other security step.
- Create a simple inventory of every system your business exposes to the internet, and assign a named owner to each one.
- Patch software automatically and audit admin access quarterly; shared logins and dormant accounts are a common breach path.
- Do not rely on staff to catch every phishing email or AI misuse—build safeguards like email filtering, access limits, and data classification rules instead.
- Treat offboarding and access revocation as a checklist, not an afterthought; revoke credentials the day someone leaves.
Most frequently recommended first steps by experts
| Point | Experts |
|---|---|
| Weak or shared passwords without multi-factor authentication | 21 |
| Unpatched software, plugins and outdated systems | 13 |
| No inventory of systems or who has admin access | 11 |
| Phishing and email compromise without safeguards | 7 |
| Failing to revoke access when staff leave | 7 |
| Employees pasting data into unapproved AI tools | 6 |
| Relying on staff to spot every security threat alone | 4 |
| No tested backups or disaster recovery plan | 4 |
Number of experts (out of 50) who made each point. Many made more than one.
We asked IT and cybersecurity experts what single mistake costs small businesses the most. Their answers cluster around a few themes: the false belief that small companies are too small to target, the habit of sharing passwords or leaving accounts unprotected, and the assumption that once software is deployed it no longer needs attention. Most experts offered a first practical step that costs little or nothing.
1. Multi-factor authentication and account access control
The single most common recommendation from experts is to enable MFA on email and admin accounts, followed by giving each person their own unique login and removing shared passwords. This foundation protects against credential theft and unauthorized access.
Rafay Baloch, CEO and Founder, REDSECLABS
“The most common and costly mistake made by small businesses is "security by obscurity", i.e. believing that because the business is small it won't interest a hacker. My first piece of practical advice to business owners is to enable Multi-Factor Authentication (MFA) and automatic updates on all business accounts. That's the deadbolt on your front door that will stop the vast majority of attacks in their tracks.”
Small businesses wrongly assume attackers won't bother with them, but automated attacks probe every network looking for weak entry points.
Rafay Baloch is the CEO and founder of REDSECLABS.
Sam Sawalhi, Founder, JSOC IT
“Leaving email protected only by a password is the most common mistake I see with small businesses. In a world where one compromised inbox can allow an attacker to impersonate the owner, access customer details and convince clients to send payments to alternate accounts, the consequences can be costly both financially and reputationally. The fix is a multifactor authentication for every email and admin account, along with verification of use.”
Sam Sawalhi is the founder of JSOC IT.
Nicolas Falourd, Founder & CEO, Cyber Techwear
“The most common and costly mistake I see is trusting weak or reused credentials and giving broad access without regular review. First practical step: require unique passwords and enable multi-factor authentication for all accounts, and immediately audit who has access to sensitive systems (remove anyone who doesn't need it).”
Weak credentials allow attackers to move laterally through systems; a single compromised account can lead to the biggest losses.
Nicolas Falourd is the founder and CEO of Cyber Techwear.
Richard Bui, VP of IT / CIO, Solvit AI
“The costliest mistake small businesses make is protecting email, banking, payroll and admin accounts with passwords alone, often shared among staff and never changed when someone leaves. Once one email account is taken over, an attacker can reset most other logins and send convincing fake invoices from an address customers and vendors trust. The first fix takes an afternoon: turn on multi-factor authentication for every email and admin account, starting with the owner's, and give each person their own login so access can be shut off on their last day.”
Richard Bui is the VP of IT and CIO at Solvit AI.
Omair Manzoor, Founder, CEO & Chief Hacker, ioSENTRIX
“The most common and costly mistake I see small businesses make is assuming they're too small to be targeted. The first practical step is enabling multi-factor authentication on every account that supports it, starting with email — because email is the front door to password resets, financial approvals, and customer communications, and a compromised email account is how most small business breaches escalate from inconvenience to catastrophe.”
The assumption that small businesses are too small to target leads to neglecting the basics like MFA, which then becomes the easiest door for attackers to walk through.
