There is a myth that cyberattacks target only large enterprises. The opposite is true: smaller businesses are attacked precisely because their defences are assumed to be weaker. The good news is that the most common weaknesses are not exotic — they are basic hygiene issues that a focused effort can fix in a week. These are the five we run into most.

1. No multi-factor authentication

A stolen or guessed password should not be enough to get into your email, your accounting system, or your admin panel. Multi-factor authentication — a code from an app in addition to the password — blocks the overwhelming majority of account-takeover attempts. It is free on almost every major platform and takes an afternoon to roll out. If you do one thing after reading this, do this.

2. Reused and weak passwords

When staff reuse the same password across services, one leaked site compromises all of them. A team password manager solves this quietly: it generates strong, unique passwords and remembers them so no one has to. It also means access can be revoked instantly when someone leaves.

3. Unpatched software and devices

Attackers scan for known vulnerabilities in out-of-date software. Every laptop, server, phone and website plugin that is not kept current is an open door. Automatic updates and a simple monthly check of anything that cannot auto-update removes most of this risk.

4. No real backups

Ransomware is only devastating if you cannot recover. Backups that are automated, stored separately from your main systems, and — critically — tested by actually restoring from them, turn a business-ending event into an afternoon of inconvenience. The test is the part everyone skips and the part that matters most.

A backup you have never restored from is a hope, not a plan.

5. Staff who have never been shown what a phishing email looks like

The most common way in is not a firewall exploit — it is a convincing email that tricks someone into clicking a link or paying a fake invoice. A short, practical training session, repeated a couple of times a year, measurably reduces how often that click happens. People are not the weak link when they know what to watch for.

Where to start

You do not need an enterprise security budget to be meaningfully safer. Start with a quick assessment of where you stand against these five, fix the cheapest and highest-impact gaps first, and build from there. We run exactly this kind of assessment for Gulf businesses — practical, plain-language, and prioritised by real risk rather than fear.