The single most common cybersecurity blind spot for small business owners is human vulnerability, not technical weakness. 5 of 48 experts highlight employee training and phishing awareness, while 9 of 48 experts point to unmanaged or forgotten access—old employee logins, vendor accounts, and dormant integrations that attackers can still use. 16 of 48 experts stress multifactor authentication on email as the fastest concrete step.
Key takeaways
- Weak email security is the master key to most small business breaches—turn on multifactor authentication on email first, and test whether it actually blocks attackers.
- Forgotten access—old employee logins, dormant vendor accounts, and unused integrations—poses as much risk as a skilled attacker, and costs nothing to audit and remove.
- Phishing awareness training works, but only if tested regularly; running fake phishing drills monthly teaches more than any policy document sitting in a shared drive.
- Payment and invoice fraud usually succeeds through process, not hacking; one simple rule—verify any payment request by calling a trusted phone number, never one in the email—closes the gap most attacks exploit.
- Small businesses are targeted precisely because they are seen as easy, not because they are large; attackers run automated scans and take whatever door is unlocked.
Number of experts (out of 48) who made each point. Many made more than one.
We asked experts what cybersecurity mistake or blind spot they see most often in small businesses, and what one concrete action owners can take this week to reduce that risk. Their answers cluster around three main themes: the human element in security failures, access that nobody actively manages anymore, and the underestimation of risk that leads to corner-cutting on basics.
1. Email Is the Master Key
Multiple experts emphasize that email is the account that controls everything else. Once compromised, attackers can reset passwords, impersonate leadership, access cloud services, redirect payments, and lock the owner out entirely.
Dilip Siddalingha Prasad, Cybersecurity Engineer & Researcher
“The biggest blind spot I see in small businesses is treating email as just another application instead of recognizing that it is often the master key to the entire company. If an attacker takes over an owner's or administrator's email account, they may be able to reset passwords, impersonate leadership, access cloud services, redirect invoices, or trick employees into sending money or sensitive information. The one thing I would do this week is enable multi-factor authentication on every business email account and every administrator or finance account, starting with the highest-privilege users. Where possible, use an authenticator app or security key rather than relying only on SMS.”
Email should be treated as the master key to the entire company, not just another application.
Dilip Siddalingha Prasad is a cybersecurity engineer and researcher.
Peter Andrew Wint, CISSP, Network and Security Engineer, Wint Enterprises
“Put payment and business-critical systems on their own network, separate from guest Wi-Fi and smart devices, and turn on phishing-resistant multi-factor authentication (passkeys or a hardware key, not SMS codes) on email and banking first - those two accounts are how most small-business breaches start.”
Multifactor authentication on email and banking should be the immediate priority.
Peter Andrew Wint is a CISSP and network and security engineer at Wint Enterprises.
Eitan Soloducho, Managing Partner, Edamame PR & Strategy
“The biggest blind spot is the email inbox. What we see from our clients is that owners lock down the bank login and then use a weak, reused password on the email account that every other password reset lands in. Whoever gets into that inbox can reset the bank, the website host and the social accounts, so it's the one account I'd protect first. The step: turn on two-factor authentication on your main email account, using an authenticator app rather than text messages.”
The email inbox is where password resets land, making it the single account to protect first.
Eitan Soloducho is the managing partner at Edamame PR & Strategy.
Marc Sevigny, Cybersecurity professional and certified ethical hacker
“The biggest blind spot I see is treating email as just a communication tool. For most small businesses, the inbox is the master key. It resets every other password, receives every invoice, and approves every payment. Then they send a convincing request to change a vendor's bank details. This week, turn on multi-factor authentication for every email account in your company, starting with yours and the one belonging to whoever pays the bills. Next, set one rule for your team: any request to change payment details gets verified by phone, using a number you already have on file.”
Business email compromise is one of the most common attacks; multifactor authentication and a verification rule for payment changes close the gap.
Marc Sevigny is a cybersecurity professional and certified ethical hacker.
Radovan Vuković, Founder & Software Engineer, Prometix
“The blind spot I see most often is that nobody in the company actually controls the accounts the business runs on. The business email account is the master key: whoever gets into it can reset the passwords for the domain, the website and the Google Business Profile. One phished password, or one developer who stops answering, and the owner can lose the website and email at the same time. This week, list five accounts: business email, domain registrar, hosting, website admin and Google Business Profile. Check that each one is registered to a company address the owner controls, turn on two-factor authentication with an authenticator app instead of SMS, and print the recovery codes and keep them somewhere safe in the office.”
The business email account is the master key; losing it means losing the website and email simultaneously.
Radovan Vuković is the founder and software engineer at Prometix.
Lena Asberry, Entrepreneur, Tax Expert & Notary Public, The PaperTrail Pros
“The biggest blind spot I see is treating email like a safe filing cabinet. Small owners lock the front door — passwords, a locked office — then send tax returns, IDs, and loan documents through regular email and keep them sitting in an inbox forever. I route anything with Social Security numbers or financials through a separate, encrypted address, password-protect the document itself, and never let sensitive files live in everyday email. Clients get one clear instruction — use this link, not a reply-all — and I delete the sensitive copy from the inbox once it is filed. Security here is not a product you buy.”