Omair Manzoor is the founder, CEO and chief hacker at ioSENTRIX.
Zachary Norris, Owner, Lamb Telecom
“The biggest one I see is email with no multi-factor sign-in, usually because nobody on the team actually owns security. One stolen password and someone can send fake invoices from the owner's inbox or reset every other account the business has. The first fix is free on most email plans... turn on MFA for every email account this week, starting with the owner and whoever handles money!”
Zachary Norris is the owner of Lamb Telecom.
Jack Wright, Senior Vice President of Operations, HealthWright Technologies
“The costliest mistake is letting one login do everything: the same account that receives an invoice can also change the bank details and send the payment, so one stolen password or one convincing fake email is all it takes. The first fix is to split those jobs: give every person their own login with two factor sign in, and require a second person to approve any new payee or bank change. In our companies, no AI tool can log in to a bank, and any request to change bank details goes to a person.”
Splitting duties between accounts and requiring approval from a second person prevents one stolen password from opening all systems that move money.
Jack Wright is the senior vice president of operations at HealthWright Technologies.
James Rowell, Chief Technology Officer, Capture Expense
“The most common mistake small businesses make is sharing one login for banking, payroll or accounting tools, with no multi-factor authentication behind it. When a password is shared, nobody can tell who approved a payment, and one leaked password can open every account that moves money. The first practical step is to give each person their own login and switch on multi-factor authentication or single sign-on for the accounts that touch money, starting with the bank and the accounting software.”
James Rowell is the chief technology officer at Capture Expense.
Bobby Kerr, Founder, LOC8 My Business
“The most common, costly mistake: shared or recycled logins handed to every vendor and employee, no individual accounts, no two-factor authentication, and no offboarding process when someone leaves. The fix costs nothing: unique logins per person or vendor, 2FA everywhere, and a five-minute offboarding checklist that revokes access the day someone's off the account.”
Shared logins with no offboarding process mean that old employees and vendors retain access long after they should, and the 2026 Data Breach Investigations Report shows that third-party breaches are up 60% year-over-year.
Bobby Kerr is the founder of LOC8 My Business.
Chris McGlasson, Fractional CIO and Founder, ClearStack Advisory
“The biggest one I see is shared logins. Turn on MFA for every account, no exceptions. Then kill the shared logins and clean out the admin accounts for people who don't work there anymore. That one afternoon covers most of the messes I get called in on.”
Chris McGlasson is a fractional CIO and founder of ClearStack Advisory.
2. Software patching and asset inventory
The second most common theme is that small businesses treat deployed software as finished and leave it unpatched, or lose track of systems they've built and forgotten. Attackers use automated tools to find these easy targets. The fix starts with a simple list of what's exposed to the internet.
Brad Perniciaro, Owner and Publisher, software developer, Living Coastal
“The costliest mistake is waiting for someone to tell you to patch. Small businesses that run their own website or server usually fix things when their host or a vendor emails them, but AI is making it faster to find and exploit holes, and this month's PHP2Shell flaws in PHP were being exploited the same day the fix came out. The first practical step is to list everything you run (your website platform, its plugins, your PHP version, your hosting panel) and get security notices for each one, so you hear about a hole before an attacker uses it. It's time to get proactive.”
This month's PHP vulnerabilities were being exploited the same day fixes were released; waiting for a host to patch is no longer viable.
Brad Perniciaro is the owner, publisher and software developer at Living Coastal.
Stephen Duetzmann, Owner, Side Quest Solutions
“The most costly mistake I see is small businesses treating their website like a finished project instead of a system that needs patching, especially WordPress plugins that sit months out of date after a vulnerability is already public. I have patched client sites where one forgotten plugin was the way in, and the owner had no idea anything was wrong until the damage showed up somewhere else. The first step is simple: once a month, update everything, delete any plugin you no longer use, and turn on two-factor authentication for every admin account.”
