Notable Source
ES Book a call
← All articles

Security · Article 6 of 10

Ten doors a small business can close this week

Alejandro PeñuelaOctober 20266 min readEspañol →

A dark wall with ten small doors, one of them slightly open with gold light coming through.
Image made with AI

Most security problems at a small business don't start with a genius hacker. They start with an open door: a reused password, an account without two-step verification, a computer that never updates, a backup nobody tested. Here are ten doors you can close this week, without an IT team.

The most common is the simplest

ESET asked small and midsize businesses about the past year: 45% had at least one security incident. At the top of the list were phishing, unpatched flaws, weak passwords and a lack of monitoring.1 None of those needs a big budget to fix. They need decisions.

The ten doors

  1. Turn on two-step verification on your email first. Your email resets every other password. In a Microsoft study of real accounts, multifactor authentication cut the risk of an account being compromised by 99.22%.2
  2. Use passkeys where they're offered. A passkey signs you in with your fingerprint, face or phone instead of a password. The FIDO Alliance, which writes the standard, explains why it matters: "There are no passwords to steal."3
  3. Put every password in a password manager. One strong, different password per account. If one site leaks, the others stay closed.
  4. Let updates run. Unpatched software is one of the most common ways in.1 Turn on automatic updates on computers, phones, browser and website.
  5. Make a backup, and test it. Three copies, in two places, one of them away from the office or disconnected. Then restore one file to prove it works. Keeping backups is one of the six essentials the U.S. cybersecurity agency recommends for small businesses.4
  6. Work from an account without admin rights. Use the admin account only to install things. Most days, you don't need it.
  7. Encrypt your laptops. If one is lost or stolen, the information stays unreadable.
  8. Lock every phone that touches the business. Screen lock, theft protection, updates on. Your phone holds your WhatsApp, email and bank.
  9. Keep business accounts in the business's name. Your Google Business Profile, social media and domain should belong to the business, and each person should use their own access, never a shared password. Google's own help notes that each person needs their own Google account to manage a profile, so no one has to share a password.5
  10. Write a one-page plan. Who to call, which password to change first, where the backup is. Limiting damage and getting back to normal fast is one of the six essentials too.4
Try it

You've closed 0 of 10

Switch on each door you've already closed. Nothing you choose leaves this page.

Where to start

If you only do one thing this week, do number one. If you do two, add number five. Each door you close makes the next attack a little more expensive for whoever tries it.

For a public, more detailed guide, the U.S. National Institute of Standards and Technology publishes a quick-start guide for small businesses.6

Ask me how we do it for your business, on a free 30-minute call.

General information, not technical or legal advice.

Charted and signedOctober 2026 · Alejandro Peñuela
Every claim in this article points to its source.