A Cygnus Business Services brand
Most of the security incidents I've cleaned up at small businesses didn't start with a sophisticated hacker. They started with a reused password, an approved MFA prompt nobody asked for, or an invoice with new bank details that someone paid without picking up the phone.
Those are habits, and habits are cheap to fix. Here are the ones I'd put in place in any office, whether it's five people or fifty.
Turn on MFA everywhere, and teach people what a strange prompt means
Multi-factor authentication stops most attacks that rely on a stolen password. Turn it on for Microsoft 365 or Google Workspace first, then for your bank, payroll, accounting software, domain registrar, and anything else with a login.
Use an authenticator app rather than text messages where you can. Microsoft Authenticator now asks you to type a number shown on the sign-in screen, which makes it much harder to approve a sign-in by accident.
The habit to teach is this: if you get an MFA prompt you didn't trigger, deny it and tell someone. That prompt means someone else has your password. Approving it to make it go away hands them the account.
Use a password manager, and stop reusing passwords
Nobody can remember 80 unique passwords, so people reuse three. When one website gets breached, attackers try that email and password everywhere else.
A business password manager such as 1Password, Bitwarden, or Keeper fixes this. Each person gets a vault, the company gets shared vaults for things like the vendor portal, and when someone leaves you remove their access in one place. Pick one, roll it out to everyone, and make it the only approved place to store work passwords. Not a spreadsheet. Not a sticky note under the keyboard.
Make a call-back rule for money
This one is cheap and stops one of the most expensive scams going. Business email compromise works like this: an attacker gets into a vendor's or client's mailbox, or makes a lookalike domain, and sends a perfectly normal email saying their bank details have changed.
Say you run a 12-person accounting firm in Exeter, or a real estate office handling closings. An email arrives from a familiar name with new wiring instructions. The habit:
- Any change to payment details gets verified by phone.
- Use a number you already have on file, never the one in the email.
- Two people sign off on wires over a set amount.
Write it down, tell everyone, and back up the person who delays a payment to make the call. That delay is the control working.
Report bad clicks fast, with no blame
People will click things. The question is whether they tell you in five minutes or hide it for five days.
Make reporting easy (a "Report" button in Outlook, or one email address or phone number) and make it safe. Thank the person who reports a mistake. The office manager who says "I think I just typed my password into something weird" has given you a chance to reset it before anyone uses it. Treat that as a win.
Short, regular training helps. Our sister company Red Sector Security runs security awareness training and phishing simulations if you want something more structured than a staff meeting talk.
Let updates happen
Most software updates fix security holes. The habit is boring: let Windows, macOS, browsers, and phones update, and restart when asked. A laptop that hasn't restarted in six weeks probably hasn't finished installing anything.
Your IT provider should be pushing and tracking updates centrally, through Intune or a management tool, and able to show you a report. That's part of our managed IT work. Your staff's job is not to click "remind me tomorrow" for a month.
Separate everyday accounts from admin accounts
Nobody should read email and browse the web while signed in as a global administrator. Admin access goes on a separate account, used only for admin work, with strong MFA. Owners often want admin rights "just in case." Keep a break-glass admin account documented and locked away instead.
Keep work data in work places
Client files belong in SharePoint, OneDrive, or your practice system, not in personal Gmail, a personal Dropbox, or a USB stick. That matters for backup and for offboarding, and it matters for the law. Under New Hampshire's breach notification law, RSA 359-C:20, a business that owns or licenses computerized personal information has to notify affected people, and the Attorney General or its regulator, unless it determines the information isn't likely to be misused. Maine's law sets a 30-day deadline for notifying residents in most cases. Massachusetts requires any business holding residents' personal information to keep a written information security program under 201 CMR 17.00. And tax preparers fall under the FTC Safeguards Rule, which requires a written security plan and MFA. You can't protect data you don't know is there.
This isn't legal advice. If you handle personal or financial data, talk to your attorney about which rules apply to you.
What to do this week
- Check that MFA is on for every Microsoft 365 or Google Workspace account. No exceptions for the owner.
- Turn on MFA for your bank, payroll, and domain registrar.
- Write a one-paragraph call-back rule for payment changes and send it to everyone who touches money.
- Tell your team, in plain words, how to report a suspicious email or a bad click, and that they won't be in trouble for it.
- Pick a password manager if you don't have one.
- Make sure nobody uses a global admin account for daily work.
Questions people ask
Is MFA by text message good enough?
It's much better than nothing. An authenticator app or a hardware security key is stronger, because text messages can be intercepted or redirected through a SIM swap. Use an app wherever the service supports it.
What should an employee do if they clicked a phishing link?
Disconnect from the network if anything installed or looked strange, then call IT right away. If they entered a password, reset it and sign out all sessions. Speed matters more than anything else.
Do small businesses really get targeted?
Yes. Most attacks are automated and don't care how big you are. A small office with no MFA and an exposed mailbox is an easier target than a large company with a security team.
What if we've already been hit?
Call for help before you start deleting things, so evidence and backups are preserved. Our sister company handles incident response, and Dreamline handles the recovery side.
Brady McNeill is the founder and CEO of Dreamline Technology. He has spent 12+ years running IT and security for small and mid-sized businesses across New England.