“The biggest mistake I see is owners assuming their website is being looked after because they pay for hosting every month. Plugins and themes go out of date quietly, and this month alone I have matched critical vulnerabilities in common WordPress add-ons on small business sites that looked completely fine from the outside. The first step is simple: log in, run every update, and confirm you have a backup copy that lives somewhere separate from the site itself, then put updates on a monthly rhythm so they never pile up again.”
Stephen Duetzmann is the owner of Side Quest Solutions.
James Verlander, Founder, Poket Dev
“The costliest mistake is an unpatched thing nobody owns. Write every internet-facing system on one page, put a name next to each one, and update or cancel whatever has no name. Patching the rest is easy once a name is on it.”
The biggest risk is an unpatched system nobody owns; the first step is writing every internet-facing system on one page and putting a name next to each one.
James Verlander is the founder of Poket Dev.
Zakaria Mamoumi, Founder, Growtoria
“The most costly mistake we see on small business websites is running out-of-date software: old plugins and themes, and PHP versions that no longer get security fixes. Owners put off updates because they are afraid of breaking the site, so known holes stay open for months. The first practical step is simple: take a full backup and test that you can actually restore it, then apply the updates on a staging copy and check that your server runs a PHP version php.net still supports.”
Zakaria Mamoumi is the founder of Growtoria.
Shoaib Hassan, Editor, AuTechWire
“The costliest mistake I keep seeing: small firms leave internet-facing software unpatched while reusing the same admin credentials everywhere. PHP2Shell went from thousands of exploitation attempts to millions in days, because patching lagged behind disclosure. Make a one-page list of everything facing the internet, turn on automatic updates for it, and put MFA on every admin login. No new tool needed.”
The combination of unpatched systems and reused admin credentials opened the door for millions of PHP2Shell exploitations in just days.
Shoaib Hassan is the editor of AuTechWire.
Javier Juárez Zarruk, CEO and cofounder, Secur0
“Most small businesses think nobody is going to bother attacking them, so nobody checks what they have sitting on the internet. If I had to pick one first step it would be to sit down and write out every single thing your business has exposed to the internet, kill what you don't use anymore and turn on two factor authentication on everything that's left.”
Javier Juárez Zarruk is the CEO and cofounder of Secur0.
Daniel Di Nardo, Network and Security Consultant, Intellibreach
“The biggest mistake that small businesses make is thinking they will not be targeted because they're too small. Simply creating an asset inventory will help. This will mean knowing anything that is exposing your business to the Internet. If you don't know what is there then you cannot protect it.”
After nearly 20 years in security, most vulnerabilities are not due to lack of knowledge but to forgetting something; a simple asset inventory reveals what attackers will find.
Daniel Di Nardo is a network and security consultant at Intellibreach.
Radovan Vuković, Founder & Software Engineer, Prometix
“The most costly mistake I see is treating the website as "finished" once it launches: outdated CMS plugins, a server exposed directly to the internet, and no tested backup. A single automated bot campaign is then enough to take the site down or inject spam pages, and the owner usually hears about it from Google before anyone else. The first fix takes an afternoon: put the site behind a web application firewall with bot protection (most CDNs offer a free tier), configure the server to accept traffic only from that firewall, and turn on automatic plugin updates with a daily off-site backup.”
Radovan Vuković is the founder and software engineer at Prometix.
Etienne Basson, Founder, Veravix
“The biggest gap I measured was not knowing what is actually installed, so nothing gets checked. The first practical step is to write down every plugin and tool you use, turn on automatic updates, and check that list against a free vulnerability database once a month.”
The biggest gap is not knowing what's installed, so nothing gets checked; a vulnerability database check once a month catches outdated plugins quickly.
Etienne Basson is the founder of Veravix.
3. Phishing, email security, and human oversight
Experts emphasize that phishing accounts for roughly 90 percent of data breaches and that training staff to spot every scam is unrealistic. The solution is layered: email filtering, MFA, and realistic phishing simulations that build muscle memory, rather than relying on people to get it right 100 percent of the time.