Sensitive documents should never travel through regular email; use encrypted channels and delete sensitive copies once filed.
Lena Asberry is an entrepreneur, tax expert and notary public with The PaperTrail Pros.
Brian Cute, President and Chief Executive Officer, Global Cyber Alliance
“Email is a good place to start. It holds customer conversations, invoices and password-reset links. One compromised inbox can give a criminal a way to impersonate the owner, redirect a payment or access other business accounts. This week, make multifactor authentication mandatory for every business email account, including the owner's. Ask whoever manages your email to verify that it is enabled for everyone; don't assume that because the option exists, people are using it.”
Email holds the keys to impersonation, payment redirection, and account access; multifactor authentication is a practical defense that works even when someone is fooled.
Brian Cute is the president and CEO of Global Cyber Alliance.
Omair Manzoor, Founder, CEO & Chief Hacker, ioSENTRIX
“First, if an employee's email password is stolen today, what stops an attacker from logging in? If the answer isn't "multi-factor authentication on every account," that's your first fix.”
Multifactor authentication on email is the first fix to implement this week.
Omair Manzoor is the founder, CEO and chief hacker at ioSENTRIX.
2. Forgotten and Unmanaged Access
Old employee logins, dormant vendor accounts, API keys sitting in code, and integrations that survived project changes all remain usable long after they should have been removed. Attackers prefer these doors because they work without needing to exploit a flaw.
Nicholas Carroll, Co-founder & CTO, Deception Check
“The blind spot I'd put first is access nobody owns anymore. A former employee's login, an old IT provider's remote connection, or a shared administrator account can remain usable long after the reason for it has gone. A valid account can give an intruder access without needing to exploit a software flaw. This week, do a 30-minute access review with whoever manages your IT. Start with business email. Open the list of users and administrators, and ask one question about each account: who needs this access today? Disable accounts confirmed as unnecessary, and identify an owner for anything you cannot explain.”
Access nobody owns anymore—old employee logins and shared admin accounts—can remain usable for years.
Nicholas Carroll is the co-founder and CTO of Deception Check.
Timur Rakhmatullin, Senior Software Engineer, MyTona
“The single biggest blind spot I see is unmanaged API keys and service account credentials sitting in plain text. Small businesses adopt SaaS tools fast, Stripe for payments, Twilio for SMS, some analytics dashboard, and every integration creates a key. Those keys end up in .env files on developer laptops, pasted into Slack messages, hardcoded in deployment scripts. Nobody rotates them. Nobody tracks which ones are active. I have personally found live production database credentials in a public GitHub repository for a client's project that had been exposed for eleven months. One concrete step this week: run a search across your codebase and shared drives for strings that look like API keys or passwords. If you find even one, rotate it immediately and move all credentials into a secrets manager like AWS Secrets Manager, HashiCorp Vault, or even a password manager with team sharing.”
API keys and service credentials left in plain text, hardcoded in code, and never rotated are a common path to production database exposure.
Timur Rakhmatullin is a senior software engineer at MyTona.
Daniel Di Nardo, Network and Security Consultant, IntelliBreach
“Most small business owners think cybersecurity failures start with a sophisticated attack. The biggest blind spot I see consistently is infrastructure that has fallen off the radar: an old subdomain from a marketing campaign, a forgotten admin panel, or a cloud server that survived a project and never got shut down. If I could recommend one thing a business owner do this week, it would be to create a list of every internet-facing asset they own and verify each one is still needed. You can't protect an asset you don't know exists, and after nearly 20 years in security, I've found the gap is rarely competence. It's visibility.”
The biggest blind spot is infrastructure that has fallen off the radar—old subdomains, forgotten admin panels, cloud servers that survived a project and were never shut down.
Daniel Di Nardo is a network and security consultant at IntelliBreach.
Chad Angle, Founder & Managing Director, Reputation Repair
“The blind spot I would highlight is losing track of who controls the accounts that keep the business running and represent it online. A former employee or vendor may still have administrator access, or the only recovery phone number may belong to someone who has left. A compromised or inaccessible account can disrupt customer communication and damage trust. One concrete step this week is an account access audit, starting with business email, domain registration and Google Business Profile. For each, identify the administrators, confirm the business controls its recovery options, remove access that is no longer needed and enable multifactor authentication. Make sure someone currently authorized can recover the account if the primary administrator becomes unavailable.”
Former employees or vendors may still have administrator access; an audit of email, domain, and Google Business Profile should identify and remove unnecessary access.
Chad Angle is the founder and managing director at Reputation Repair.
Gopi Chand Vegineni, Senior UI/UX Developer & AI Interfaces Researcher, Nexsolv, Inc.
“The risk most small businesses overlook is not their own firewall, it is everyone else who already has a key. In my research on dark web anomaly detection, we kept finding the same pattern: a business gets breached through a vendor account, an old contractor login, or an employee password that was stolen in someone else's breach months earlier and never changed. Owners focus on hackers breaking in, while the real door is credentials that are already out there and still working. The one step I would take this week is an access audit: list every person and vendor who can log into your systems, remove anyone who no longer needs access, and turn on multi-factor authentication for everyone who remains.”
