Cybersecurity for Small Business: A Plain-English Guide

General information, not legal advice.

Why small businesses are targets

It’s easy to think “we’re too small to bother with.” Attackers don’t see it that way. The SBA notes that small businesses can be attractive targets because they may lack the resources to protect their systems, and that many owners say they don’t know where to begin. ^[1]

The good news: the basics are cheap, and they work against the most common attacks.

The five habits that block most problems

1. Turn on multi-factor authentication (MFA) everywhere that matters

MFA means a password plus a second check, such as a code from an app, a prompt on your phone or a security key. Even if a password leaks, the attacker usually can’t get in. CISA, the federal cybersecurity agency, says using MFA makes you “99% less likely to be hacked.” ^[2]

Start with: email (the key to resetting everything else), banking and payroll, accounting software, your website and hosting control panel, and any AI tools connected to business data.

Pair it with unique passwords stored in a password manager. The FTC’s guidance to businesses stresses unique, complex passwords and MFA, citing real cases where a reused password opened the door to millions of records. ^[3]

2. Keep everything updated

Updates fix security holes that attackers already know about. That covers computers, phones, routers, your website software and its plugins, and the apps you use. The SBA recommends setting software to update automatically where possible, including operating systems and web browsers. ^[1] CISA’s ransomware guidance puts it simply: “Regularly patch and update software and Operating Systems.” ^[4]

3. Back up, and test that backups actually restore

Backups turn a disaster into an inconvenience, provided they work and an attacker can’t reach them. CISA’s advice: “Maintain offline, encrypted backups of data and regularly test your backups.” ^[4]

Ask yourself: If the office computers were locked tomorrow, what would we restore, from where, and how long would it take? If nobody knows, test it this month.

4. Give people only the access they need

Not everyone needs access to everything. The FTC calls this the “principle of least privilege”: each person gets access only to what their job requires. ^[5] Limit admin rights to a couple of trusted people. When someone leaves, remove their access the same day: email, files, apps, building codes. The SBA also recommends regular access audits to make sure former employees are removed. ^[1]

5. Train your team, briefly and often

The SBA identifies employees and work-related communications as a leading pathway into small-business systems, and recommends training on spotting phishing emails, safe browsing, avoiding suspicious downloads and using strong authentication. ^[1] Short, regular reminders work better than one long annual session.

Phishing and scams in the AI era

Phishing is a message that tricks someone into clicking a bad link, opening a bad attachment, sharing a password or sending money. For years the advice was “look for spelling mistakes.” That advice is out of date.

The FBI has warned that criminals use generative AI to commit fraud on a larger scale and make their schemes more believable. AI tools can “correct for human errors that might otherwise serve as warning signs of fraud,” and help criminals write messages faster and reach more people. ^[6] The same warning covers AI-generated images, fake documents and cloned voices.

What to look for instead:

Urgency or pressure: “today”, “immediately”, “before end of day”.
Unusual requests: gift cards, new bank details, a password or a code.
A slight change in who it’s from: a lookalike email address or a new phone number.
Anything that changes where money goes.

The rule that beats it: confirm through a second channel you already trust. If an email says a supplier changed bank details, call them on the number you already have, not the one in the email. If “the owner” texts asking for gift cards, call the owner. The FBI also suggests agreeing on a secret word or phrase with family members to verify identity ^[6], and a business can use the same idea for urgent payment requests.

Your website and hosting

Your website is often the most visible part of your business online, and an easy target if it’s neglected. The basics:

Software, theme and plugins kept up to date. Updates close security holes attackers already know about.
Remove what you don’t use: old plugins, old admin accounts, test copies of the site.
SSL (the padlock and https) so information sent through your site is encrypted in transit.
Backups of the site and its database, stored separately from the site itself.
Monitoring and alerts, so someone notices quickly when something is wrong.
MFA on admin and hosting logins.

AI tools and your data

AI tools bring their own security questions: what information they can see, where it’s stored, and who can access it. Use business accounts with MFA, connect AI only to what each task needs, and keep sensitive personal information out of public tools. Our guide to AI and your business data covers this in full, including questions to ask any AI vendor.

If you handle patient information, HIPAA adds specific security requirements, including a risk analysis, access controls and business associate agreements with vendors. See AI for healthcare and medical practices.

Plan for a bad day

The FTC’s guidance for businesses ends with a simple principle: “Plan ahead. Create a plan to respond to security incidents.” ^[5] For a small business, that plan can fit on one page:

Who’s in charge when something goes wrong, and who’s their backup.
Who to call: your IT or hosting provider, your bank (for payment fraud, call immediately), your insurer if you have cyber coverage, and your attorney.
First steps: disconnect affected computers from the network, change passwords from a clean device, and don’t pay a ransom before getting advice.
Where to report: the FBI’s Internet Crime Complaint Center (ic3.gov) ^[6], and CISA also takes reports. ^[4]
Who you may need to notify: customers, partners or regulators, depending on what was affected and the laws that apply. Ask your attorney.
Where the backups are and how to restore them.

Print it. If the computers are down, you’ll want it on paper.

A 30-minute checklist

MFA on email, banking, payroll, accounting and website/hosting logins
Password manager in use, no shared or reused passwords
Automatic updates on for computers, phones and browsers
Website software, theme and plugins up to date
Backups exist, are stored separately, and a test restore has been done
Admin rights limited to a few people
Leavers’ access removed the same day
Team knows the “confirm by phone” rule for money and password requests
One-page incident plan written and printed

How AltoSky handles security

When we host what we build, or take over your site, updates, nightly off-site backups, SSL and server monitoring are included, with 24/7 support. Every request gets an immediate AI response, and we guarantee a response within four hours, day or night.

We’ll tell you exactly what’s covered for your setup when we quote.

Cybersecurity for small businesses: a plain-English guide