You do not need to be a large company to suffer a cyberattack: SMEs are targeted precisely because they usually have fewer controls in place. The good news is that most incidents rely on basic things that are missing. These ten checks cover the essentials, and you can start today.
1. Turn on multi-factor authentication (MFA) everywhere critical
It is the measure with the best cost-benefit ratio: even if an attacker gets your password, they cannot get in without the second factor. Start with email (almost every other account is reset from it), then banking, cloud and CRM.
How to check: open the security settings of each service and verify MFA is enabled. If it is not, turn it on — most take less than five minutes.
2. Know what is visible from the internet
Forgotten subdomains, reachable admin panels, test servers… Anything that answers from the internet is attack surface, and it tends to grow unnoticed.
How to check: ask your hosting or DNS provider for the list of active subdomains, note what each one is for, and shut down or protect what you do not use. A free OSINT audit delivers this in 72 h without touching your systems.
3. Keep updates current (automatic where possible)
Most attacks exploit flaws that already have a published patch. You do not need the latest hardware: you need the patches applied.
How to check: enable automatic updates for the operating system and browser. For the website (CMS and plugins), put a monthly review in the calendar.
4. Backups that are actually tested
A backup that has never been restored is not a backup: it is a hope. Ransomware specifically targets backups connected to the network.
How to check: run a test restore to an isolated machine this quarter and confirm the backups are not reachable from the work network with normal credentials.
5. Ex-employee accounts and forgotten access
People leave, suppliers change, internships end… and the accounts stay active. They are a favourite entry point because nobody watches them.
How to check: make a list of who has access to email, CRM, cloud and hosting. Anything no longer in use should go — today.
6. Unique passwords with a team password manager
Reusing your email password anywhere else is handing over the keys: one leak from a forum or an online shop is enough to open the important doors.
How to check: adopt a password manager with team plans, create unique passwords and start with email and banking. Modern browsers can generate and store them for you.
7. Know whether your credentials are circulating out there
When a credential appears in a breach, the clock starts ticking: attackers will try it against your systems within days.
How to check: look up your domain in known breach sources or order an OSINT audit: it is free, needs no access to your systems, and tells you which credentials and data of your company are circulating.
8. Anti-phishing training, with simulations
Email remains the favourite entry door. A team that can spot a fraudulent email is the best defence there is — and the cheapest.
How to check: run a simple simulation, measure who falls for it and repeat every six months. Reinforce without punishing: the goal is learning, not naming and shaming.
9. Alerts and access logging
Detecting a strange login early turns a weeks-long disaster into an hours-long incident.
How to check: enable sign-in alerts from new locations and review your email and cloud provider logs at least once a month.
10. A response plan: who to call
When something happens, improvising is expensive: the first hour decides the damage. A one-page plan is worth more than fifty theoretical pages.
How to check: write a single sheet with three things: who to call (provider, legal advisor, police), how to isolate affected machines and where the backups are.
If you want to know how your business looks from the outside before you start, begin with our free OSINT audit: we analyse your public exposure and deliver a report within 72 h.