Small businesses often assume they are too small to be a target. Attackers do not see it that way. Most attacks are not aimed at anyone in particular. They are automated attempts that try leaked passwords against thousands of logins, or phishing emails sent to every address on a list, and they succeed wherever the basics have slipped.
The good news is that the basics are cheap. You do not need a security team or an expensive consultant to stop most of what reaches a small business. You need a handful of habits, applied consistently, and the right tools to make them easy.
This guide covers those habits in order of impact, how to share files and credentials without creating new risks, what to do when something goes wrong, and where the government backed Cyber Essentials scheme fits in.
Start with passwords
Stolen and reused passwords are behind a large share of account takeovers. When one website is breached, the email and password pairs are tried against everything else. If someone on your team uses the same password for a shopping site and your business email, a breach you have never heard of becomes your problem.
- One password for each account. Reuse is the single most important habit to break.
- Length beats complexity. The NCSC recommends three random words joined together. A long passphrase is stronger than a short string of symbols and far easier to remember.
- Use a password manager. Nobody can remember fifty unique passwords. A password manager remembers them for you, generates new ones and fills them in, so the secure option is also the convenient one.
- Stop sharing passwords in chat and email. A password pasted into a message lives in that message forever, in every inbox it reached.
Add a second step to every sign in
Two-factor authentication asks for something beyond the password, usually a code sent to you or generated on your phone. A stolen password alone is then not enough to get in. Switch it on for email first, because whoever controls your email can reset almost everything else, then for banking, accounting and any system that holds customer or employee data.
Passkeys go a step further. Instead of a password, your device proves who you are with a fingerprint, face or PIN. There is nothing to type, nothing to reuse and nothing a fake login page can capture. Where a service offers passkeys, they are worth adopting.
Single sign-in through Google or Microsoft is another option. It means one well protected account instead of many separate passwords, provided that account has strong two-factor protection of its own.
Give people only the access they need
Every account that can see everything is an account that can lose everything. Give each person the access their job needs and no more, keep administrator rights to two or three trusted people, and never share a login between colleagues. Our guide to roles and permissions for small businesses covers how to set this up in detail.
The moment that matters most is when someone leaves. Old accounts belonging to former staff, contractors and agencies are one of the most common ways in, because nobody is watching them. Make removing access part of every leaving process: the business system, email, shared drives, the password manager and any shared credentials the person knew. If they knew a shared password, change it.
Learn to spot phishing
Phishing emails and messages try to get someone to click a link, open an attachment, enter a password or pay a fake invoice. They have become harder to spot, but most still share a few warning signs.
- Urgency. A deadline, a threat or a request to act before you think.
- An unusual request. A supplier changing bank details, or a manager asking for gift cards or a quick payment.
- A mismatched sender or link. The display name looks right but the address or the web link does not.
- A request for a password or code. No genuine service will ask you to send a sign in code to someone else.
Agree one simple rule as a team: any request to change payment details or move money is confirmed by phone, using a number you already hold, never one from the message. Make it easy and blame free to report a suspicious message, and forward suspicious emails to the NCSC at report@phishing.gov.uk.
Keep devices updated and protected
Attackers routinely exploit flaws that already have a fix available. Keeping laptops, phones, browsers and routers up to date closes those doors.
- Turn on automatic updates for operating systems, browsers and apps, and restart when asked.
- Replace unsupported devices. A laptop or phone that no longer receives security updates should be retired from business use.
- Use built in malware protection. Modern operating systems include it. Make sure it is switched on.
- Lock screens and encrypt devices. A lost laptop should be an inconvenience, not a data breach.
- Change default passwords on routers, printers and anything else that arrived with one.
Back up what you cannot lose
Backups are your answer to ransomware, accidental deletion and hardware failure. Know where your important data lives, make sure it is backed up automatically, and keep at least one copy that an attacker on your network could not reach or encrypt. Then test a restore. A backup that has never been restored is a hope, not a plan.
If most of your work lives in a cloud platform, check what the provider backs up and for how long, and what you would need to keep yourself.
Share files and credentials safely
Much of the risk in a small business comes from how information leaves it. Attachments are forwarded, links are shared publicly and passwords are pasted into messages. A few habits keep sharing under control.
- Share a link, not an attachment. An attachment is a copy you can never take back. A link can be withdrawn.
- Give links an expiry date. Most shares are only needed for days. A link that expires cleans up after itself.
