How Do I Protect My Small Business From Hackers?
The cyber threats small businesses face most, a 10-step security checklist, an incident response plan and free government resources.
Turn on multi-factor authentication for every important account, use a password manager, keep software updated, back up data using the 3-2-1 rule, train staff to spot phishing, verify any payment or bank-detail change by phone, limit access, secure Wi-Fi and devices, and write a simple incident response plan.
In this article
Small businesses are frequent targets for cybercriminals because they hold valuable data (customer information, payment details, bank access) but often have weaker defenses than large companies. The good news: most attacks exploit a handful of basic weaknesses, and fixing them costs little. This guide covers the threats that matter most and a practical checklist you can complete in a week.
The biggest cyber threats to small businesses
- Phishing: fake emails, texts and calls that trick people into clicking malicious links, entering passwords or sending money. It's the most common way attacks begin.
- Business email compromise: criminals impersonate a vendor, executive or client, often from a hacked or look-alike email account, and ask you to pay an invoice or change bank details.
- Ransomware: malware that locks your files and demands payment to unlock them.
- Stolen or weak passwords: attackers reuse passwords leaked from other breaches to break into your accounts.
- Unpatched software: known security holes in outdated systems, plugins and devices.
- Lost or stolen devices holding business data.
The small business cybersecurity checklist
1. Turn on multi-factor authentication (MFA) everywhere
MFA requires a second step, such as an app code or security key, in addition to a password. It's one of the most effective protections against account takeovers. Start with email, banking, payment processors, accounting software, your website and cloud storage. Authenticator apps and security keys are stronger than text-message codes.
2. Use a password manager
Give every account a long, unique password, and let a password manager remember them. Business password managers let you share access securely and remove it instantly when someone leaves.
3. Keep everything updated
Turn on automatic updates for operating systems, browsers, apps, website software and plugins. Replace devices and routers that no longer receive security updates.
4. Back up your data (and test it)
Follow the 3-2-1 rule: three copies of important data, on two different types of storage, with one copy offsite or in the cloud and protected from changes. Test restoring files regularly. Good backups turn a ransomware attack from a disaster into an inconvenience.
5. Train your team to spot phishing
Teach everyone the warning signs: urgency, unexpected attachments, requests for passwords or payments, and mismatched sender addresses. Make it easy and blame-free to report suspicious messages.
6. Verify every payment change by phone
If a vendor or client emails new bank details or an urgent payment request, call them on a phone number you already have, not one in the email. This single habit stops most business email compromise fraud.
Red flags in an invoice email: a changed bank account, a slightly different email domain, unusual urgency or secrecy, or a request to pay by gift card or crypto. When in doubt, call.
7. Limit access
Give each person only the access they need, use separate accounts instead of shared logins, and remove access immediately when someone leaves. Use administrator accounts only for admin tasks.
8. Secure your Wi-Fi and devices
Change default router passwords, use WPA3 or WPA2 encryption, keep a separate guest network for visitors, and turn on device encryption and screen locks for every laptop and phone. Enable remote wipe for company phones.
9. Protect your website and payments
Use HTTPS, keep your website platform and plugins updated, use strong admin passwords with MFA, and work with reputable payment processors so card data doesn't touch your systems. If you accept cards, follow PCI DSS requirements.
10. Collect only the data you need
Data you don't keep can't be stolen. Delete old customer records you no longer need, and never store full card numbers yourself.
What phishing looks like
- Fake invoice: "Attached is overdue invoice #4471. Please pay today to avoid service interruption." From a vendor you don't use, or a slightly misspelled one you do.
- Password reset: "Unusual sign-in detected on your account. Verify your password here." Links to a fake login page.
- Boss request: a text "from the owner" asking an employee to buy gift cards urgently for a client.
- Shared document: "You've been sent a document" with a link to a fake sign-in page for your email provider.
- Delivery problem: a text claiming a package can't be delivered until you pay a small fee.
The fix is the same every time: don't click from the message. Go directly to the website or call the person using contact details you already trust.
Offboarding checklist when someone leaves
- Disable their accounts on their last day (email, cloud storage, apps, admin panels).
- Change any shared passwords they knew, and move to individual accounts where possible.
- Recover company devices, keys and access cards.
- Remove them from payment systems, bank access and vendor portals.
- Transfer ownership of files, domains and social accounts they managed.
- Remove their access from your password manager.
Make an incident response plan
Write a one-page plan before anything goes wrong:
- Who to call: your IT provider, bank, insurer and, if needed, a lawyer.
- How to isolate affected devices (disconnect from the network; don't just turn them off).
- How to restore from backups.
- How to reset passwords and revoke access.
- Who must be notified. Most states have data breach notification laws that apply if personal information is exposed.
- Where to report: the FBI's Internet Crime Complaint Center (IC3.gov) for cybercrime, and your bank immediately for fraudulent payments.
Consider cyber insurance
Cyber insurance can cover costs like investigation, data recovery, customer notification, legal fees and business interruption. Insurers increasingly require basics like MFA and backups before they'll offer coverage, which is another reason to put them in place.
Free cybersecurity resources
- CISA (the Cybersecurity and Infrastructure Security Agency) offers free guides and services for small businesses.
- The FTC publishes "Cybersecurity for Small Business" materials you can use for staff training.
- The SBA has cybersecurity guidance for small business owners.
- NIST provides a small business cybersecurity corner with plain-language resources.
Plan your security checklist as tasks and tick them off one by one.
Open the project boardA one-week cybersecurity plan
| Day | Do this |
|---|---|
| Monday | Turn on MFA for email, banking and payment accounts |
| Tuesday | Set up a password manager and replace reused passwords |
| Wednesday | Turn on automatic updates everywhere; check your router |
| Thursday | Set up automated backups and test a restore |
| Friday | Run a 30-minute phishing awareness session and agree on the "call to verify payments" rule |
Frequently asked questions
Why do hackers target small businesses?
Small businesses have valuable data and money but often weaker defenses, making them easier targets. Many attacks are automated and hit any vulnerable business, regardless of size.
What is the most important cybersecurity step for a small business?
Turning on multi-factor authentication for email, banking and key business accounts is one of the most effective steps, followed by reliable backups and staff phishing training.
How much does cybersecurity cost for a small business?
The basics, such as MFA, updates, backups and training, cost little or nothing. Password managers, backup services and managed security providers add modest monthly costs that scale with your team.
What should I do if my business is hacked?
Isolate affected devices, contact your bank immediately if money is involved, reset passwords, restore from backups, call your IT provider and insurer, report the crime to IC3.gov, and check whether breach notification laws require you to inform customers.
This article is general information for US readers, not legal, tax or financial advice. Rules, prices and platform policies change, so confirm details with official sources or a qualified professional.