Cybersecurity
Five Cybersecurity Habits Every Small Business Should Adopt
Most attacks on small businesses exploit simple gaps: reused passwords, missing updates and convincing fake emails. Five habits that close the biggest ones, at little or no cost.
SAG Encoders · · 2 min read
Small businesses are attractive targets precisely because they rarely have a security team. The good news is that the most common attacks rely on a handful of everyday weaknesses, and closing them does not require expensive tools. These five habits are drawn from the baseline guidance published by national cybersecurity agencies such as the UK's NCSC and the US CISA.
1. Turn on multi-factor authentication everywhere
Multi-factor authentication (MFA) means a stolen password alone is not enough to get into an account. Switch it on first for email, banking, accounting software, your domain registrar and social media accounts. Where you can, use an authenticator app or a hardware security key rather than SMS codes, which can be intercepted through SIM-swap fraud.
2. Keep software up to date, and retire what is unsupported
Updates fix security flaws that attackers actively look for. Turn on automatic updates for operating systems, browsers and phones, and do not forget website plugins, routers and network equipment. Replace software that no longer receives security updates: for example, Microsoft ended support for Windows 10 on 14 October 2025, so those computers should be upgraded or replaced.
3. Learn to spot phishing and payment fraud
Many costly incidents start with an email, not a hack. Watch for urgency, requests to log in through a link, unexpected attachments, and sender addresses that are almost, but not quite, right. The most expensive variant is payment redirection: a convincing email "from a supplier" announcing new bank details. Make it a firm rule that any change to payment details is confirmed by phone, using a number you already had, before money moves.
4. Use a password manager and give everyone their own account
Reused passwords are how one breached website becomes access to your email. A password manager lets every person use long, unique passwords without memorising them. Avoid shared logins, give staff only the access their role needs, and remove access the day someone leaves.
5. Back up your data, and test that you can restore it
Backups are your recovery plan for ransomware, theft, hardware failure and honest mistakes. Keep at least one copy offline or otherwise protected from being changed, and practise restoring files so you know it works before you need it. Our guide to the 3-2-1 backup rule covers this in detail.
Have a plan for when something goes wrong
Write down who to call, how to disconnect an affected computer, and where your backups are. If personal data may have been exposed, remember that the Nigeria Data Protection Act requires data controllers to notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a breach that is likely to put people's rights at risk. See our guide to the NDPA.