Reading the news, you might think every small business is perpetually on the brink of a cyberattack. The reality is less dramatic — but also less reassuring than many assume: small businesses are attractive targets precisely because they are often less well protected.
The good news: you do not need to spend a fortune to protect yourself properly. The following five measures cover 90 per cent of the risks.
1. Endpoint protection on every device
Every computer, every laptop, every company phone needs up-to-date endpoint protection. Not the free Windows Defender, but a professional solution such as ESET Endpoint Security. The difference: professional solutions detect not only known viruses, but also suspicious behaviour.
The ESET licence is included in the per-user price of our managed IT packages. For businesses without a managed IT contract, an ESET licence costs approximately €3 to €5 per device per month.
2. Two-factor authentication. Everywhere.
The simplest and most effective security upgrade you can implement today. Even if someone knows your password, they cannot get in without the second factor. Enable 2FA at a minimum for Microsoft 365, your email account, online banking, and all admin accounts.
It takes five minutes per service and prevents by far the most common attack vector: stolen or guessed passwords.
3. Backup using the 3-2-1 rule
Three copies of your data. On two different media. One of them off-site. In practice: data on the server (copy 1), backed up overnight to a local NAS (copy 2), and additionally replicated to the cloud (copy 3).
What matters is not just that you back up, but that you regularly test whether the restore actually works. We carry out test restores for our clients on a regular basis.
4. Apply updates promptly
Most successful attacks exploit known vulnerabilities for which patches have long been available. The problem is not that vendors are too slow to patch. The problem is that many businesses do not apply those patches promptly.
A word of caution about "auto-update everything": a faulty Windows update has brought more than one server to its knees. We test patches in a controlled environment first before rolling them out to clients.
5. Configure your firewall properly
A firewall running on default settings is better than no firewall — but only just. The real work lies in the configuration: which ports are open? Which devices are allowed to communicate where? We deploy Fortinet firewalls and configure each one individually. This includes ongoing maintenance: firmware updates, rule set adjustments, and log analysis.
For a small business with 10 to 30 employees, you do not need a SOC, AI-driven threat analysis, or a cyber-insurance policy costing €5,000 a year. Implement the five measures above properly.