Security advice written for enterprises can feel irrelevant when you are twenty people with no IT department. But most real-world incidents at growing companies come down to the same handful of gaps — and every one of them can be closed with modest, unglamorous effort. This is the baseline, minus the fear-mongering.
Multi-factor authentication, everywhere that matters
Stolen and reused passwords remain the most common way into a company's accounts, and multi-factor authentication is the cheapest defence you can deploy against them. Turn it on for email first — email resets every other password — then for admin consoles, finance tools, code hosting, and cloud accounts.
Prefer an authenticator app or a hardware key over text messages where you can, and make MFA a condition of access rather than a personal choice. The occasional grumble about a six-digit code is a small price for closing the door most attackers walk through.
Backups you have actually restored
A backup you have never restored is a hope, not a plan. Ransomware, a deleted folder, a failed laptop, an angry ex-contractor — the causes vary, but the question is always the same: can you get the data back, and how long does it take? The pattern that works is boring: automatic, kept apart from the primary system, and tested. At least one copy should be separated from your main environment, so whatever hits production cannot also reach the backups.
Twice a year, pick a file, a database, and a mailbox, and restore them for real. Time it. The exercise takes an afternoon and answers the only questions that matter.
A patching cadence you can actually keep
Most breaches are not exotic — they walk in through known vulnerabilities in software nobody updated. The fix is a rhythm, not heroics: automatic updates on operating systems and browsers, and a short monthly review for everything that cannot update itself — servers, routers, plugins, dependencies.
Keep a simple inventory of what you run and who owns updating each piece. The forgotten server nobody looks at is a far bigger risk than the systems everyone uses daily, because you cannot patch what nobody remembers owning. An hour a month spent on this list quietly removes an entire category of incident.
Least privilege, and offboarding that honours it
People should hold the access their job requires — no more. Fewer admin accounts mean fewer catastrophic mistakes and less damage when a credential leaks. Review access quarterly and downgrade anything that accumulated “just in case”; access tends to ratchet upward unless someone deliberately winds it back.
Offboarding is least privilege with a deadline. Keep a per-role checklist: disable single sign-on, revoke email, remove repository and cloud access, rotate any shared credentials the person knew, and collect devices — on the leaving day, not at the end of the month. A leaver with lingering access is one of the most common findings in any security review, and one of the most avoidable.
Phishing awareness without the theatrics
Phishing works because it targets busy people, not careless ones. Skip the blame culture and teach two habits instead. First: slow down on any message that pairs urgency with a request — pay this invoice, click this link, buy gift cards, change these bank details. Second: verify unusual requests through a second channel, such as calling the colleague who supposedly sent the email.
Then make reporting effortless and consequence-free. A team that forwards suspicious messages to a known address within minutes is worth more than any filter, because the first person to spot a campaign protects everyone behind them.
Know what you will do on a bad day
You do not need a forty-page incident-response plan. You need one page that answers four questions: who do we call, and in what order? Who is allowed to take a system offline or freeze a payment? Where are the account recovery codes kept? What do we tell customers, and who says it? Write it while things are calm, and store it somewhere that still works when your main systems do not.
Then rehearse once. A one-hour tabletop walk-through of “our email account is compromised” will teach you more about your real gaps than any policy document ever will.
None of this requires a security team: MFA, backups you have restored, a patching rhythm, least privilege, clean offboarding, calm phishing habits, and a one-page plan. Each is a modest project on its own; together they close the gaps behind most of the incidents that actually happen to companies your size.
If you would like a structured look at where you stand, our security and reliability work starts with exactly this baseline — or tell us what worries you most and we will point you at the highest-leverage fix first.