Cybersecurity for small businesses doesn't start with expensive software, but with a few fixed habits: strong passwords, two-factor authentication, updates, good backups and staff who can spot phishing. With those basics in place, you already stop most attacks.
Many business owners think their company is too small to be interesting. But most attacks aren't aimed at one particular business. Criminals send fake emails in bulk and try leaked passwords everywhere. Whoever leaves the door open gets hit. In this article you'll learn where to start, in what order, and what you can safely skip.
Why cybersecurity matters for small businesses too
A small business often has no IT department and no fixed security agreements. Everyone uses their own laptop, passwords are shared over WhatsApp and nobody makes backups on purpose. That's exactly what makes small and medium-sized businesses an easy target.
The damage is usually bigger than you think. Think of a hacked email account used to send fake invoices to your customers, ransomware that encrypts all your files, or a data breach you have to report under GDPR (AVG in Dutch). Besides money, it mainly costs time and trust.
The five biggest risks for small businesses
- Phishing: fake emails or messages that lure you to a fake login page or get you to open an infected attachment.
- Leaked or weak passwords: one password used in several places, which has leaked somewhere.
- Outdated software: a laptop, plug-in or router that hasn't had an update for months.
- Ransomware: malicious software that encrypts your files and demands a ransom.
- CEO fraud and invoice fraud: a message that seems to come from your boss or supplier, asking you to pay quickly.
Almost all these risks have one thing in common: they start with a person clicking on something, or with an account that's too easy to break into. So that's also where the biggest gains are.
Cybersecurity basics: the small business checklist
You don't have to do everything at once. Work through this list from top to bottom. The first points give the most protection for the least effort.
- Switch on two-factor authentication (2FA) for email, accounting, banking, website admin and cloud storage. With 2FA you need a code from your phone as well as your password.
- Use a password manager, so everyone has a unique, long password for each service.
- Switch on automatic updates on laptops, phones and software. Replace devices that no longer get updates.
- Make automatic backups and keep at least one copy separate from your network or with another provider.
- Only give people access to what they need. Remove accounts of staff who have left straight away.
- Encrypt laptops and switch on a screen lock, so a stolen laptop doesn't become a data breach.
- Agree that payment requests and changed bank account numbers are always checked by phone.
Read more about recovering data in our article on backups and recovery. And if you want to know how secure login works in your own systems, see login and two-factor authentication.
Spotting phishing: train your people
Technology helps, but most attacks come through a message. So it's smart to spend a short while on phishing with your team a few times a year. Show real examples and discuss what to look out for.
- Is the sender really who they say, or does it just look that way?
- Is there pressure to hurry, or a threat of a block or fine?
- Does the link lead to a different website than you expect? Hover over the link with your mouse first.
- Does the message ask you to log in, open an attachment or transfer money?
Make it easy to report a mistake too. Someone who clicked a wrong link must feel able to say so straight away. The sooner you know, the smaller the damage. A culture where people feel ashamed works against you.
Your website and software: often forgotten
Many business owners only think of their laptop and email when it comes to cybersecurity. But your website, online shop or customer portal is also a way in. An outdated plug-in or an admin account without 2FA is a well-known weak spot. On top of that, many systems store customer data, and then a breach falls under GDPR.
Ask yourself a few questions. Who has access to your website's admin? Are updates actually carried out? Where is your customer data stored, and who can get to it? For the technical side of your site, read more in securing your website. If you have custom software built, also look at getting secure software built.
What do you do if it goes wrong anyway?
Even with good security, things can go wrong. That's why a simple emergency plan matters. Write it on one A4 sheet and make sure everyone knows where it is, on paper too.
- Disconnect an infected device from the network and wifi straight away.
- Change the passwords of affected accounts from a different, clean device.
- Call your bank if payments have been made or account details have leaked.
- Warn customers and suppliers if fake emails have been sent in your name.
- Check whether it's a data breach. If you're unsure about your duty to report, you can turn to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or a lawyer.
- Only restore your backup once you're sure the cause is gone.
Report it to the police. And afterwards, look at what could be better, without blaming anyone.
Common cybersecurity mistakes
- Thinking your antivirus is enough.
- One shared password for the whole team.
- Backups that have never been tested, or that sit on the same drive as the original.
- Former staff who still have access for months.
- Seeing security as a one-off project instead of a regular habit.
How Violexa approaches security
We're not a security firm and we don't do penetration tests. We do build websites and custom web applications with security as a fixed part: secure login, limited permissions per user, updates and backups. With our maintenance plans we keep your website or software up to date. Silver costs €179 excl. VAT (€217 incl. VAT) per month, Gold €299 excl. VAT (€362 incl. VAT) and Platinum €699 excl. VAT (€846 incl. VAT).
Not sure whether your website or software is secure enough? Book a free quickscan. In 30 minutes, online or on site, we look at where you stand together. Afterwards you get brief written advice with a price indication, with no obligation.
Frequently asked questions
What are the most important cybersecurity basics for small businesses?
Start with two-factor authentication on your most important accounts and a password manager. Then switch on automatic updates and backups. Those four steps already stop most attacks.
Is a small business really interesting to hackers?
Yes. Most attacks aren't aimed at one business, but go out widely. Anyone with weak passwords or outdated software gets hit, however small the business.
Do I have to report a data breach?
Sometimes, yes. Under GDPR you often have to report a breach involving personal data to the Dutch Data Protection Authority. If you're unsure, ask a lawyer for advice or check with the regulator itself.
How often should I train my staff on phishing?
Discussing it briefly a few times a year usually works better than one long training session. Use real examples and make it easy to report mistakes.