The real door attackers use is credentials that are already out there and still working—old contractor logins, passwords stolen in other breaches and never changed.
Gopi Chand Vegineni is a senior UI/UX developer and AI interfaces researcher at Nexsolv, Inc..
Rami Akeela, Founder and CEO, Nera Systems
“The biggest blind spot is that most owners can't say where their sensitive data goes. They worry about hackers, while an employee pastes a client spreadsheet into a free AI tool and a former contractor still has access to the shared drive that holds customer records. Nobody did anything malicious. The tools never got a review. This week, ask everyone on your team which tools they use with customer, client or financial data, and write the list down. Personal accounts and AI assistants count. Then check two things for each one: who can get in, and whether sign-in requires multi-factor authentication. Remove anyone who has left, and turn it on wherever it's missing.”
Owners cannot say where their sensitive data goes; an employee pastes a spreadsheet into a free AI tool and a contractor still has drive access.
Rami Akeela is the founder and CEO at Nera Systems.
Brent Govaerts, Founder, Consolidations.ai
“The overlooked security risk I would flag is access that nobody still owns. Small businesses add a contractor, grant an integration broad CRM permissions, or connect a new automation platform to solve a real problem. Months later, the person has left or the workflow has been replaced, but the account or token may still be able to read conversations and export contacts. One step to take this week: Have a named owner open the user and integration access screens of the three systems that contain the most sensitive customer data. Compare every active user, service account and token to a current person or approved workflow. Disable anything unneeded, reduce surviving permissions to what the task requires, and enable multifactor authentication wherever supported.”
Access that nobody still owns—contractor accounts and integrations that have been replaced—can still read conversations and export contacts.
Brent Govaerts is the founder of Consolidations.ai.
Mykyta Chernenko, Founder, AIWriteBook
“The blind spot I see most is the pile of third-party apps connected to the business. Every AI tool, scheduler, plugin and "sign in with Google" someone tried once still has a key to your email, your files or your payments. Owners guard the front door with a strong password and forget the dozen side doors they opened themselves. Nobody remembers granting them, so nobody checks them. One step for this week: open the security page of your Google or Microsoft account and your payment provider, and list every connected app and API key. Revoke anything nobody can explain in one sentence. Then turn on two-factor login for the accounts that are left.”
Every AI tool, plugin, and sign in with Google still has a key to email, files, or payments; owners guard the front door and forget the dozen side doors.
Mykyta Chernenko is the founder of AIWriteBook.
Brad Perniciaro, Owner and Publisher, Living Coastal
“The cleanup also turned up three old app passwords for tools we had stopped using, one from 2023, still sitting there as a way in. This week's concrete step is to review your connected apps, plugins, and API keys and revoke anything you don't actively use. Forgotten access is an easy, free fix, and it can sit open for years until someone finds it.”
Forgotten API keys and app passwords for tools no longer in use can sit open for years as a way in.
Brad Perniciaro is the owner and publisher of Living Coastal.
Anouar Mansour, Partner, Technology and InfoSec, Everett & Co.
“The biggest blind spot I see is third parties. Every small business relies on a lot of them in various ways: the website host, the payment processor, the bookkeeping software, the IT contractor, the plugins on the site. Most businesses check a vendor once, and never really keep up with it after that. But vendors change, and any one of them having an incident will affect you one way or another. This week, go through every outside service that touches your business, check what each one can access today, and remove anything you no longer use. Then put a reminder on your calendar to do it again every three months.”
Third-party vendors are checked once and never again; any vendor incident will affect the business, so track what each vendor can access.
Anouar Mansour is a partner, technology and InfoSec at Everett & Co..
[email protected], Founder, RestoZign
“The blind spot I see most often is not a missing security tool — it is shared passwords on the few accounts that control everything else. The domain registrar, the website admin, the hosting account, and the business email are routinely protected by one password that the owner, a manager, and sometimes a former employee all know, with no second factor turned on. The fix takes about an hour this week: turn on multi-factor authentication — an authenticator app or a passkey, not just text messages — for the registrar, hosting, website admin, and email accounts, in that order. Then change any password that more than one person knows, store the new ones in a password manager, and delete logins for anyone who no longer works there. No new software to buy, and it closes the door most small-business takeovers actually walk through.”
Shared passwords on accounts that control everything—registrar, hosting, email—are the door most takeovers walk through.
[email protected] is the founder of RestoZign.
3. Human Vulnerability and Phishing
The human element remains the weakest point. Employees click first and think later, attackers impersonate trusted contacts, and owners assume they are too small to target. Regular training and simple verification processes close these gaps.
Thomas Oldham, Founder, WebMotion Media
“The weak point in most small business security is a person, not a firewall. Staff click first and think later because nobody trained them to slow down. Send your team a fake phishing email from an address you control. Pick the person who clicks, then walk them through what gave it away. Run that drill every month and log who falls for it. 2 rounds of this teaches people more than any policy document sitting in a shared drive. Training can.”
Staff click because nobody trained them to slow down; monthly fake phishing drills teach more than any policy document.
Thomas Oldham is the founder of WebMotion Media.
