Do small businesses actually need cyber security?

Small businesses get targeted more than they think, but you don’t need a big budget. Here’s the practical baseline that actually matters, minus the scaremongering.

There’s a lot of noise around cyber security, and most of it is aimed at making you nervous enough to buy something. So let’s be plain about it. If you run a business with one to ten people, you don’t need a fortress. But you do need a sensible baseline, because most attacks aren’t clever, targeted operations. They’re automated and opportunistic, and they find whoever left the door unlocked.

Yes, you’re a target, but not the way films suggest

Small businesses aren’t ignored by criminals. In many ways they’re preferred, because they hold useful data, handle real money, and rarely have proper defences. Nobody is sitting in a dark room picking you out by name. What happens is that automated tools scan the internet constantly for weak passwords, out-of-date software and people who’ll click a convincing email. If you’re an easy target, you get caught in the net.

The good news is that the same thing that makes those attacks cheap for criminals also makes them easy to block. You don’t have to be perfect. You just have to not be the easy one.

The baseline that actually matters

If you do nothing else, do these. They cover the large majority of real-world incidents affecting small firms.

• Turn on two-factor authentication (2FA) on email, banking, cloud storage and anything with customer data. This single step stops most account takeovers, even when a password leaks.
• Use a password manager so every account has a long, unique password. Reused passwords are how one breach becomes five.
• Keep software updated. Turn on automatic updates for your operating system, browser and phone. Most malware exploits holes that were patched months ago.
• Back up your data so a ransomware attack or a dead laptop is an inconvenience, not a disaster.
• Learn to spot phishing. The email that creates urgency and asks you to log in or pay is the one to slow down on.

None of this is expensive. Most of it is free or close to it, and it’s the difference between shrugging off an incident and losing a fortnight of work.

What you can reasonably skip for now

Plenty of products are sold to small businesses that they don’t really need yet. You probably don’t need a dedicated security team, an expensive threat-monitoring subscription, or the enterprise-grade firewall a salesperson is keen on. Antivirus is worth having, but the one built into Windows is genuinely fine for most people. Be wary of anything sold on fear rather than on solving a problem you actually have.

Cyber Essentials, the UK government-backed certification, is worth a look if you tender for public sector work or larger contracts, because it’s often required. If nobody’s asking for it, it’s a nice-to-have rather than urgent.

The human side is the weak point

Most breaches come down to a person, not a machine. Someone reuses a password, clicks a link, or wires money to a fake supplier email. That means the cheapest and most effective thing you can do is talk to your team. Agree that nobody pays an invoice or changes bank details based on an email alone. Make it normal to double-check by phone. Nobody should feel daft for pausing on a suspicious message.

A simple plan for this month

You don’t have to do everything at once. Pick a rainy afternoon and work through it in order: switch on 2FA everywhere important, set up a password manager, check your backups actually restore, and turn on automatic updates. That’s most of the job done in a couple of hours.

If you’d rather someone sanity-checked your setup or handled it for you, that’s exactly the kind of thing SeddCo does for small businesses across Shropshire and beyond. Give us a ring on 01746 325326 and we’ll talk it through in plain English.