10 Biggest Cybersecurity Mistakes That Companies Make

Tanya Wetson-Catt • 3 November 2023

Cybercriminals can launch very sophisticated attacks. But it’s often lax cybersecurity practices that enable most breaches. This is especially true when it comes to small and mid-sized businesses (SMBs).


Some business owners often don’t prioritize cybersecurity measures. They may be just fully focused on growing the company. They think they have a lower data breach risk. Or they may think it’s an expense they can’t bear.


But cybersecurity is not only a concern for large corporations. It's a critical issue for small and medium businesses as well. These businesses are often seen as attractive targets for cybercriminals. This is due to many perceived vulnerabilities. 


Fifty percent of SMBs have been victims of cyberattacks. More than 60% of them go out of business afterward.


Cybersecurity doesn’t need to be expensive. Most data breaches are the result of human error. But that is actually good news. It means that improving cyber hygiene can reduce the risk of falling victim to an attack.


Are You Making Any of These Cybersecurity Mistakes?


To address the issue, you need to first identify the problem. Often the teams at SMBs are making mistakes they don’t even realize. Below are some of the biggest reasons these businesses fall victim to cyberattacks. Read on to see if any of this sounds familiar around your company.


1. Underestimating the Threat


One of the biggest cybersecurity mistakes of SMBs is underestimating the threat landscape. Many business owners assume that their company is too small to be a target. But this is a dangerous misconception. 


Cybercriminals often see small businesses as easy targets. They believe the company lacks the resources or expertise to defend against attacks. It's essential to understand that no business is too small for cybercriminals to target. Being proactive in cybersecurity is crucial.


2. Neglecting Employee Training


When was the last time you trained your employees on cybersecurity? Small and medium businesses often neglect cybersecurity training for their employees. Owners assume that they will naturally be cautious online.


But the human factor is a significant source of security vulnerabilities. Employees may inadvertently click on malicious links or download infected files. Staff cybersecurity training helps them:


  • Recognize phishing attempts
  • Understand the importance of strong passwords
  • Be aware of social engineering tactics used by cybercriminals


3. Using Weak Passwords


Weak passwords are a common security vulnerability in companies. Many employees use easily guessable passwords. They also reuse the same password for several accounts. This can leave your company's sensitive information exposed to hackers.


People reuse passwords 64% of the time.


Encourage the use of strong, unique passwords. Consider implementing multi-factor authentication (MFA) wherever possible. This adds an extra layer of security.


4. Ignoring Software Updates


Failing to keep software and operating systems up to date is another mistake.


Cybercriminals often exploit known vulnerabilities in outdated software to gain access to systems. Businesses should regularly update their software to patch known security flaws. This includes operating systems, web browsers, and antivirus programs.


5. Lacking a Data Backup Plan


Some companies may not have formal data backup and recovery plans. They might mistakenly assume that data loss won't happen to them. But data loss can occur due to various reasons. This includes cyberattacks, hardware failures, or human errors.


Regularly back up your company's critical data. Test the backups to ensure they can be successfully restored in case of a data loss incident.


6. No Formal Security Policies


Many businesses often operate without clear policies and procedures. With no clear and enforceable security policies, employees may not know critical information. Such as how to handle sensitive data. Or how to use company devices securely or respond to security incidents. 


These businesses should establish formal security policies and procedures. As well as communicate them to all employees. The policies should cover things like:


  • Password management
  • Data handling
  • Incident reporting
  • Remote work security
  • And other security topics


7. Ignoring Mobile Security


As more employees use mobile devices for work, mobile security is increasingly important. Many companies often overlook this aspect of cybersecurity.


Put in place mobile device management (MDM) solutions. These enforce security policies on company- and employee-owned devices used for work-related activities.


8. Failing to Regularly Watch Networks


SMBs may not have IT staff to watch their networks for suspicious activities. This can result in delayed detection of security breaches.


Install network monitoring tools. Or consider outsourcing network monitoring services. This can help your business promptly identify and respond to potential threats.


9. No Incident Response Plan


In the face of a cybersecurity incident, SMBs without an incident response plan may panic. They can also respond ineffectively.