Bogdan Nicholas, Co-founder & Data Security Lead, VINspectorAI
“They assume they're too small to be targeted. Phishing is where it hits hardest. 85% of data breaches involve a human element — not some sophisticated hack, just someone opening the wrong email. Here's what you can do this week: run a 30-minute phishing awareness session with your entire team. Show them real examples of phishing emails. Teach them to hover over links before clicking. Just a conversation that could save you from a six-figure breach.”
Small business owners assume they are too small to be targeted, skip training, and leave employees vulnerable to phishing.
Bogdan Nicholas is the co-founder and data security lead at VINspectorAI.
Ben van Leewarden, General Manager, Warden Consulting
“The blind spot I would point to is trust in an email. Payment and invoice fraud, one of the areas our firm investigates, usually exploits a process instead. A message arrives that looks like it comes from a supplier, a client or the owner, asking for an urgent payment or a change of bank details. The person who approves the payment just never checks who is really asking. Write down one rule and give it to everyone who can move money. No change to a supplier's bank details, and no urgent payment request, is acted on until someone calls that person on a number already on file. It costs nothing, takes five minutes to explain, and closes a gap that no firewall can.”
Payment fraud exploits process, not technical flaws; verify payment requests by calling a trusted phone number, never one in the email.
Ben van Leewarden is the general manager at Warden Consulting.
Zachary Belous, Business Development, Flexible IT
“The biggest blind spot is owners believing they're too small to be a target. They assume attackers go after big companies, so security gets pushed to later. Attackers like small businesses the most. They have money, customer data, and ties to larger partners, but often lack the basic protections a bigger company has. The real question isn't whether you're big enough to attack. One step to take this week: turn on two-factor authentication for every email account in your business, starting with your own. Email is where we see most problems start, and it's the key to resetting passwords on almost everything else. With two-factor on, a stolen password alone won't get someone in. It's free on nearly every email platform and takes a few minutes per person.”
Attackers target small businesses because they are seen as easy, not because they are large; two-factor authentication is free and takes minutes.
Zachary Belous is in business development at Flexible IT.
Jack Wright, Senior Vice President of Operations, HealthWright Technologies
“The blind spot I see most is trusting the message itself. A fake invoice or a "we changed banks" email usually looks right, and it hands you the phone number and the link to check it with. Those belong to whoever sent it, so checking through the email only confirms the fraud. One step for this week: write one rule and tell everyone who touches money. Any request to move money or share a login gets checked through contact details you already had, like the vendor file or an older email thread you trust.”
Fake invoices look right and hand you the phone number and link to check; verify through contact details you already have, not the ones in the email.
Jack Wright is the senior vice president of operations at HealthWright Technologies.
Lloyd Marino, CEO, AVETTA Global LLC
“The biggest blind spot I see is the belief that nobody would bother attacking a business your size. Attackers don't pick targets; they run automated scans and take whatever is unlocked. For a small business, that's usually an email account with a reused password and no second step to log in. Here's the one thing to do this week: turn on multi-factor authentication for email, banking, and accounting software, starting with the owner and anyone who handles money. It takes an afternoon, costs little or nothing, and shuts the door on the most common account takeovers, fraud, and ransomware.”
Attackers run automated scans and take whatever is unlocked; multifactor authentication on email, banking, and accounting is the easy win.
Lloyd Marino is the CEO of AVETTA Global LLC.
Michel Sahyoun, Chief Solutions Architect, NopalCyber
“The most overlooked security risk is the phone. While small businesses have improved email security, few have clear procedures for calls from individuals claiming to be their IT provider. Attackers exploit this by gathering staff names from company websites and LinkedIn, then calling employees to request password reset codes or remote access. These attempts often succeed because employees want to be helpful and are not informed that they can refuse such requests. This week, establish and communicate a simple rule to all employees: never grant access or share codes in response to an incoming call. Instead, hang up and return the call using a number already on file, not the one the caller provided. Inform your IT provider about this rule so they anticipate the callback. Implementing this only takes ten minutes and costs nothing.”
Few businesses have procedures for calls claiming to be IT support; never grant access or codes over the phone; hang up and call back using a trusted number.
Michel Sahyoun is the chief solutions architect at NopalCyber.
Matt Sergeant, Founder, inletAP
“The blind spot is the bills. Small businesses guard their passwords and then pay whatever arrives in the inbox looking like an invoice. The expensive version is a message, apparently from a supplier you already pay, saying their bank details have changed. Sometimes the supplier's own email account has been taken over, so the message comes from the right address and replies to your questions. The step to take this week costs nothing. Write down one rule: nobody changes where money goes because of an email. Then make a short list of your regular suppliers with a phone number for each, taken from a contract or an old invoice, not from a new message. When a "new bank details" request arrives, someone calls that number, and a second person signs off before the change is made. Ten minutes of setup closes the gap that costs the most.”
Small businesses pay whatever arrives looking like an invoice; make a rule that nobody changes where money goes because of an email.
Matt Sergeant is the founder of inletAP.
