"We're too small to be a target" is one of the most dangerous beliefs in business. Automated tools scan the entire internet every day, looking for exposed services, weak passwords and unpatched software. They don't check the size of your company first.
In our penetration tests, the same weaknesses appear again and again. If any of these sound familiar, you are easier to break into than you think.
1. Email accounts without multi-factor authentication
If a stolen password is all it takes to read someone's email, you are one phishing message away from a breach. MFA blocks the vast majority of account-takeover attempts and is usually free to enable. Start with email, then remote access, cloud and admin accounts.
2. Remote access exposed to the internet
Remote desktop (RDP), old VPN appliances and admin panels open to the whole internet are favorite entry points for ransomware groups. If it doesn't need to be public, close it. If it does, put it behind a patched VPN with MFA.
3. "We'll update it later"
Outdated website plugins, firewalls, VPNs, servers and content-management systems are where many breaches begin. Attackers often start exploiting a publicly announced vulnerability within days. Keep a list of everything you run and a regular patching routine.
4. Shared and reused passwords
One admin password shared by the whole IT team, the same password on the firewall and the email, a former employee whose account still works. Use a password manager, give each person their own account, and remove access the day someone leaves.
5. Backups nobody has tested
Many companies discover during a ransomware attack that their backups were incomplete, encrypted too, or impossible to restore quickly. Keep at least one copy offline or immutable, and practise a real restore regularly.
6. Staff who have never seen a real phishing example
Your team is the target of every phishing campaign. People who have seen realistic examples, and who know reporting is welcome, catch attacks that technology misses. Read our 10-second phishing check and share it with your team.
7. You have never been tested
If no one has ever tried to break in, you don't really know whether your defenses work. Configurations drift, new systems appear, and assumptions go unchallenged. An independent penetration test shows you what an attacker would find, before an attacker does.
Where to start
If you only do three things this month: turn on MFA everywhere, close or protect anything exposed to the internet that doesn't need to be, and test a backup restore. Then book a test to find what you missed.
DABS can map what your business exposes to the internet and test how far an attacker could get. Talk to us; the first scoping call is free.