Develop a comprehensive incident response plan. One that outlines the steps to take when a security incident occurs. This should include communication plans, isolation procedures, and a clear chain of command.


10. Thinking They Don’t Need Managed IT Services


Cyber threats are continually evolving. New attack techniques emerge regularly. Some businesses often have a hard time keeping up. Yet, they believe they are “too small” to pay for managed IT services.


Managed services come in all package sizes. This includes those designed for SMB budgets. A managed service provider (MSP) can keep your business safe from cyberattacks. As well as save you money at the same time by optimizing your IT.


Learn More About Managed IT Services


Don’t risk losing your business because of a cyberattack. Managed IT services can be more affordable for your business than you think.



Give us a call today to schedule a chat.

Let's Talk Tech

More from our blog

Wi-Fi Performance Secrets to Boost Your Business Productivity

by Tanya Wetson-Catt • 15 September 2025
Nothing disrupts your workday quite like unreliable Wi-Fi. One moment everything’s running smoothly, and the next, video calls freeze, files won’t upload, and the team struggles to meet deadlines because everything’s slowed down. Being stuck in this situation is exhausting, killing productivity, and impacting the entire business. When slowdowns start happening regularly, frustration quickly builds. But here’s the good news: most businesses don’t need to overhaul their entire system. Usually, just a few smart tweaks to your network can bring your connection back to life. You don’t need a big IT team to make a real difference. By working with the right IT partners, you can pinpoint what’s slowing down your network, make smart upgrades, and turn your slow Wi-Fi into a fast, reliable system your team can count on every day. Why Stable Connection Is Essential for Your Business These days, everything we do at work depends on the internet, including: Video meetings Cloud-based apps Real-time messaging Smart devices like printers or coffee machines Slow connections are not just an inconvenience; they slow down your entire workflow. A reliable and fast network is no longer a luxury, but the foundation of a productive workplace. Check These 6 Signs to Know If Your Network Needs Help Curious about how your network is really performing? These six factors will give you a clear picture: Speed: Can your team upload, download, and stream without delays? Lag: Notice a delay between clicking and things happening? That's a lag. Dropouts: If your Wi-Fi signal keeps cutting out, that’s a problem. Jitter: On calls, if voices sound garbled or video stutters, jitter is likely to blame. Coverage: Dead zones around the office? You may need more access points. Security: Unknown devices connecting? That’s a red flag for performance and safety. 8 Smart Tips to Boost Your Network’s Performance If your connection keeps freezing during important client meetings or it takes too long to download apps, it can seriously hurt your business’s revenue and reputation if it goes on. Here are eight ways to optimise your network performance: 1. Upgrade Your Hardware If your router or firewall is several years old, it might be time for an upgrade. Outdated equipment can slow down even the fastest internet plans. Invest in equipment that can handle today’s demands and grow with you down the line. 2. Give Priority to What Matters Most Ever notice how streaming Netflix can disrupt your Zoom call? That’s where Quality of Service (QoS) comes in, it prioritises important traffic like video and phone calls, ensuring they get the bandwidth they need first. 3. Divide Your Networks Think of it like creating separate lanes to avoid traffic jams. By dividing your network into smaller segments, you reduce congestion and boost security. If one segment goes down, the others keep running, so you can maintain operations. It also helps different departments work efficiently without interfering with each other. 4. Balance Serve Load By balancing server load, you share workload across servers, so nothing gets overloaded. It keeps systems running smoothly during busy times and helps your team stay productive without delays. 5. Adjust Your Setup for Efficiency Sometimes slow internet is simply a matter of settings. Make sure to regularly check your router, switch, and firewall. Using network monitoring tools can help you quickly identify and fix any problems. 6. Watch for Threats Before They Slow You Down An Intrusion Detection System (IDS) keeps an eye out for unusual activity that might be slowing down your network. If someone tries to sneak in or overload your system, you’ll catch it early, before it turns into a bigger problem. It quietly works behind the scenes, protecting your system and keeping your connection steady. 7. Build in a Backup Plan Having a backup internet connection or extra equipment means your team can keep working, even if something goes down. There’s no need to sit around waiting for the internet to come back. It’s a simple, budget-friendly solution that small businesses can put in place easily, keeping you prepared for slowdowns or unexpected issues. 8. Tune Up Your Protocols Not all businesses use the same kind of internet traffic. If your network protocols are outdated or poorly configured, they can slow everything down. Updating them to better manage data flow can make a significant difference, especially for businesses that rely on real-time data, like customer service, trading, or e-commerce. Ready for a Real Fix? Call in the Pros You’ve got more important things to do than deal with dropped signals or choppy calls, and that’s where we can help. We’ll make sure your network runs smoothly and stays free from interruptions. Whether you're managing complex operations or leading a large team, we’ll help you build a Wi-Fi network that’s fast, secure, and reliable. Here’s what we have to offer: Clean, modern hardware setups Smarter configurations tailored to your needs Proactive security and support Solutions that scale as you grow We don’t make quick fixes; we do it right. Let us take the pressure off. Contact us today, and we’ll help turn your slow, unreliable network into one your team can count on, so you can stay focused, work faster, and keep things moving forward.

