Every few weeks we get the same call: an email that looked like it came from the bank, an invoice with a different account number on it, or a server with every file encrypted. None of those companies were special targets: they were small, their email lived in the cloud, and somebody clicked where they should not have.
Cybersecurity for a small company is not about buying the most expensive product. It is about closing the doors that real attacks walk through. This is what we apply with companies of 5 to 30 people in Mallorca: which threats matter, which measures to take, in what order and where not to spend.
The threats we actually see
Phishing and stolen credentials
Still the number one way in. An email imitates Microsoft, the bank or a supplier and leads to a page that asks for a username and password. With those, the attacker gets into the mailbox, reads quietly for weeks and waits for the right moment.
Payment fraud
Already inside a mailbox, or impersonating a supplier, the attacker sends a genuine invoice with the bank details changed. Nobody notices until the real supplier chases the payment. It is the most profitable attack against a small company and it needs no malware at all.
Ransomware
It encrypts the files on the server and the workstations, and often steals them first so the attacker can threaten to publish them. It gets in through an exposed remote access, a weak password or an unpatched machine.
Reused passwords
The same password on the email account, the invoicing tool and an online shop that suffered a breach. When that breach goes public, someone tries it against your Microsoft 365. Without a second factor, they are in.
A tiered protection plan
Tier 1: this week
- MFA on everything that supports it, starting with email; in Microsoft 365, security defaults turn it on for every user.
- A password manager for the whole team (Bitwarden or similar), one password per service, and credentials shared through folders rather than over WhatsApp.
- Automatic updates on Windows, macOS and browsers, and above all on the router, the firewall and any NAS or server reachable from outside.
- 3-2-1 backups: three copies, on two different media, one off-site and ideally immutable. We go through the details in our guide to 3-2-1 backups. And test the restore: a backup that has never been restored is a hypothesis.
Tier 2: the next few months
- Email filtering beyond what comes out of the box, and SPF, DKIM and DMARC records set correctly on your domain so nobody can send mail in your name.
- Least privilege: nobody works day to day as an administrator, on their laptop or in Microsoft 365; admin accounts are used only to administer, and they carry MFA too.
- Same-day leavers: the access of anyone who leaves is closed that day on every service, shared accounts included.
- Short, frequent training: twenty minutes every few months using real emails the company has received is worth more than a two-hour course once a year.
- Remote access through a VPN or identity-based access, never remote desktop open to the internet.
Tier 3: once the above works
- A one-page incident plan: who gets called, what gets disconnected first, where the backups are, how customers are told and, if personal data is involved, how the Spanish data protection authority (AEPD) is notified within 72 hours.
- Cyber insurance. It makes sense once MFA and backups are in place, because most insurers now require both before they pay out. Read the exclusions before signing.
- Endpoint protection with someone watching it (managed EDR), plus a periodic review of access and configuration. This is part of our IT support service, because installing the tool without anyone reading the alerts achieves little.
On NIS2 and Spain’s Esquema Nacional de Seguridad: most companies of this size are not in scope unless they work for the public sector or in a regulated industry. If someone is selling you a “compliance pack” on fear, ask first whether it applies to you at all.
Warning signs
- Forwarding or deletion rules in a mailbox that nobody created.
- Sign-in alerts from countries where nobody from the company is.
- A supplier who “changes bank” by email, with no confirmation call.
- Files with strange extensions, or text notes appearing in shared folders.
If you see any of these: disconnect the machine from the network (do not switch it off), change the email password from another device and call support.
What is a waste of money
- A high-end firewall with features nobody will configure, while email still has no MFA.
- 24/7 monitoring with nobody behind it to respond.
- A “premium” antivirus on every machine when the one built into Windows, properly managed, covers the essentials.
Budget
There is no magic percentage. There is an order: almost all of tier 1 costs more time than money. A password manager, an immutable off-site backup and the right Microsoft 365 licences add up to a modest monthly amount; set against a fraud or a week of not being able to work, it is the best-returning line in the whole IT budget.
Where to start
If you can only do three things this month: MFA on email, a password manager and a test restore of your backup. Once that works, move on to tier 2. And if you do not know where you stand, a morning’s review is usually enough.