Most breaches at small and midsize businesses aren't sophisticated — they exploit everyday gaps. Here are five to close before the next one costs you.
When most people picture a cyberattack, they imagine a sophisticated hacker in a hoodie finding a zero-day flaw. The reality at growing businesses is usually far less dramatic — and far more preventable.
The majority of incidents we see trace back to a handful of everyday gaps. Here are five worth closing before they cost you.
1. Multi-factor authentication that isn't actually enforced
MFA is the single highest-return security control a small business can deploy. But there's a common failure mode: it's available on a tenant, but not required on the accounts that matter. Admin accounts, shared mailboxes, and finance users get overlooked.
The fix is policy, not just technology — enforce MFA on every privileged and external-facing account, and review exceptions regularly.
2. Unpatched, unmanaged endpoints
A laptop that hasn't been patched in three months is an open door. The gap isn't usually awareness — it's that patching is manual, inconsistent, and nobody owns it. Centralized endpoint management with automated patching closes most of this overnight.
3. Backups that have never been tested
A backup you've never restored from is a hope, not a plan. We regularly find businesses with backups running cleanly that can't actually restore — corrupted, incomplete, or missing the systems that matter. The only way to know is to test a restore.
4. Overprivileged accounts
Over time, people accumulate access they no longer need — admin rights from a project, shared logins, accounts for staff who left. Each one is an extra path to a breach. A periodic access review, even a simple one, removes most of this risk.
5. No clear response plan
When something goes wrong, the first ten minutes matter. Businesses without a plan lose those minutes to confusion — who do we call, what do we isolate, what do we tell customers? A one-page response plan that names owners and first steps is worth more than most tools.
Where to start
You don't need to fix all five at once. Start with MFA enforcement and a backup test — those two alone cover a disproportionate share of real incidents. Then work through the rest.
Not sure where your gaps are? Start with an IT Health Check — it's the fastest way to find out.