Security incidents rarely look like the ones in films. They look like an old account that was never disabled, a shared password in a message thread, a database backup sitting in an unsecured folder, or an admin panel reachable from the open internet with no second factor. Understanding of the boring, ordinary ways systems are compromised is what separates a resilient business from a lucky one.
The uncomfortable truth
Attackers do not target you because you are small; they target the weakest configurations they can find at scale, automatically. This means most of your risk is not exotic. It is the gap between how your systems were set up and how they are configured today, months or years later, after changes nobody documented.
The checklist that covers most real-world risk
Access and identity
- Every account belongs to a named person, not a shared role. Shared logins destroy accountability and never get revoked.
- Multi-factor authentication is enforced on email, hosting, and any admin interface — these are the keys to everything else.
- Former staff and former suppliers are removed within days, not months.
- Admin privileges are granted to the fewest people who need them, and reviewed periodically.
- Default credentials have been changed everywhere, including on devices and tools nobody thinks about.
Data handling
- Personal and financial data is encrypted in transit and at rest.
- You know where each category of data lives, in which system, and how long it is retained.
- Backups exist, are encrypted, and have been restored successfully at least once — an untested backup is a hope.
- Production data is never copied into test environments without being anonymised.
- Data is only collected if you can explain why you need it.
Application behaviour
- Input is validated on the server, not just in the browser.
- Authorisation is checked on every request — not only by hiding buttons in the interface.
- Errors do not reveal stack traces, internal paths, or database structure to users.
- Dependencies are updated deliberately, and known-vulnerable packages are removed rather than ignored.
- File uploads are restricted by type and size, stored outside the application root, and never executed.
Operations
- Critical actions are logged, and the logs are stored where an attacker cannot easily erase them.
- Software and server updates happen on a schedule, not during an emergency.
- There is a written answer to: if our main system goes down or is compromised tomorrow, who does what first?
- Access to infrastructure is through individual accounts with audit trails, not a shared administrator password.
If you can only do three things this quarter
- Enable multi-factor authentication on every administrative account, starting with email, hosting, and the domain registrar.
- Prove your backups work by restoring one into a clean environment and using it.
- Remove every account and permission that nobody can justify in one sentence.
Those three steps cost almost nothing, take days rather than months, and close the routes through which a large share of incidents actually begin.
Most businesses are not breached by clever attackers. They are breached by an oversight that a checklist would have caught.
Security as routine, not as a project
The businesses that stay secure are not the ones with the largest security budgets. They are the ones where updates, access reviews, and dependency checks are part of normal operations — small, regular, unremarkable habits. A security review once a year will find problems; doing the boring work continuously prevents most of them.