Zakaria Mamoumi, Founder, Growtoria
“The blind spot I see most is trusting anything that arrives through your own website. Contact-form notifications come from your own domain, so owners read them as safe. In the past week our own form received two "quote requests" for a WordPress backup service: two different names, the same message word for word, sender addresses on a domain unrelated to the companies they named, and a link to an unknown site. That pattern is almost always phishing aimed at the owner, and it lands looking like a new lead. One step to take this week: treat every link in a form submission as untrusted. Before clicking anything, check that the sender's email domain matches the company website they give, and search one sentence of the message to see whether it was sent to other businesses. A real prospect will answer a plain reply without you ever opening their link.”
Messages arriving through your own website look safe; check that the sender's email domain matches their company website and search the message to see if it was sent elsewhere.
Zakaria Mamoumi is the founder of Growtoria.
4. Infrastructure and Patch Management
Forgotten plugins, outdated software, unpatched systems, and flat networks all leave doors open. Owners often treat websites like printed brochures—set and forget—while attackers actively scan for known vulnerabilities.
Kyle Stroud, Owner, All Ways Organic Carpet & Upholstery Cleaning
“The biggest mistake that I often see other small businesses make is not keeping their plugins and apps up to date. Small business owners that do have a website rarely or never log in to their website to check what's going on. Not only are there often piles of spam link comments on their blog portions of their sites, but their plugins, or worse, their entire wordpress version is months out of date. This is the easiest way bad actors can infiltrate a website. Exploits for older versions of all kinds of technology are actively traded and sold across the internet. Those plugins that are pushing out updates often provide new features, but they also patch known exploits that leave your website vulnerable.”
Plugins and WordPress versions months out of date are the easiest way attackers infiltrate; exploits are actively traded and sold online.
Kyle Stroud is the owner of All Ways Organic Carpet & Upholstery Cleaning.
Shannon Alexis, Founder and Website Manager, Inkredibly Punny
“One cybersecurity blind spot small business owners may overlook is "parasite SEO" spam and malicious redirects on their own websites. A site can appear normal to its owner while visitors are redirected to unrelated websites or logins promoting pharmaceuticals, gambling, or other inappropriate content through use of hidden code injected on their homepages. This damages customer trust, Google rankings, and the business's reputation before the owner even realizes anything is wrong. One practical step owners can take this week: Open your website in a private browser window on both a phone and a computer to check for unexpected redirects. On a desktop, right-click the page and select View Page Source. Use Ctrl+F to search the HTML for suspicious terms related to gambling, pharmaceuticals, or inappropriate products, as well as unfamiliar domains and links. If you find injected spam, suspicious scripts, or redirects, save screenshots of the affected URLs, and then contact your IT team to investigate or remove the suspicious code yourself if you're qualified.”
Hidden code and parasite SEO can redirect visitors and damage trust; check your website in a private browser and search the page source for suspicious code.
Shannon Alexis is the founder and website manager of Inkredibly Punny.
Ghulam Mustafa Basra, Independent malware-cleanup specialist, Fiverr
“The single biggest blind spot I see: small business owners treat their website like a printed brochure — set it and forget it. Most of the hacked sites I clean up were compromised through the same three doors: a plugin or theme nobody updated in two years, an admin login of "admin" with a reused password and no two-factor authentication, and no backup from before the infection — so recovery means rebuilding from scratch instead of rolling back an hour. The one concrete step for this week: turn on automatic updates for your site's CMS, themes, and plugins, and set up one automated off-site backup. It takes about twenty minutes. That single change would have prevented most of the infections I've cleaned up this year, and it turns a "my site is gone" disaster into a one-click restore.”
Most hacked sites were compromised through outdated plugins, weak admin logins with no two-factor authentication, or no backup; turn on automatic updates and set up an off-site backup.
Ghulam Mustafa Basra is an independent malware-cleanup specialist.
Etienne Basson, Founder, Veravix
“The biggest mistake I see is treating a clean result from a free website scanner as proof a site is safe. Most of them only look at what a visitor's browser loads. In my last survey, the scanner I used named zero plugins across 71 scans, so it could never have flagged a vulnerable one. One step this week: list every plugin or add-on your site runs, with its version number, and look each one up in a public vulnerability database such as WPScan or Patchstack. I did this by hand for the 25 plugins on my own site on 25 October. WPScan listed 67 known entries and Patchstack 69, and none applied to the versions I run. Three new entries had appeared four days earlier, so repeat it monthly.”
Free website scanners only check what visitors' browsers load; list every plugin and look each one up in a public vulnerability database like WPScan or Patchstack monthly.
Etienne Basson is the founder of Veravix.
Assaf Mevorach, Independent Wi-Fi and connectivity expert
“The biggest blind spot I see is the flat network. A small business runs its payment terminal, back-office computer, security cameras, and guest Wi-Fi all on one network, behind one password that has not changed in years and that former employees still know. One compromised camera or phone then becomes a direct path to the till. The fix this week costs nothing. Log in to the router and create separate networks for the business, for guests, and for devices like cameras and TVs, keeping the payment terminal on the business network only. Change the Wi-Fi password, turn on automatic router updates, and keep a short list of who has the new password. After that, one infected device can no longer reach the systems that matter.”
A flat network with one unchanged password means one compromised camera or phone becomes a path to the till; create separate networks for business, guests, and devices.
