Many owners of small and mid-sized businesses assume cyber criminals only go after banks and big companies. In practice, smaller businesses are attractive precisely because their defences are lighter. Most attacks are automated or opportunistic: they look for weak passwords, outdated software and busy people who will approve a payment without checking.
Here are twelve mistakes we see repeatedly in Indian SMEs, and a simple first fix for each. None of them require a big security team.
1. Sharing one login across the team
The same email password or software login is shared by several people, written on a sticky note or sent on WhatsApp. When someone leaves, the password rarely changes, and there is no way to know who did what.
First fix: give each person their own account and use a password manager for any credentials that must be shared.
2. No multi-factor authentication
Email, banking, website admin and social media accounts are protected only by a password. If that password leaks in a data breach elsewhere or is guessed, the account is open.
First fix: turn on MFA everywhere it is offered, starting with email and banking. Authenticator apps are generally stronger than SMS codes.
3. Former employees still have access
Ex-staff, past freelancers and old agencies still have accounts on the website, Google Workspace, CRM or social media pages.
First fix: keep a simple access register listing every system and who has access. Review it whenever someone leaves and at least every quarter.
4. Running pirated or unsupported software
Unlicensed copies of operating systems, office software or design tools do not receive security updates, and cracked installers often contain malware. Very old systems may no longer receive updates at all.
First fix: list the software in use, replace pirated copies with licensed versions and plan to retire systems that no longer get security updates.
5. Skipping updates
Update notifications are postponed for weeks or months on computers, phones, routers and websites. Many attacks exploit vulnerabilities that already have a fix available.
First fix: turn on automatic updates for operating systems and browsers, and agree a regular schedule for website and server updates. Our website maintenance plans handle this for CMS-based sites.
6. Treating antivirus as complete security
Installing antivirus feels like the job is done. But antivirus will not stop someone logging in with a stolen password or approving a fake invoice.
First fix: think in layers - updated systems, MFA, least-privilege access, backups, and staff awareness - with antivirus as one of them.
7. Falling for payment-change and invoice scams
A message that appears to come from a supplier, customer or the owner asks for urgent payment to a new account. The email address looks almost right, the tone is urgent, and the payment goes out.
First fix: set a firm rule that any change in bank details, or any unusual urgent payment request, is confirmed by phone using a number already on file. Share this rule with your accounts team and suppliers. If money is lost, contact your bank immediately and call the national cyber crime helpline 1930.
8. Backups that are untested or on the same machine
Backups exist on the same server or office computer, or have not been checked in months. When ransomware or hardware failure strikes, the backups fail too.
First fix: follow the 3-2-1 rule - three copies, two types of storage, one off-site - keep one copy offline or immutable, and test a restore on a schedule.
9. Domain, hosting or social accounts in someone else's name
The domain was registered by a former developer, the hosting account uses an employee's personal email, or the Facebook page is owned by an agency. When that relationship ends, regaining control can be painful.
First fix: check who owns your domain, hosting, email admin, social media pages, Google Business Profile and app store accounts, and move them to business-controlled accounts.
10. Weak office Wi-Fi and default router passwords
Office routers still use default admin passwords, the Wi-Fi password has not changed in years, and guests use the same network as office computers.
First fix: change router admin passwords, use strong Wi-Fi encryption, and set up a separate guest network for visitors and personal devices.
11. No rules for personal phones and laptops
Staff access business email, WhatsApp groups and customer data from personal phones with no screen lock, no updates and no way to remove access if the phone is lost.
First fix: set basic rules: screen lock, updates on, approved apps for business data, and a process to remove access if a device is lost or the person leaves.
12. Ignoring data protection obligations
Customer data is collected on forms, stored in spreadsheets and shared freely inside the team, with no clear purpose, retention period or security controls.
First fix: list where personal data is stored, who can access it and why you keep it. The DPDP Act 2023 expects businesses to protect personal data with reasonable security safeguards and use it for stated purposes. Take legal advice on your specific obligations as the Rules are phased in.
Summary table
| Mistake | Risk | First fix this week |
| --- | --- | --- |
| Shared logins | No accountability, hard to revoke | Individual accounts plus password manager |
| No MFA | Account takeover from leaked passwords | Enable MFA on email and banking first |
| Ex-staff access | Unauthorised access | Access register and offboarding checklist |
| Pirated software | Malware, no updates | Replace with licensed software |
| Skipped updates | Known vulnerabilities exploited | Automatic updates and a maintenance schedule |
| Antivirus only | False sense of security | Layered protection |
| Payment-change scams | Direct financial loss | Phone verification rule for bank changes |
| Untested backups | Data loss after an incident | 3-2-1 rule and restore tests |
| Accounts in others' names | Loss of control | Move to business-owned accounts |
| Weak Wi-Fi | Network access by outsiders | New passwords and guest network |
| Unmanaged personal devices | Data exposure if lost | Basic device rules |
| Ignoring data protection | Regulatory and trust risk | Data inventory and access review |
Where to start if you have one hour
- Turn on MFA for the owner's email and business bank account
- Tell the accounts team about the phone verification rule for bank changes
- Check who owns the domain and hosting
- Remove access for anyone who has left
- Ask whoever handles IT when backups were last tested
Turn fixes into habits
Security is not a one-time project. A simple routine keeps the basics in place:
- Every week: check that backups ran successfully and that website and server updates are applied or scheduled.
- Every month: review new and removed users across email, website, CRM and accounting systems; restore a few files from backup.
- Every quarter: review the access register in full, test a website or database restore, and remind the team about phishing and payment-change scams with a recent example.
- Every year: review your security policy and incident plan, check domain and certificate renewals, and replace devices or software that no longer receive updates.
Put these on a shared calendar with a named person against each one. Small, regular checks prevent the slow build-up of risk that leads to most incidents.
When to bring in outside help
Many of these fixes can be handled internally. Consider an external review when you are moving systems to the cloud, launching an e-commerce store, handling significant volumes of customer personal data, or after any incident - even a small one.
Key takeaways
- Most SME security incidents exploit simple, fixable weaknesses
- Individual accounts, MFA and prompt offboarding protect the front door
- Licensed, updated software closes common gaps
- A phone verification rule stops many payment scams
- Tested, off-site backups make recovery possible
- Keep domains and key accounts in your business's name
- Treat personal data with care under the DPDP Act 2023
If you would like an owner-friendly security review of your business, book a free consultation. We will go through accounts, devices, website, backups and policies and give you a prioritised list of fixes. Learn more about our cyber security services, or about cloud and DevOps support for your servers.