Securing Your Supply Chain Practical Cybersecurity Steps for Small Businesses

by Tanya Wetson-Catt • 27 August 2025
Picture this: your business’s front door is locked tight, alarm systems are humming, and firewalls are up, but someone sneaks in through the back door, via a trusted vendor. Sound like a nightmare? It’s happening more often than you think. Cybercriminals aren’t always hacking directly into your systems anymore. Instead, they exploit the vulnerabilities in the software, services, and suppliers you rely on every day. For small businesses, this can feel like an impossible puzzle. How do you secure every link in a complex chain when resources are tight? That’s where reliable IT solutions come in. They help you gain visibility and control over your entire supply chain, providing the tools to spot risks early and keep your business safe without breaking the bank. A report shows that 2023 supply chain cyberattacks in the U.S. affected 2,769 entities, a 58% increase from the previous year and the highest number reported since 2017 . The good news is you don’t have to leave your business exposed. With the right mindset and practical steps, securing your supply chain can become manageable. This article walks you through easy-to-understand strategies that even the smallest business can implement to turn suppliers from a risk into a security asset. Why Your Supply Chain Might Be Your Weakest Link Here’s the harsh truth: many businesses put a lot of effort into protecting their internal networks but overlook the security risks lurking in their supply chain. Every vendor, software provider, or cloud service that has access to your data or systems is a potential entry point for attackers. And what’s scarier? Most businesses don’t even have a clear picture of who all their suppliers are or what risks they carry. A recent study showed that over 60% of organisations faced a breach through a third party, but only about a third trusted those vendors to tell them if something went wrong. That means many companies find out about breaches when it’s already too late, after the damage is done. Step 1: Get a Clear Picture: Map Your Vendors and Partners You might think you know your suppliers well, but chances are you’re missing a few. Start by creating a “living” inventory of every third party with access to your systems, whether it’s a cloud service, a software app, or a supplier that handles sensitive information. List everyone: Track every vendor who touches your data or systems. Go deeper: Look beyond your direct vendors to their suppliers, sometimes risks come from those hidden layers. Keep it current: Don’t treat this as a one-time job. Vendor relationships change, and so do their risks. Review your inventory regularly. Step 2: Know Your Risk: Profile Your Vendors Not all vendors carry the same weight in terms of risk. For example, a software provider with access to your customer data deserves more scrutiny than your office supplies vendor. To prioritise, classify vendors by: Access level: Who can reach your sensitive data or core infrastructure? Security history: Has this vendor been breached before? Past problems often predict future ones. Certifications: Look for security certifications like ISO 27001 or SOC 2, but remember, certification isn’t a guarantee, dig deeper if you can. Step 3: Don’t Set and Forget: Continuous Due Diligence Treating vendor security like a box to check once during onboarding is a recipe for disaster. Cyber threats are evolving, and a vendor who was safe last year might be compromised now. Here’s how to keep your guard up: Go beyond self-reports: Don’t rely only on questionnaires from vendors, they often hide problems. Request independent security audits or penetration testing results. Enforce security in contracts: Make sure contracts include clear security