Most small business cyberattacks don't succeed because of sophisticated hacking. They succeed because of simple, avoidable mistakes that nobody ever got around to fixing. These are the five I see most often in Irish businesses, and what you can do about each one. Most of the fixes are free.
1 Reusing the same password everywhere Easy fix
This is far and away the most common one. Staff use the same password for their email, their banking, their Microsoft 365 login, and the website they signed up to years ago. Services get breached all the time, and when one does, attackers try those credentials on everything else. It's called credential stuffing and it's entirely automated.
The fix: Get everyone onto a password manager. Bitwarden is free for individuals and very cheap for teams. It generates a unique, strong password for every site and fills it in automatically, so your staff only have to remember one master password. You can roll it out in an afternoon.
2 No multi-factor authentication on email Free fix
Email is the most valuable thing an attacker can get access to. From your inbox they can reset passwords for everything else, intercept invoices, impersonate you to clients, and cause serious damage before you notice. And yet most small businesses leave email protected by a single password.
The fix: Turn on MFA (multi-factor authentication) for your Microsoft 365 or Google Workspace accounts. In M365 it's in the admin centre under Security, and it takes about 10 minutes to enable for everyone. Staff then need their phone to log in, which stops credential-based attacks dead. It's free, and if you only do one thing on this list, do this.
3 Ignoring Windows updates Just do it
"I always click remind me later." I hear that a lot. Updates are annoying, but they exist mainly to patch security holes. The WannaCry ransomware attack in 2017, which hit hospitals across the UK's NHS, used a Windows hole Microsoft had patched two months earlier. The organisations hit hadn't applied that patch.
The fix: Schedule updates for outside business hours. Windows lets you set Active Hours in Settings → Windows Update so it doesn't restart during the day. Better still, use Microsoft Intune (included in some M365 plans) to manage updates centrally across all devices.
4 No offsite backup Affordable fix
Having a backup on an external hard drive in the office is better than nothing. But if there's a fire, a flood, a ransomware infection, or someone walks out the door with the drive, you've lost everything. Ransomware goes after local backups on purpose, encrypting your files and the backup at the same time.
The fix: Add a cloud backup alongside whatever local backup you have. Backblaze B2 costs roughly €6 per terabyte per month. For most small businesses, backing up the important data (documents, email, accounts) costs less than €10/month. That's the price of two coffees.
5 Clicking links in emails without checking Training fix
Phishing is still the most common entry point for business attacks in Ireland. The emails are convincing now. They look like they're from Revenue, your bank, or a supplier you actually work with. The link leads to a fake login page that captures your credentials.
The fix: Train your staff on three simple rules. (1) Hover over any link before clicking; the real URL shows at the bottom of your browser. (2) If an email pushes urgency ("pay now or your account will be suspended"), treat it as a red flag and ring the sender on a number you already have. (3) If you're not sure, don't click. Forward it to IT first.
Microsoft Defender for Business (included in M365 Business Premium) has an Attack Simulator that sends fake phishing emails to your own staff to test and train them. It works better than you'd expect.
Getting it done
None of these fixes need a big budget or technical know-how. The biggest barrier is usually finding an afternoon to do it. If you'd rather someone came in and sorted the lot in one session (password manager, MFA, update policies, backups), that's exactly the kind of IT work Fentech does. Get in touch and we'll put a plan together.
