Photo by Christian Velitchkov on Unsplash
Most cyber attacks on small businesses do not start with someone cracking your firewall. They start with an email to your accounts payable person, a message to your managing director, or a password reset link sent to whoever runs the company email account. The attacker is not trying to break your network. They are trying to get a specific person to do something, or hand over something, that gives them a way in.
This gets lost in how cyber security is usually talked about. Tools that sit on the edge of your network, filtering traffic in and out, matter. But if your finance director clicks a convincing phishing link and types in their Microsoft 365 password, the attacker is already inside. No amount of network-level protection helps you at that point.
Why attackers go after people first
Breaking into a properly configured system takes time and real skill. Tricking a person takes neither. A well-crafted phishing email costs almost nothing to send and can fool someone who is rushed, distracted, or simply not expecting it. When attackers profile a target business, they are not scanning your router for open ports. They are looking at LinkedIn to find out who the finance manager is, checking public records to see who the directors are, and browsing your website to understand what your business does and who you work with.
Once they know who holds the access they want, they build something believable around that person. A supplier invoice with a changed bank account. A message from the apparent CEO asking for an urgent payment. A password reset that looks exactly like the real thing. The technical defences you have built are largely beside the point, because the attack is aimed at a person, not a port.
Who in your business is most at risk
In a small business, a handful of people typically hold the access attackers find valuable. The director or owner, because they have signing authority and usually admin rights on most systems. The person who handles payments and invoices, because financial fraud pays off quickly. The contact who manages your IT or email platform, because those credentials often unlock everything else. And new starters, because they are still learning what a legitimate request looks like inside your business.
A junior member of staff who clicks a malicious link can also give an attacker a quiet foothold that goes undetected for days. But targeted attacks tend to focus on whoever holds the most useful access. Knowing who those people are in your own business is a reasonable place to start.
What protecting your people actually looks like
Know who holds the keys
Start with a clear picture of who has administrative or elevated access across your systems. Every business accumulates permissions over time, and they rarely get reviewed or removed. A staff member who left eighteen months ago may still have an active account. Someone who briefly covered for a manager might still hold access they no longer need. Auditing this properly, and keeping it current, limits the damage if any one account is ever compromised. Managing elevated privileges carefully means attackers who gain access to a standard account cannot simply step up to something more powerful.
Train people on what real attacks look like
Generic advice about being careful with emails does not prepare anyone for a convincing, well-researched phishing attempt. People need to see what these attacks actually look like, regularly, so that recognition becomes a habit rather than something they half-remember from a one-off session a couple of years ago. Security awareness training done well simulates current attack techniques, identifies who is most vulnerable in your team, and builds specific practical habits rather than vague caution. As we covered in our earlier post on AI-assisted attacks, attackers now have tools that make convincing, personalised lures far easier to produce at scale, which raises the bar for what good training needs to cover.
Make stolen credentials less useful
Even if an attacker gets hold of a password, you want to limit what they can do with it. Multi-factor authentication adds a second check that a password alone cannot pass. A password manager means people use strong, unique passwords for every account rather than reusing one familiar combination across everything. These two controls together significantly reduce what a stolen credential is actually worth to the person who obtained it.
Limit what each person can actually reach
Each person should have access only to what they genuinely need for their role. If your marketing coordinator does not need to see payroll data, they should not have it. If a staff member's account is compromised, limiting their access limits the blast radius. This sounds straightforward but requires deliberate policy and regular review, not a one-time setup that nobody revisits.
A practical place to start
If you have not done a recent review of who has access to what across your business systems, that is the most useful first thing you can do. Pair it with training that reflects how attacks actually work today. Your network defences still matter, but your staff are the most consistently targeted part of your business, and they deserve the same deliberate attention as your firewall. Talk to the team if you want to understand where your biggest exposure currently sits.