requirements, breach notification timelines, and consequences if those terms aren’t met. Monitor continuously: Use tools or services that alert you to any suspicious activity, leaked credentials, or new vulnerabilities in your vendor’s systems. Step 4: Hold Vendors Accountable Without Blind Trust Trusting vendors to keep your business safe without verification is a gamble no one should take. Yet, many businesses do just that. To prevent surprises: Make security mandatory: Require vendors to implement multi-factor authentication (MFA), data encryption, and timely breach notifications. Limit access: Vendors should only have access to the systems and data necessary for their job, not everything. Request proof: Ask for evidence of security compliance, such as audit reports, and don’t stop at certificates. Step 5: Embrace Zero-Trust Principles Zero-Trust means never assuming any user or device is safe, inside or outside your network. This is especially important for third parties. Key steps include: Strict authentication: Enforce MFA for any vendor access and block outdated login methods. Segment your network: Make sure vendor access is isolated, preventing them from moving freely across your entire system. Verify constantly: Recheck vendor credentials and permissions regularly to ensure nothing slips through the cracks. Businesses adopting Zero-Trust models have seen a huge drop in the impact of vendor-related breaches, often cutting damage in half. Step 6: Detect and Respond Quickly Even the best defences can’t guarantee no breach. Early detection and rapid response make all the difference. Practical actions include: Monitoring vendor software: Watch for suspicious code changes or unusual activity in updates and integrations. Sharing threat info: Collaborate with industry groups or security services to stay ahead of emerging risks. Testing your defences: Conduct simulated attacks to expose weak points before cybercriminals find them. Step 7: Consider Managed Security Services Keeping up with all of this can be overwhelming, especially for small businesses. That’s where managed IT and security services come in. They offer: 24/7 monitoring: Experts watch your entire supply chain non-stop. Proactive threat detection: Spotting risks before they escalate. Faster incident response: When something does happen, they act quickly to limit damage. Outsourcing these tasks helps your business stay secure without stretching your internal resources thin. Ignoring supply chain security can be costly. The average breach involving a third party now tops £4 million, not to mention the damage to reputation and customer trust. On the flip side, investing in proactive supply chain security is an investment in your company’s future resilience. It protects your data, your customers, and your bottom line. Taking Action Now: Your Supply Chain Security Checklist Map all vendors and their suppliers. Classify vendors by risk and access level. Require and verify vendor security certifications and audits. Make security mandatory in contracts with clear breach notification policies. Implement Zero-Trust access controls. Monitor vendor activity continuously. Consider managed security services for ongoing protection. Stay One Step Ahead Cyber attackers are not waiting for a perfect moment, they are scanning for vulnerabilities right now, especially those hidden in your vendor ecosystem. Small businesses that take a proactive, strategic approach to supply chain security will be the ones that avoid disaster. Your suppliers shouldn’t be the weakest link. By taking control and staying vigilant, you can turn your supply chain into a shield, not a doorway for attackers. The choice is yours: act today to protect your business or risk being the next headline.  Contact us to learn how our IT solutions can help safeguard your supply chain.

