Three weeks later

A small business owner once told us, "We don't need MFA. We're too small to be a target." Three weeks later, someone signed in to their email from a country they'd never been to. The password wasn't weak. There was simply nothing else standing in the way.

Most attacks today are automated. They don't look at your revenue or your headcount. They try thousands of doors at once and walk through whichever ones are unlocked. Being small doesn't hide you. It often just means fewer locks.

Five habits that stop the easy attacks

  1. Turn on MFA, or better, passkeys. Multi-factor authentication on your email is about a 10-minute job, and it's one of the biggest security upgrades you can make. If your provider supports passkeys, use them: there's no code to type and no text message to intercept, just your fingerprint or device unlock.
  2. Stop reusing passwords. When one site gets breached, attackers try that same email and password everywhere else: your email, banking, payroll, and Microsoft 365. A password manager gives every account its own strong password, and it lets your team share logins without texts or sticky notes. Put MFA on the manager itself.
  3. Keep everything updated. Outdated software is one of the easiest ways in. Once a flaw is made public, attackers start using it within days. Turn on automatic updates for computers, phones, routers, and website plugins, or have someone manage updates for you.
  4. Make backups automatic, and test them. One bad drive, a stolen laptop, or ransomware can wipe out years of work in seconds. Keep at least one copy off-site, have it run without anyone remembering to do it, and try a restore now and then. A backup you've never restored is a guess.
  5. Pause five seconds before you click. Good phishing emails don't look like scams anymore. They use a familiar name, a believable request, and a rush. Check that the sender's actual address matches who they claim to be, be wary of urgency, and hover over links to see where they really go. For any payment, gift card, or big order, confirm by phone with a number you already have.
A real one from our own inbox. We once got a large "order" for laptops from what looked like a school district. The name and the signature were real. The email domain was a lookalike, and the shipping address didn't match. Five seconds of checking, plus a quick check with the real district, stopped it.

Start with email

If you only do one thing this week, protect your email. It's the key to everything else: password resets, invoices, and client conversations all run through it. Turn on MFA or a passkey, then work down the list.

Want a second set of eyes?

Run our free Tech Checkup to see how your domain and email stack up, or book a free 30-minute consultation and we'll go through these five with you.