A suspicious invoice lands in an accounts inbox at 4.45pm on a Friday. It looks familiar, the supplier name is right, and one rushed click is all it takes to expose passwords, bank details or customer information. The question of how to protect cyber security is not really about buying one piece of software. It is about reducing the small, everyday gaps that criminals use to disrupt a business.

For small businesses, the consequences can be immediate: staff cannot access systems, customers lose confidence, operations stop, and valuable time is spent untangling the problem. Good cyber security should make those situations less likely without making everyday work difficult. The aim is simple: your technology should support the business, not become another job for the owner or office manager.

How to protect cyber security starts with visibility

You cannot protect technology that nobody has properly mapped. Many businesses have grown by adding devices, software subscriptions, cloud accounts and remote-working arrangements as the need arises. Over time, it becomes unclear who has access to what, whether old accounts are still active, or where business data is actually stored.

Start with a clear view of your environment. This includes laptops, desktops, mobile phones, Wi-Fi equipment, cloud services, email accounts, shared files, specialist industry software and any systems managed by third parties. It also means knowing which information is most sensitive, such as payroll records, client files, financial data and login credentials.

This exercise is not about creating paperwork for its own sake. It helps you make sensible decisions. A garage may need to prioritise diagnostic equipment and supplier portals. A charity may need to focus on donor data, volunteer access and grant-funded software. The right controls depend on how the organisation works and what would cause the greatest disruption.

Put identity and access controls first

Most successful attacks do not begin with a criminal forcing their way through a technical barrier. They begin with a stolen password, a convincing email or an account that should have been removed months ago. That is why access control is one of the most valuable places to invest effort.

Every member of staff should have their own account. Shared logins make it difficult to see what happened when something goes wrong, and they are hard to secure when a person leaves. Access should also match a person’s role. Someone who only needs to view a document should not automatically be able to delete it, share it externally or alter financial details.

Multi-factor authentication adds a second check when signing in, usually through an app or approval prompt. It is not perfect, and staff should still be trained to reject unexpected prompts, but it makes a stolen password far less useful to an attacker. Apply it first to email, cloud storage, finance systems, administrator accounts and remote access.

Offboarding deserves the same attention as onboarding. When an employee, contractor or volunteer leaves, disable their accounts promptly, remove access to shared systems and recover company devices. A good process protects the business while also giving former colleagues a clear and professional departure.

Keep devices patched, protected and managed

An unpatched laptop is like leaving a known fault unresolved in a company vehicle. It may continue to run, but the risk grows each day it is left unattended. Criminals actively look for well-publicised weaknesses in operating systems, browsers, routers and business applications.

Updates need to be applied consistently, not only when somebody remembers. This includes the software staff use every day, as well as background systems such as firewalls, Wi-Fi equipment and cloud services. Where possible, set updates to install automatically and use central management to confirm they have actually completed.

Business devices should also be protected with managed security software that can identify suspicious activity and allow a support team to respond. For laptops that travel between home, client sites and the office, device encryption and the ability to lock or wipe a lost machine are equally useful. These measures may sound technical, but their business purpose is straightforward: a missing laptop should not become a reportable data incident.

There is a balance to strike. Installing updates in the middle of a busy working day can interrupt staff, especially where specialist software is involved. A managed approach schedules routine maintenance sensibly, tests changes where needed and deals with exceptions before they become vulnerabilities.

Make email security a daily habit

Email remains a favourite route for fraud because it targets people rather than machines. A message can appear to come from a director, a supplier, a delivery company or a trusted colleague. It may ask for a payment, a password reset, a shared file to be opened or a bank account change to be approved.

Technical filtering can block a large proportion of malicious messages, but it cannot catch every convincing attempt. Staff need a simple, repeatable habit: pause before acting on an unusual request. Check the sender address carefully, be wary of urgency, and confirm changes to payment details using a known telephone number rather than the contact details in the email.

Short, practical training works better than an annual lecture full of jargon. Use examples that reflect the business, such as a fake supplier invoice or a false message requesting a payroll change. Most importantly, make it easy for staff to ask when they are unsure. A culture where people report suspicious messages without embarrassment is a real security control.

Protect the business with backups that can be restored

Backups are often mistaken for a cyber security solution on their own. They are not. They will not stop an account being compromised or prevent confidential information from being copied. What they do provide is a way back if ransomware, accidental deletion, hardware failure or a major software issue interrupts the business.

The key word is restore. A backup that has never been tested is only a hopeful assumption. Your business should know which systems are backed up, how often copies are taken, where they are stored, how long they are retained and how quickly the essential data can be recovered.

Keep backup copies separate from the main network and protect them with strong access controls. If an attacker can reach both the live files and the backup platform using the same administrator account, recovery may be much harder than expected. Cloud storage can be useful, but synchronisation alone is not always a backup. If a file is encrypted or deleted, that change can also synchronise.

Decide in advance what must be restored first. For some businesses that will be email and customer records; for others, it may be booking systems, phones, finance tools or specialist applications. This prioritisation turns a technical recovery into a practical continuity plan.

Create a response plan before you need one

When a security incident happens, uncertainty costs time. People may be tempted to reboot machines, delete evidence, carry on working or contact customers before the facts are clear. A short incident response plan gives staff a calm, agreed route to follow.

It should identify who to contact, who can make decisions, how to isolate a suspicious device and how the business will communicate if email or phones are unavailable. It should also cover external responsibilities, including insurers, banks, regulators and affected customers where relevant. The precise actions depend on the incident, so the plan should guide people rather than try to predict every scenario.

Run through the plan occasionally. A 20-minute discussion can expose gaps, such as an emergency contact list stored only in the system that might be unavailable. It also reassures staff that reporting a possible problem early is the right thing to do.

Know when to bring in support

Small businesses do not need a large internal IT department to be well protected, but they do need clear ownership. Security tools produce alerts, updates need oversight, user access changes, and backups need testing. If those tasks sit on the bottom of an already busy person’s list, risk builds quietly.

A managed IT partner can provide monitoring, patching, security controls, backup oversight and a knowledgeable response when something does not look right. For businesses with internal IT, external support can add specialist skills and cover without replacing the team. The value is not simply another supplier. It is having somebody accountable for keeping the technology stable and secure.

For Sussex businesses that want a clearer picture of their risks, My Tech Team can help turn scattered systems and vague concerns into practical priorities, without jargon or unnecessary disruption. Start with the areas that would hurt most if they failed, improve them steadily, and make cyber security part of normal business operations rather than a last-minute reaction.