Building a Smart Data Retention Policy: What Your Small Business Needs to Keep (and Delete)

by Tanya Wetson-Catt • 22 August 2025
Does it ever seem like your small business is overwhelmed with data? This is a very common phenomenon. The digital world has transformed how small businesses operate. We now have an overwhelming volume of information to manage employee records, contracts, logs, financial statements, not to mention customer emails and backups. A study by PR Newswire shows that 72% of business leaders say they've given up making decisions because the data was too overwhelming. If not managed properly, all this information can quickly become disorganised. Effective IT solutions help by putting the right data retention policy in place. A solid data retention policy helps your business stay organised, compliant, and save money. Here's what to keep, what to delete, and why it matters. What Is a Data Retention Policy and Why Should You Care? Think of a data retention policy as your company’s rulebook for handling information. This shows how long you hold on to data, and when is the right time to get rid of it. This is not just a cleaning process, but it is about knowing what needs to be kept and what needs to be deleted. Every business collects different types of data. Some of it is essential for operations or for legal reasons. Other pieces? Not so much. It may seem like a good idea to hold onto data, but this increases the cost of storage, clutters the systems, and even creates legal risks. Having a policy not only allows you to keep what's necessary but lets you do so responsibly. The Goals Behind Smart Data Retention A good policy balances data usefulness with data security. You want to keep the information that has value for your business, whether for analysis, audits, or customer service, but only for as long as it’s truly needed. Here are the main reasons small businesses implement data retention policies: Compliance with local and international laws. Improved security by eliminating outdated or unneeded data that could pose a risk. Efficiency in managing storage and IT infrastructure. Clarity in how and where data lives across the organisation. And let’s not forget the value of data archiving. Instead of storing everything in your active system, data can be tucked away safely in lower-cost, long-term storage. Benefits of a Thoughtful Data Retention Policy Here’s what a well-planned policy brings to your business: Lower storage costs: No more paying for space used by outdated files. Less clutter: Easier access to the data you do need. Regulatory protection: Stay on the right side of laws like GDPR, HIPAA, or SOX. Faster audits: Find essential data when regulators come knocking. Reduced legal risk: If it’s not there, it can’t be used against you in court. Better decision-making: Focus on current, relevant data, not outdated noise. Best Practices for Building Your Policy While no two businesses will have identical policies, there are some best practices that work across the board: 1. Understand the laws: Every industry and region has specific data requirements. Healthcare providers, for instance, must follow HIPAA and retain patient data for six years or more. Financial firms may need to retain records for at least seven years under SOX. 2. Define your business needs: Not all retention is about legal compliance. Maybe your sales team needs data for year-over-year comparisons, or HR wants access to employee evaluations from the past two years. Balance legal requirements with operational needs. 3. Sort data by type: Don’t apply a one-size-fits-all policy. Emails, customer records, payroll data, and marketing files all serve different purposes and have different retention lifespans. 4. Archive don’t hoard: Store long-term data separately from active data. Use archival systems to free up your primary IT infrastructure. 5. Plan for legal holds: If your business is ever involved in litigation, you’ll need a way to pause data deletion for any records that might be needed in court. 6. Write two versions: One detailed, legal version for compliance officers, and a simplified, plain-English version for employees and department heads. Creating the Policy Step-by-Step Ready to get started? Here’s how to go from idea to implementation: 1. Assemble a team: Bring together IT, legal, HR, and department heads. Everyone has unique needs and insights. 2. Identify compliance rules: Document all applicable regulations, from local laws to industry-specific guidelines. 3. Map your data: Know what types of data you have, where it lives, who owns it, and how it flows across systems. 4. Set retention timelines: Decide how long each data type stays in storage, gets archived, or is deleted. 5. Determine responsibilities: Assign team members to monitor, audit, and enforce the policy. 6. Automate where possible: Use software tools to handle archiving, deletion, and metadata tagging. 7. Review regularly: Schedule annual (or bi-annual) reviews to keep your policy aligned with new laws or business changes. 8. Educate your staff: Make sure employees know how the policy affects their work and how to handle data properly. A Closer Look at Compliance If your business operates in a regulated industry, or even just handles customer data, compliance is non-negotiable. Examples of data retention laws from around the world include: HIPAA: Healthcare providers must retain patient records for at least six years. SOX: Publicly traded companies must keep financial records for seven years. PCI DSS: Businesses that process credit card data must retain and securely dispose of sensitive information. GDPR: Any business dealing with EU citizens must clearly define what personal data is kept, why, and for how long. CCPA: California-based or U.S. companies serving California residents must provide transparency and opt-out rights for personal data. Ignoring these rules can lead to steep fines and reputational damage. A smart IT service provider can help navigate these regulations and keep you compliant. Clean Up Your Digital Closet Just like you wouldn’t keep every receipt, email, or post it note forever, your business shouldn’t hoard data without a good reason. A smart, well-organised data retention policy isn’t just an IT necessity, it’s a strategic move for protecting your business, lowering costs, and staying on the right side of the law. IT solutions aren’t just about fixing broken computers; they’re about helping you work smarter. And when it comes to data, a little organisation goes a long way. So don’t wait for your systems to slow down or a compliance audit to hit your inbox.  Contact us to start building your data retention policy today and take control of your business’s digital footprint.