- Revoke what is no longer needed. When a project ends or a client leaves, close the shares that went with it.
- Use a client portal for ongoing work. Customers and candidates sign in to see what you have shared with them, instead of digging through old emails.
- Share credentials through the password manager. Share the entry, not the password. When the person no longer needs it, remove their access.
Have a simple incident routine
Something will go wrong eventually: a lost phone, a clicked link, a misdirected email. The difference between a bad day and a disaster is usually how quickly you act. Write down a short routine before you need it.
- Report it straight away. Everyone should know who to tell and that they will not be blamed for speaking up.
- Contain it. Change passwords, sign the affected account out, revoke shares and disconnect devices as needed.
- Record it. What happened, when, what was affected and what you did.
- Decide whether to report it. If personal data was involved and there is a risk to the people affected, UK GDPR requires you to tell the ICO within 72 hours of becoming aware of it.
- Learn from it. Find the root cause and change something so it does not happen again.
Where Cyber Essentials fits
Cyber Essentials is the UK government backed scheme, run by the NCSC, that sets a baseline of technical controls every organisation should have. It centres on five of them:
- Firewalls to control what can reach your devices from the internet.
- Secure configuration to remove default passwords and switch off what you do not use.
- Security update management to keep software patched and supported.
- User access control to make sure only the right people have accounts, with only the rights they need.
- Malware protection to stop malicious software from running.
The basic certification is a self-assessment questionnaire that is independently reviewed, and it is renewed every year. Cyber Essentials Plus adds a hands-on technical audit. For a small business it is a practical checklist even if you never apply, and certification is increasingly asked for by larger customers and public sector contracts. Check the current requirements on the NCSC website before you start, as they are reviewed regularly.
Certification shows that the basics were in place when you were assessed. It does not cover every risk, and it does not replace the habits in the rest of this guide. Wizard Application is Cyber Essentials certified, and our security page explains what that covers.
Mistakes to avoid
- Thinking you are too small to be a target. Automated attacks do not check your headcount.
- Leaving former staff with access. Remove it on their last day, not when someone notices.
- Keeping a shared password spreadsheet. It is a single file that unlocks everything.
- Turning off two-factor because it is inconvenient. A few seconds at sign in is cheap compared with a takeover.
- Never testing backups. Find out they do not work before you need them, not after.
How this works in Wizard Application
Wizard Application brings the tools for these habits into the same platform your team already works in.
- Safer sign in. Administrators can switch on two-factor sign in for the whole workspace, so a one-time code is emailed at each password sign in. You can also enable passkeys and sign in with Google or Microsoft.
- Automatic sign out. Choose how long an idle session stays signed in, from 15 minutes to a full day.
- Roles and permissions. Roles control which features and actions each person can use, and deactivating a user removes their access in one step.
- A team password vault. The password vault keeps credentials encrypted behind a separate master password and locks itself after 15 minutes of inactivity. Share an entry with a colleague and choose whether they can view, edit, delete or share it on. It stores authenticator codes too, and browser extensions for Chrome, Firefox and Edge fill in logins for you.
- Controlled document sharing. Document share links can carry an expiry date, show how often they have been opened and can be revoked at any time. Documents can also be shared to a customer, candidate or company portal.
- Incident management. Incidents can be categorised as security, data breach or access control issues, given a severity with a response target, flagged as security incidents and closed with a recorded root cause, corrective actions and lessons learned.
Frequently asked questions
What is the most important security step for a small business?
Stop reusing passwords and switch on two-factor authentication, starting with email. Together they block the most common way accounts are taken over.
Do small businesses need a password manager?
Yes. It is the only realistic way for a team to use a unique strong password for every account and to share logins without sending them through chat or email.
Is Cyber Essentials mandatory?
Not for most businesses. It is required for some government contracts and is increasingly requested by larger customers, but for many small businesses its main value is as a clear baseline to work towards.
What should we do when an employee leaves?
Deactivate their accounts on their last day, remove their access to shared files and the password manager, and change any shared passwords they knew.
Do we have to report a data breach?
If personal data is involved and the breach is likely to put people at risk, UK GDPR requires you to report it to the ICO within 72 hours of becoming aware of it. Record every breach, even the ones you do not need to report.
Security starts with who can see what. If you have not set up access properly yet, read our guide to roles and permissions, and if you are bringing on new people, our employee onboarding checklist covers giving them the right access from day one.