Kevin Walker, Founder & Director, Black Swan Cyber Security Solutions
“Too many small businesses rely on their staff to spot every phishing email, which is a lot to ask when some of these scams are incredibly convincing. Training helps, of course, but businesses need decent email filtering, multi-factor authentication and other safeguards in place for when something inevitably slips through. You can't expect people to get it right 100% of the time, so why build your security around the assumption that they will?”
Training helps, but expecting people to catch sophisticated scams that even security systems miss is unrealistic; build safeguards for when something inevitably slips through.
Kevin Walker is the founder and director of Black Swan Cyber Security Solutions.
Bogdan Nicholas, Co-founder & Data Security Lead, VINspectorAI
“The costliest security mistake I see small businesses make is treating employee awareness as optional. Phishing accounts for roughly 90% of data breaches, and most of those succeed because someone on staff simply didn't know what to look for. The first practical fix is dead simple: run short, mandatory phishing simulations monthly. It costs almost nothing compared to a breach, and it turns your weakest link into an actual defense layer.”
Bogdan Nicholas is the co-founder and data security lead at VINspectorAI.
Brian Cute, President & CEO, Global Cyber Alliance
“Protect email systems. Email remains a common attack vector for phishing and fraud. Strong authentication, cautious link handling, and staff awareness reduce risk.”
Email remains the common attack vector for phishing and fraud; strong authentication, cautious link handling, and staff awareness reduce risk.
Brian Cute is the president and CEO of Global Cyber Alliance.
Rami Akeela, Founder and CEO, Nera Systems
“The costliest mistake I see right now is staff pasting sensitive data into AI tools nobody approved: client financials, customer records, contracts, sometimes passwords. It happens because it saves time, and the business usually finds out only when a client or auditor asks where the data went. The first step is a one-page rule that names what never goes into a public AI tool (client financials, personal identifiers, credentials), plus a business-tier account with training turned off for the tools people already use, so there's an approved option. Then ask your team what they're already using, because that conversation will show you more than any policy will.”
Rami Akeela is the founder and CEO of Nera Systems.
Kevin Hyland, Chief Executive Officer, Capella CSL
“Staff: Most security breaches come through staff, more precisely the inexperience of employees to spot fake emails often referred to as phishing emails. There are free courses or educational emails/videos that will assist and give greater confidence to employees to spot potential problems.”
Most security breaches come through staff inexperience spotting phishing emails; free courses and educational videos help employees gain confidence.
Kevin Hyland is the chief executive officer of Capella CSL.
4. Access control, inventory, and offboarding
Experts highlight that small businesses often don't know who has access to their systems, and they fail to revoke credentials when staff leave. Forgotten cloud apps, dormant admin accounts, and devices sitting in closets become silent breaches waiting to happen. The fix is a simple checklist that ties access to a named owner.
Hiren Hasmukh, Founder and CEO, Teqtivity
“The mistake I see most is treating offboarding as an HR task. The first fix is simple: keep one list of every device and who has it, and don't mark any departure complete until IT confirms the hardware is back and wiped.”
Hiren Hasmukh is the founder and CEO of Teqtivity.
Mykyta Chernenko, Founder, AIWriteBook
“The most common mistake I see is shared logins: one password for the company email, the payment dashboard and the hosting account, passed around in a chat thread and never changed when someone leaves. Put every account in a team password manager, give each person their own login with only the access they need, and turn on two-factor everywhere. Then change any password that was ever pasted into a chat.”
Mykyta Chernenko is the founder of AIWriteBook.
Deepak Shukla, Founder, Pearl Lemon Group
“One security mistake I see small businesses make is giving third-party integrations and automations broad access, then forgetting which systems can still reach customer data. The first practical fix is to list every integration and its owner, remove permissions it doesn't actually need, and check that access can be revoked immediately if something changes. That is a much better starting point than assuming another security subscription will solve a permissions problem.”