Assaf Mevorach is an independent Wi-Fi and connectivity expert.
5. AI and Third-Party Tools
Connecting AI assistants and integrations without permission review grants broad access that attackers or prompts can exploit. Employees also share sensitive data with personal accounts or free services with no control or assessment.
Joshua Estrin, PhD, CEO, Concepts in Success
“The most overlooked cybersecurity mistake is giving software more authority than you would give an employee. An SMB owner would question a new hire who requested access to every customer record, invoice, and shared folder. But connect an AI assistant or sales plugin, and those same permissions can get approved without a second thought. One concrete step this week: review the connected apps in your primary business platform Google Workspace, Microsoft 365, or your CRM. Remove unused connections and check whether the remaining tools need all the access they have. Assign one person to approve future connections.”
Giving software more authority than an employee—automatic access to every customer record, invoice, and folder—happens without a second thought.
Joshua Estrin is the CEO of Concepts in Success. He holds a PhD and brings experience as a data scientist and GTM architect.
Damodar Yekkuluri, Lead Architect, AI Inference, DigitalOcean
“The single biggest cybersecurity blind spot I see in small businesses is treating AI inputs as trusted. A shop will plug a chatbot or AI assistant into its website or customer data and assume whatever a visitor types is just a question. It is not - a crafted prompt can steer that assistant into revealing internal instructions, customer data, or taking actions it was never meant to take, and there is usually no validation layer in front of it to catch that. The one concrete step to take this week: put an input-screening layer in front of any AI tool that touches customer data or takes action on your behalf. Before the model ever sees a message, screen it for instructions that did not come from you. That single check closes the gap most small businesses do not know they have.”
Chatbots plugged into websites can be steered through crafted prompts to reveal internal instructions or customer data; screen inputs before the model sees them.
Damodar Yekkuluri is the lead architect, AI inference at DigitalOcean.
Dr. Walter Kurz, AI researcher and entrepreneur, Swissi Institute for AI
“What worries me is how easily a small business can connect an AI workflow to its operations without understanding the access it is granting. A few clicks can connect an assistant to emails, customer records and documents. The security review is considerably harder than the installation. Malicious connectors and agent skills have already been found. One fake email connector secretly copied outgoing messages to an attacker. Even legitimate tools can expose information through poor design, while instructions planted in an email or document can manipulate an assistant. That is prompt injection. There is also a risk without any attacker: an employee uploads a client file to a general-purpose online AI service to summarise it. Without an appropriate legal basis and safeguards, that can breach data protection or confidentiality obligations and become expensive quickly. This week, I would check one AI workflow already in use: what client data leaves the business, who receives it, and what can the assistant do? Restrict unnecessary access and keep client information out of services that have not been assessed for that use.”
Connecting AI workflows without security review is easy; malicious connectors exist, prompt injection can manipulate assistants, and employees may upload client files to external services.
Dr. Walter Kurz is an AI researcher and entrepreneur at Swissi Institute for AI.
Dr. Gleb Tsipursky, CEO, Disaster Avoidance Experts
“The overlooked risk I see is giving an AI assistant broad access to customer records, email, or company files without clear limits on what it may do. A malicious instruction buried in a document or email can sometimes lead an assistant to reveal information or take an unintended action. Owners may test whether it gives useful answers but neglect to test what it can send, change, or delete. One practical step this week: choose the AI workflow with the most sensitive access and make a permissions inventory. List which systems it can read, which it can modify, and who must approve consequential actions. Remove unnecessary access. Require human approval before an AI agent sends customer messages, moves money, deletes records, or changes permissions. Test the boundary using a harmless sample document containing an instruction the agent should ignore.”
Broad access to customer records and email without clear limits means malicious instructions can sometimes lead assistants to reveal or change data; test permissions and require human approval.
Dr. Gleb Tsipursky is the CEO of Disaster Avoidance Experts.
Chase Bernier, Founder & CEO, Sidekick Orchestration
“The biggest blind spot I see right now is staff using free, personal AI accounts for work. Nobody decided which AI tool the business uses, so people pick their own and paste in client emails, contracts and pricing. The owner usually doesn't know it's happening, and their IT provider was never asked. The step to take this week: choose one approved AI tool on a business account (Microsoft Copilot, ChatGPT Business or Claude Team), have your IT provider set it up with the right data settings, and write a one-page rule on what can and can't go into it. Then tell your team it exists and show them how to use it.”
Staff use personal AI accounts for work without IT oversight; choose one approved tool on a business account, set data policies, and tell the team it exists.
Chase Bernier is the founder and CEO of Sidekick Orchestration.
More expert takes
Nicolas Falourd, Founder & CEO, Cyber Techwear
“Most cyber attacks occur due to compromised credentials. My biggest concern would be owners who think that by using a basic password and periodically updating it they are protected. If you're not doing this yet, implement it. Start with email, administrative panels, payment platforms and other critical systems. This is an easy win that is not onerous for users.”
Most attacks occur through compromised credentials; implement multifactor authentication and periodic password resets on email, admin panels, and payment platforms.
Nicolas Falourd is the founder and CEO of Cyber Techwear.
