Why small businesses keep getting breached — and the 5 controls that stop most attacks

Attackers don't hack small businesses because they're special targets. They hack them because automation finds them, and automation doesn't care how big you are. The good news: the attacks are predictable, so the defences can be too.

The five control layers that matter most

1. MFA on every account that matters

Multi-factor authentication on email and cloud accounts stops the single most common attack: stolen passwords being reused. It takes an afternoon to roll out and blocks the majority of account takeovers outright.

2. Managed endpoint detection (EDR)

Traditional antivirus matches known-bad files. EDR watches behaviour — encryption starting en masse, suspicious PowerShell, credential dumping — and responds in real time. It's the difference between a camera and a guard.

3. Email filtering that understands impersonation

Most ransomware starts as an email. Filters that spot lookalike domains, display-name spoofing and malicious attachments stop attacks before any employee has to make the right decision under pressure.

4. Tested, isolated backups

Backups only count if they survive the attack and restore cleanly. Isolated or immutable copies, monitored jobs, and actually restored in tests — that's what turns a catastrophe into a bad afternoon.

5. Trained, phishing-simulated humans

Every technical control eventually depends on a person not clicking. Short, regular awareness training plus safe simulated phishing measurably reduces click rates within a few months.

Where to start

If you're doing none of these, start with MFA and backups this week — they're the highest impact per hour of work. Then layer in EDR, filtering and training. If you'd like an independent view of where your own gaps are, that's exactly what a security assessment is for.