Deepak Shukla is the founder of Pearl Lemon Group.
Rick Gilchrist, CEO and Founder, Vannadium
“The most expensive mistake I see small businesses make is treating their data as a byproduct instead of an asset. They can't tell you where customer records, payroll, or contracts actually live, who has access to them, or which former employees and vendors still have access. Before buying another tool, sit down for an afternoon and write down every system that holds sensitive data, who can get into it, and why. Most owners are shocked by the list, and cutting it in half is the single best security move they'll make that year.”
Rick Gilchrist is the CEO and founder of Vannadium.
Marcus Tommy, Co-founder, MALTO Cyber
“The biggest security mistake small businesses make is not knowing which systems they run and who has admin access to each one. The fix is to write a one-page list of every system the business uses and the people who hold admin access to it, then turn on multi-factor authentication for every admin account on that list before buying any new security tool. After that, review the list every quarter and remove any access that no longer has an owner.”
Marcus Tommy is a co-founder of MALTO Cyber.
Suhaib Chaudhry, Founder, Black Hart Consulting
“The most common mistake I see is that nobody knows who has the keys to the business's website. The domain, hosting and website admin logins are often tied to a former employee's or an old web designer's email, shared through one reused password, with no two-step verification. The first fix is an afternoon's work: list every account the website depends on (domain registrar, hosting, website admin, Google Business Profile), move each one to an email address the owner controls, remove users who no longer need access, and turn on two-step verification everywhere.”
Suhaib Chaudhry is the founder of Black Hart Consulting.
Rehan Ahmed, Chief Executive Officer, Smart Web Agency
“The biggest mistake I see small businesses make is choosing technology because it is cheap or does what they want, without checking who maintains it or how security issues are handled. Before committing, check its security update history, whether it has an active company or community behind it and how long it will remain supported. A low upfront cost can become expensive if you are left running software nobody is fixing.”
Rehan Ahmed is the chief executive officer of Smart Web Agency.
Timur Rakhmatullin, Senior Backend Engineer, Softline Solutions
“The single most common and costly security mistake I see small businesses make is treating database credentials as a deployment detail instead of a rotating secret. The first practical step is dead simple but almost nobody does it: enable credential rotation on a 90-day cycle using your cloud provider's secret manager, AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, whatever you already pay for. At Softline we cut credential-related incidents by roughly 60 percent in the first quarter after making rotation mandatory across client accounts. The second thing is revoking access for departed employees the same day, not "when IT gets around to it."”
Database credentials are often hard-coded and never rotated; enabling credential rotation on a 90-day cycle cuts credential-related incidents by roughly 60 percent.
Timur Rakhmatullin is a senior backend engineer at Softline Solutions.
Owen Parry, CISO, CyberFOX
“The mistake I see most is small businesses giving everyone local admin rights on their own machines, usually because the one IT person is too busy keeping people working to handle every install request. Then the attacker is an admin too, and that's what most ransomware needs to switch off your protection and spread. The first step is to pull those admin rights, starting with the people who don't really need them (which is almost everyone), and give them a simple way to ask when they do.”
Owen Parry is the CISO at CyberFOX.
5. AI, data security, and uncontrolled tool usage
A growing theme among experts is that employees are pasting sensitive data into unapproved AI tools, and businesses are giving third-party tools and AI systems broad access to customer data and systems without proper oversight. The fix is classifying what data is sensitive, approving one or two business-tier tools with training disabled, and auditing integrations quarterly.
Jason Radney, CEO, Coast2CoastMSP
“The most costly mistake I see right now is small businesses adopting AI too quickly and too broadly, with no oversight: employees connect AI tools to email, shared files, and customer data with no policy, no access limits, and no one checking the output. That "shadow AI" quietly becomes a data-exposure risk nobody is watching. The first practical step is a simple inventory of which AI tools are already in use and what data each one can reach, then approving one or two tools, limiting their access to only what each task needs, and making a named person responsible for reviewing AI output before it reaches customers or core systems.”