M. Curtis McCoy, Web design, SEO and AEO expert
“The blind spot I see most is the domain itself. Small business owners lock down laptops and passwords, then never check who can send email as their business. If your domain has no DMARC record, anyone can send an invoice that looks like it came from you. Your customers can't tell the difference. The second one is quieter. The website goes down or shows a security warning, and company email can stop with it. One step this week: run your domain through a free DMARC checker. If SPF, DKIM or DMARC is missing, have whoever manages your email set them up, starting DMARC in monitor mode so nothing breaks. While you're at it, log into your domain registrar, turn on auto-renew, and make sure the account email is one you'll still read five years from now.”
The domain itself is often unprotected; anyone can send an invoice that looks like it came from you if there is no DMARC record, and renewal failures can take down the website and email.
M. Curtis McCoy is a web design, SEO and AEO expert.
Ranjith Raghunath, CEO, CX Data Labs
“Most small businesses are good about locking down the essentials like network access, point of sale, and other transaction points, but they often fail to consider privacy and security when it comes to customer and employee information. Even simple employee information from job applications and payroll can be used to commit fraud, as well as opening you up to potential liability concerns. Make sure you're securing this data, and make sure you're deleting old personal information that has little value but lots of risk attached.”
Owners lock down transaction points but fail to secure customer and employee information; delete old personal information that carries risk.
Ranjith Raghunath is the CEO of CX Data Labs.
Lokesh Karanam, Staff Software Engineer (MLOps), RR Donnelley
“The biggest blind spot I see in small businesses is authentication. Many teams still rely on just a username and password. They also add tools without a clear check. Sometimes those are open source tools from GitHub. Open source can be useful. But it also carries risk. Vulnerabilities are common in open source packages. One step to take this week is to check your inventory. List every service and tool you use. Ask if you understand what each one does. If a service is not needed, or not as expected, remove it from your environment. Then turn on multi-factor authentication in the apps you keep.”
Many teams rely on just a username and password, and add tools without checking them; list every service, understand what each does, and turn on multifactor authentication.
Lokesh Karanam is a staff software engineer (MLOps) at RR Donnelley.
Daniel Preston, Founder, LiveInCare USA
“One cybersecurity blind spot I believe small businesses underestimate is the security of administrative accounts and third party services connected to their websites. Small businesses often concentrate on securing their main website while overlooking the accounts that control their domain, hosting, email delivery, analytics, and other essential services. These accounts can provide access to important business systems, even when the website itself is properly maintained. My recommendation is to conduct a 30-minute administrative access audit this week. Start by listing every service that can affect your website or customer communications. Identify who has administrative access, remove permissions that are no longer necessary, enable multifactor authentication wherever available, and confirm that recovery email addresses are current and secure. This is a relatively simple preventive measure that doesn't require a large cybersecurity budget.”
Administrative accounts controlling the domain, hosting, and email delivery are overlooked; audit these accounts, remove unnecessary permissions, and enable multifactor authentication.
Daniel Preston is the founder of LiveInCare USA.
Suzon Mahmud, Founder, PrivacyMetadata.com
“The blind spot I see most in small businesses isn't hackers breaking in — it's files walking out the door carrying more than their owners realize. Every photo, PDF, and document a business emails to a client, vendor, or contractor can carry hidden data: GPS coordinates from a phone photo, the author's name, device details, and edit history. One shared site photo can reveal a home address; one contract draft can reveal who edited it and when. Nobody meant to share any of it. The concrete step any business can take this week: make stripping metadata part of sending, not an afterthought. Before any file leaves the company, run it through a metadata remover — it takes seconds — and check what's actually inside the file, not just what it looks like on screen. Most breaches I hear about start with someone oversharing by accident, not someone breaking in. Closing that gap costs nothing and takes less than a minute per file.”
Files walking out the door carry hidden metadata—GPS coordinates, author names, device details, edit history—most breaches start with someone oversharing by accident.
Suzon Mahmud is the founder of PrivacyMetadata.com.
Matthew Lynch, Founder, COSMIQ
“The single biggest cybersecurity blind spot for small business owners is often a fundamental misunderstanding of their own digital footprint and the data they truly possess. This overlooks the critical importance of identifying all sensitive data – customer information, financial records, intellectual property – and understanding where it resides, who has access, and how it's protected. One concrete step small business owners can take this week is to conduct a simple, internal data inventory. List every type of sensitive information your business handles, where it's stored (cloud services, local drives, employee devices), and who has access. This initial mapping provides a crucial foundation for understanding vulnerabilities and prioritizing security measures, moving beyond a reactive approach to a more informed, proactive stance.”
Small business owners often misunderstand their own digital footprint and assume basic antivirus is sufficient; conduct a simple data inventory to identify all sensitive information and where it resides.
Matthew Lynch is the founder of COSMIQ.
