Photo by Christopher Gower on Unsplash
There is a pattern that appears again and again in cyber security incident reports. An organisation gets breached. Investigators dig in. And what they find at the root cause is not some sophisticated nation-state attack, not a zero-day vulnerability that nobody could have predicted. It is something much more ordinary: a software update that never got applied, a default password that never got changed, a staff member who clicked a link in an email that looked just plausible enough.
This happens to large organisations with dedicated IT departments. It happens to public sector bodies with compliance requirements and budget. It happens because cyber security basics are easy to understand in theory and surprisingly hard to maintain consistently in practice, especially when everyone is focused on running the actual business.
If you run a small business, that should not be a comfort. It should be a prompt. Because you have fewer people, less redundancy, and in most cases no one whose sole job is to notice when something slips.
What the basics actually are
The phrase "cyber hygiene" gets used a lot. It rarely comes with a clear list. So here is one, in plain terms, covering what genuinely reduces your exposure rather than just making a tick-box somewhere look better.
Keep software updated and do it promptly
When a software vendor releases a security update, they are usually telling the world that a flaw existed and here is the fix. That means everyone who has not yet applied the patch is now running software with a known, documented weakness. Attackers read the same release notes you do. They move quickly. The window between a patch being released and it being actively exploited is often measured in days, sometimes hours.
This applies to everything: your operating system, your browser, your office applications, any software your team uses day to day, and the firmware on your router and other network devices. Most small businesses apply some updates some of the time. The gap is in making it systematic and fast rather than occasional. Automated patch management removes the dependency on someone remembering.
Control who has access to what
The principle here is simple: nobody should have access to systems or data they do not actively need for their job. In practice, small businesses tend to accumulate access over time. Someone joins and gets admin rights because it was convenient. Someone leaves and their account stays active for weeks. These are the footholds attackers use once they get a first foothold into your network.
Go through your accounts regularly. Remove what is no longer needed. Make sure the handful of people who genuinely need administrator-level access are using it deliberately rather than routinely.
Train staff on what to actually look for
Most breaches still begin with a phishing email. The techniques have become more convincing, and in some cases attackers are now using AI to personalise messages in ways that are genuinely hard to spot without some training. Your team does not need to become security experts, but they do need to know what a suspicious email looks like, what to do when they are unsure, and that reporting something odd is a good thing, not an admission of failure.
One-off training does not hold. The businesses that handle this well build it into how the team operates, with regular short updates rather than an annual video that everyone forgets by lunchtime. Attackers are already using AI to sharpen their phishing tactics, which is why ongoing awareness training matters more now than it did even two years ago.
Know what vulnerabilities you are carrying right now
Most small businesses do not have a clear picture of where they are exposed. That is not a criticism, it is just a reality when there is no dedicated IT function. A vulnerability scan gives you that picture. It looks at your systems the way an attacker would, identifies known weaknesses, and tells you what to prioritise. Regular scanning and reporting turns an unknown risk into a manageable list.
Back up your data and test that the backup actually works
Backups are not exciting. They also represent the single biggest difference between a ransomware incident that disrupts your business for a week and one that ends it. The critical detail most people miss: having a backup is not the same as having a working backup. Files get corrupted. Configurations get missed. The time to find out your backup has a gap is not when you need to restore everything urgently.
Why large organisations still get this wrong
The honest answer is that consistency is hard at scale. More people means more devices, more accounts, more ways for something to slip through. For a small business, the same dynamics apply but the margin is thinner. You cannot absorb a significant breach the way a large organisation might.
What large organisations do have, when they are operating well, is structure. Policies that define who does what. Tools that automate the parts that humans forget. Monitoring that catches problems before they become incidents. Small businesses can have all of that too, and it does not require a full-time IT department to make it work. It requires choosing the right tools and having someone who owns the process.
A practical starting point
If you want a framework to check your basics against, Cyber Essentials is the UK government-backed scheme designed exactly for this. It covers five control areas that address the most common ways businesses get compromised. Getting certified through an approved body gives you an independent check on your controls, and it is increasingly expected by insurers and larger clients when they are assessing the businesses they work with.
Software flaws being actively exploited right now are a reminder that this is not theoretical risk. The businesses that handle it best are not the ones that have never faced a threat. They are the ones that made the basics hard to miss.