Jason Radney is the CEO of Coast2CoastMSP.
Damodar Yekkuluri, Lead Architect, AI Inference, DigitalOcean
“The costliest mistake I see small businesses making now is treating AI inputs as trusted: they plug chatbots and AI assistants into their websites and customer data with no validation layer in front of them, so a crafted prompt can pull out internal instructions or data the business never meant to expose. The first practical step is simple: put an input-screening layer in front of any AI tool that touches your data or customers, before it reaches your systems - not after an incident.”
Chatbots and AI assistants plugged into customer data with no validation layer can pull out internal instructions or data through prompt injection; screening inputs before they reach your systems is essential.
Damodar Yekkuluri is the lead architect of AI inference at DigitalOcean.
Sammy Cheung, Founder, Vaelolab
“The costliest mistake I see is small businesses granting AI tools, task apps and vendors broad account access to save time, then never reviewing it, so a forgotten connection keeps reading data long after the job is done. The first fix is a short quarterly access audit: revoke anything unused, turn on two factor authentication everywhere, and never connect an account that has a payment card attached to a low trust app.”
Sammy Cheung is the founder of Vaelolab.
Theo Laredo, Co-founder, Integrated AIS
“The most costly mistake I see is small businesses treating their staff's AI tools as harmless productivity apps. Employees routinely paste customer records, contracts and passwords into free chatbots, and that data leaves the business with no record of where it went. The first fix costs nothing: write a one-page rule on what may and may not go into AI tools, then give staff one approved business-tier tool so they aren't tempted to use personal accounts.”
Theo Laredo is a co-founder of Integrated AIS.
More expert takes
Michael Pedrotti, Owner, Game Host Bros
“The most common and costly mistake I saw was password reuse: staff using the same password everywhere and no password manager, so one leaked login opens every door. A close second was passwords and sensitive details written on sticky notes stuck to screens, which anyone can photograph, and employees often post photos of their desks on social media without noticing. The first practical step is to roll out a password manager for the whole team, give every account a unique password, and clear the notes off the monitors.”
Michael Pedrotti is the owner of Game Host Bros.
Gopi Chand Vegineni, Senior UI/UX Developer & AI Interfaces Researcher, Nexsolv, Inc.
“The biggest mistake I see is small businesses assuming they are too small to be a target, so they leave basic doors unlocked while worrying about exotic attacks. In my research on dark web anomaly detection, we found that the most damaging intrusions rarely start with a sophisticated hack — they start with a reused password, an unpatched system, or a phishing email that quietly opens a foothold. The fix is not expensive tools but disciplined basics: unique credentials with multi-factor authentication everywhere, automatic patching turned on, and backups that are actually tested.”
The most damaging intrusions rarely start with a sophisticated hack but with a reused password, an unpatched system, or a phishing email; the fix is disciplined basics and tested backups.
Gopi Chand Vegineni is a senior UI/UX developer and AI interfaces researcher at Nexsolv, Inc.
Nicholas Carroll, Co-founder & CTO, Deception Check
“Start with a basic inventory of your devices, software, and important accounts, including any production or building-control systems; a spreadsheet is enough to get started. Use it to identify what needs updating and where multi-factor authentication is missing, starting with email, remote access, and administrator accounts. The basics do not have to be expensive, but someone has to own the work and follow through.”
Start with a spreadsheet inventory of devices, software, and accounts, then identify what needs updating and where MFA is missing; someone must own the work.
Nicholas Carroll is the co-founder and CTO of Deception Check.
Matt Sergeant, Founder, inletAP
“The costly one is paying a supplier's "new bank details" because an email asked you to. Call the vendor on a number you already had on file (not one from the message), and have a second person approve any change to payment details.”
Email is easy to fake and easier to take over; never change payment details based on an email and always have a second person approve such changes.
Matt Sergeant is the founder of inletAP.
