Cybersecurity for small businesses

Technology · 2026-04-07 · 8 min read

By Arjun Mehta, Engineering & product

You are not being targeted by a nation state. You are being targeted by a template, and templates are stopped by basics.

Attacks on small firms are overwhelmingly automated and opportunistic. Nobody studied your business; a script found an exposed login, a reused password or an unpatched appliance and took the cheapest path in.

Four controls stop most of it: phishing-resistant multi-factor authentication on email and money, automatic updates on everything, backups that somebody has restored from in a test, and removing access the day a person or supplier leaves.

The loss that actually happens to small businesses is invoice fraud. Somebody reads a real email thread, sends a convincing message with new bank details, and the payment goes out. The fix is procedural, not technical: verify any change of banking details by phone on a number you already had.

Write the incident plan on one page before you need it. Who is called, which accounts get locked first, where the backups are, what customers are told and by whom. Improvising this at 2am is how a contained incident becomes a public one.

Insurance is worth reading closely. Policies increasingly require the controls above to be in place, and a claim can be reduced or refused over a missing one, which makes the basics cheaper than they look.

Tags: security, startup, cyber

Arjun Mehta — Arjun writes about web performance, developer tooling and applied AI for ESPYCRUX. He has spent the last decade building and maintaining production web apps, and most of his articles start from something that broke in one of them.