When we audit a business for the first time, we rarely find anything exotic. The gaps that put small and medium businesses at risk are ordinary, fixable and remarkably common. Here are the ones we see most often, why they matter and what to do about them.
1. Shared admin accounts
One “admin” login used by the owner, the office manager and the last IT supplier. When everyone uses the same account, you cannot tell who changed what, and you cannot remove one person’s access without changing it for everyone. Fix: give each person their own account, with admin rights only for those who need them.
2. Stale access
Former employees whose email still works, old suppliers with remote access tools still installed, shared passwords that have not changed in years. Fix: a written leaver process, and a quarterly review of every account with access to your systems.
3. No multi-factor authentication on email
Email is the key to almost everything else: password resets, invoices, customer conversations. A single stolen password is enough to take it over. Fix: turn on multi-factor authentication for every mailbox, starting with finance and management.
4. Flat networks
Guest Wi-Fi, CCTV cameras, printers and staff laptops all on the same network as the server holding your accounts. One compromised device can reach everything. Fix: separate guests and devices from business systems, so a problem in one area stays there.
5. Unpatched and unsupported systems
Computers that have not installed updates for months, operating systems past the end of support, and routers or firewalls that have never had a firmware update. Fix: automate updates, track what is out of support and plan its replacement.
6. Default passwords on devices
Routers, CCTV recorders and printers still using the password printed on the box. Fix: change them, record them somewhere safe, and disable remote access you do not use.
7. Payment fraud by email
A convincing email asking to change a supplier’s bank or M-Pesa details, sent from a lookalike address or a genuinely compromised account. Fix: a simple rule that any change of payment details is confirmed by phone, on a number you already have, before money moves.
8. Untested backups
Backups exist, but nobody has restored from them — and they are often reachable from the same network ransomware would spread across. Fix: keep an offline or unchangeable copy, and test restores regularly. We wrote about this in backups are not a strategy until you have tested them.
Where to start this week
- Switch on multi-factor authentication for email.
- Remove accounts belonging to people who have left.
- Agree the phone-confirmation rule for payment changes with your finance team.
- Ask when your backups were last restored.
None of these need a big budget, and together they close most of the doors attackers actually use. For a full picture, our cybersecurity service starts with a risk-led assessment and gives you a prioritised plan in plain language.