Ranjith Raghunath, CEO, CX Data Labs
“Using reputable off-the-shelf products is a good place to start, especially for logins and payment processing, but it's better to look at a cybersecurity breach as a question of when, not if. This means you've got to create a breach recovery plan. Make backups of sensitive data, invest in insurance if you face a risk of compromising customer data, and find a way to keep the lights on if key systems go down.”
Small businesses often don't know where to start; they should treat a breach as a question of when, not if, and create a recovery plan with backups, insurance, and a way to keep operations going.
Ranjith Raghunath is the CEO of CX Data Labs.
Bree Sharp, Web Developer & Technical SEO Consultant
“The costliest mistake I see is treating the website as finished: a WordPress site running outdated plugins, with one admin login shared between the owner, a past freelancer, and the bookkeeper. That's not a hacker problem, that's a housekeeping problem. The first step is to list who has admin access today, delete every account that doesn't need it, turn on two-factor for the rest, and put plugin updates on a weekly schedule with one named owner.”
Bree Sharp is a web developer and technical SEO consultant.
Dustin Sandlin, Cybersecurity and Online Safety Expert, AskTech.Support
“Your business shouldn't depend on one person's phone to stay in business, yet that's exactly what happens when every critical account sends its verification codes to the owner or a single employee. Time and Time again I have seen small businesses lose access to their socials and other critical accounts, because a single employee left, or because one person's phone was hacked or stolen. To combat this, start with your most critical systems: give at least two authorized administrators separate logins, each protected by a unique password and their own physical security key—no shared passwords, no shared keys, and no dependence on one person for access.”
Many small businesses lose access to critical accounts because one person's phone was hacked or stolen, or because that employee left; the fix is separate logins and physical security keys for at least two administrators.
Dustin Sandlin is a cybersecurity and online safety expert at AskTech.Support.
RestoZign
“The costliest mistake we see is a business website left on autopilot: software never updated, one reused password on the admin login, and no backups kept anywhere off the site itself. The first practical step costs an afternoon: turn on automatic updates, put a unique password plus two-factor authentication on every admin account, and schedule daily backups stored somewhere other than the website's own server.”
A business website left on autopilot with one reused password and no off-site backups becomes a catastrophic loss when compromised; automatic updates and daily backups stored elsewhere are the fix.
RestoZign provides web security guidance.
Scott Sampson, Founder & CEO, Nimbus Pages
“The biggest mistake I see is small businesses treating security as an afterthought: they patch, but they don't use multi-factor login or single sign-on, random teams buy software that nobody checks for vulnerabilities or fit, and it all rests on one person who has five other jobs. The first fix is what I call survival-mode disaster recovery: figure out the handful of systems the business can't run without, and work out exactly how you'd get them back fast if ransomware hits. You don't need a full disaster-recovery plan on day one; you need to know what matters most and how to recover it.”
Small businesses treat security as an afterthought; the first step is survival-mode disaster recovery—identifying the handful of systems you can't run without and knowing how to recover them fast if ransomware hits.
Scott Sampson is the founder and CEO of Nimbus Pages.
Sonu Goswami, RankScope
“The mistake we see in our own logs is trusting a bot because of the name it gives. Over 30 days, the most common failed requests to our website weren't broken links but probes for secret files such as /.env.local, /localhost.key and /.boto, sent under the names of well-known AI crawlers that many sites now allow by name. The first fix is to make sure no secrets or config files can be reached from your web server at all, then verify any bot you let in against its operator's published IP addresses, because a user-agent name costs nothing to fake.”
Attackers spoof well-known bot names to probe for secret files like .env and .boto; the fix is to prevent secrets and config files from being reachable from the web server and verify any bot against its operator's published IP addresses.
RankScope monitors web security threats.