Denis Stebunov, CTO, ivelum
“The biggest blind spot is password hygiene. Most small business owners still don't use a password manager and haven't turned on two-factor authentication. But it leaves the door open to the most basic attacks there are. Weak passwords, reused across accounts and often shared between employees over chat, without a second factor, aren't sophisticated breaches; they're just someone trying a leaked password and getting in. A strong password is at least 12 random characters, never reused, and backed by two-factor authentication on anything sensitive: email, banking, payroll, cloud storage. One step this week: install a password manager for your team, move your email and banking logins into it first, and switch on two-factor authentication for those two accounts while you're in there. Email is the master key, whoever controls it can reset everything else.”
Password hygiene is weak; most owners don't use a password manager or two-factor authentication, leaving the door open to the most basic attacks.
Denis Stebunov is the CTO of ivelum.
Scott Sampson, Founder and CEO, Nimbus Pages
“The biggest blind spot I see in small businesses is that they have almost no security at all. They patch and do the basics, but they don't use multi-factor login or single sign-on. Random teams buy software and nobody checks whether it's vulnerable or even a good fit. Security is treated as an afterthought: employees are trusted to make the right call with no oversight. They need disaster recovery, but a survival version of it: know the handful of things you can't run without and how you get them back fast. The one step to take this week: turn on multi-factor login for every account the business uses, and single sign-on if your tools support it.”
Small businesses lack basic security; multifactor login and single sign-on are absent, random teams buy unvetted software, and security is an afterthought.
Scott Sampson is the founder and CEO of Nimbus Pages.
Tony DiDonato, [[firm]], The Millennium Group Computing
“Many small businesses have cybersecurity measures in place but fail to maintain the controls that modern cyber insurance carriers now require. Three of the most common blind spots are: (1) Assuming cloud platforms such as Microsoft 365, Google Workspace, QuickBooks Online, and Salesforce automatically provide complete backup protection, failing to regularly test backups to ensure they can actually be restored. (2) Treating employee cybersecurity training as a one-time checkbox rather than an ongoing program, which is a baseline requirement for Cyber Insurance for Small Businesses. (3) Even though 88% of SMBs report having backups, only about 61% regularly test them, meaning nearly 4 out of 10 businesses are relying on unverified recovery capabilities. Cyber insurers increasingly require proof of key controls, including Multi-Factor Authentication (MFA) on all critical accounts, Endpoint Detection and Response (EDR/MDR), immutable or offline backups, documented backup restore testing, ongoing security awareness training, patch management, incident response plans, and least-privilege administration. As a rule of thumb, roughly one-third to one-half of small businesses would likely fail a modern cyber insurance audit without additional remediation because the controls may exist on paper but are not consistently enforced, tested, or documented.”
Cyber insurance now requires controls that many small businesses fail; nearly four in ten do not regularly test their backups, and employee training is treated as a one-time checkbox instead of an ongoing program.
Tony DiDonato works in technology and cybersecurity at The Millennium Group Computing.
Frequently asked questions
What single password protection matters most for a small business?
The business email account matters most because password resets land there, making it the master key. Multifactor authentication on email should be the first priority, followed by banking and accounting software. Whoever controls the email account can reset passwords for the domain, website admin, and cloud services.
How can small businesses reduce phishing risk without hiring a consultant?
Run a 30-minute phishing awareness session with the entire team, show real examples of phishing emails, and teach people to hover over links before clicking. Monthly fake phishing drills—where you send a test email from a controlled address and track who clicks—teach more than any policy document. Combine this with one simple rule: verify any payment request by calling a trusted phone number, never one in the email.
What unmanaged access poses the biggest risk?
Old employee logins, vendor accounts, API keys sitting in code, and integrations that survived a project all remain usable long after they should have been removed. An audit takes an afternoon and costs nothing: list every person, vendor, and tool that can access systems, confirm each one is still needed, remove anything unnecessary, and enable multifactor authentication on what remains.
Can a small business eliminate ransomware risk this week?
Ransomware cannot be completely eliminated this week, but two actions sharply reduce it. First, enable multifactor authentication on email and accounting software—most ransomware starts with a compromised email or banking account. Second, ask your IT provider whether you have backups and whether they have been tested by actually restoring from them. Many businesses have backups on paper but have never verified they work.
How should small businesses handle artificial intelligence tools and third-party apps?
Review connected apps in your main business platform (Google Workspace, Microsoft 365, or your CRM) and remove unused ones. Do not let employees paste sensitive customer or financial data into personal AI accounts or free services. Choose one approved AI tool on a business account, set clear policies on what can and cannot be shared, and require multifactor authentication on anything that can access sensitive data.
The bottom line
Small business cybersecurity failures are rarely about sophisticated attacks. They happen because email lacks multifactor authentication, forgotten access goes unaudited, employees are never trained to spot phishing, and payment requests are verified through the email itself rather than a trusted phone number. Almost every expert points to one of these gaps. The concrete step matters: multifactor authentication on email costs nothing and takes minutes, but it shuts down the most common paths into a small business. An afternoon spent auditing who still has access and what they can do closes the door attackers actually use. Phishing drills work when run monthly. A simple rule—call, do not email, to verify anything unusual—stops fraud that catches even large companies. Together, these steps require no budget and no consultant. They require attention, but the cost of not paying it is far higher.
Responses were collected through a media query in October 2026 and have been lightly edited for length. This article is general information on cybersecurity practices, not professional security advice, and does not replace a security audit specific to your business.