Kevin Charest, CISO and VP of Cyber Governance Services, Netrio
“The costliest mistake I've seen small businesses make is trusting a payment request because it appears to come from a reliable source, like a landlord, a key supplier or even their own CFO. Any time someone asks to change where the money usually goes, that's when your "spidey sense" should go off, so verify the request with a callback through a channel you already trust and always have two people sign off on large payments. In the end, it's okay to say, 'I need to double check that.'”
Trusting a payment request because it appears to come from a reliable source is a major mistake; verify all payment changes through a channel you already trust and always have two people sign off on large payments.
Kevin Charest is the CISO and VP of cyber governance services at Netrio.
Joshua M. Estrin, PhD, Solutions Architect, Researcher, Concepts in Success
“The biggest mistake a SMB makes is that they are somehow immune to this kind of risk. The solution is all about visibility. If you can't explain in less than 1 minute what your AI is doing, what guardrails are in place and who is in charge of making sure your AI agents don't become too "curious", it is only a matter of time before you are faced with a crisis.”
Small businesses wrongly assume they're immune to risk; the solution is visibility—if you can't explain in less than a minute what your AI is doing and who's in charge, a crisis is coming.
Joshua M. Estrin, PhD, is a solutions architect and researcher at Concepts in Success.
James Cimino, Founder, Unit Enterprises
“Passwords alone aren't enough to protect a small business. Enabling 2FA (Two Factor Authentication) on business email and essential software makes it much harder for hackers to break in using stolen credentials.”
James Cimino is the founder of Unit Enterprises.
Frequently asked questions
Why is multi-factor authentication so important for small businesses?
MFA adds a second verification step beyond a password, which stops the vast majority of attacks that rely on stolen credentials. Once an email account is compromised, an attacker can reset most other logins and send convincing fake invoices from trusted addresses. Enabling MFA on email, admin accounts, and payment systems takes an afternoon but closes that door.
How often should a small business patch its software?
Software should be patched automatically whenever possible. Vulnerabilities are being actively exploited the same day fixes are released, so waiting for a hosting provider to patch is no longer safe. The first step is to list every system your business exposes to the internet and enable automatic updates, then audit that list monthly.
What should I do when an employee leaves?
Revoke all access the day someone leaves: turn off email, reclaim devices, change any shared passwords, and remove their logins from all admin accounts. A former employee's laptop can still contain saved passwords, cached files, and working VPN logins if it isn't wiped. Use a simple offboarding checklist to make sure nothing is forgotten.
Can I rely on staff training alone to prevent phishing attacks?
No. Phishing accounts for roughly 90 percent of data breaches, and some scams are so convincing that even sophisticated security systems miss them. Training helps, but businesses need layered defenses: email filtering, multi-factor authentication, and realistic phishing simulations that build muscle memory over time. Design your security for when something inevitably slips through.
What's the first security step if I have a very small budget?
Start with a spreadsheet inventory of every system your business uses and who has admin access to each one. Then enable multi-factor authentication on email and admin accounts, give each person their own unique login (no sharing), and remove access for anyone who no longer needs it. This costs nothing, takes an afternoon, and blocks most common attacks.
The bottom line
Small businesses are targeted just as much as large ones—attackers use automated tools to scan for easy entry points rather than targeting by company size. The most common and costly mistakes cluster around five themes: weak or shared passwords without multi-factor authentication, unpatched software and forgotten systems, phishing and email compromise, failure to revoke access when staff leave, and uncontrolled employee use of third-party tools and AI. The good news is that the fixes cost little or nothing. Start with a simple inventory of what your business exposes to the internet, assign a named owner to each system, enable multi-factor authentication on email and admin accounts, turn on automatic updates, and revoke credentials the day someone leaves. Layered on top of these basics—email filtering, regular phishing simulations, access audits, and tested backups—most of the high-cost breaches that plague small businesses become preventable.
Responses were collected through a media query in October 2026 and have been lightly edited for length. This article is general information on cybersecurity practices and is not a substitute for professional IT or legal advice specific to your business situation.
This article first appeared on Grayline Post.
Top comments (0)