Cybersecurity is not a matter of expensive software. For most businesses it is a matter of closing five gaps that cost nothing to close. The hard part is not the budget; it is accepting that this is a routine rather than a project.
Short answer: where should an SME start with cybersecurity?
The order is: write down what you are protecting (data, access, continuity), then apply the three highest-impact measures — strong authentication, tested backups and current software. Those three cover the majority of real incidents, and none requires a specialist security product. Advanced tools bought before that foundation exists do not pay off, because most attacks arrive not through sophisticated technique but through a door left open.
The risk map: what are you protecting?
- What data do I hold? Customer records, financial data, contracts, employee information, trade knowledge. For each, note where it lives and who can reach it.
- Which system stopping stops the business? Website, e-mail, accounting software, order system. Write down, as a number, how many hours you can be without each.
- Who has access to what? Employees, agencies, consultants, integrations. Most businesses have never produced this list, and producing it delivers the first surprises.
The intersection of those three lists defines what you must protect. Security investment without an inventory is like buying locks without knowing which door stands open.
A 30-day implementation plan
| Week | Task | Time | Cost |
|---|---|---|---|
| Week 1 | Inventory: data, systems, access. Identify critical accounts. | 4–6 hours | None |
| Week 2 | Authentication: 2FA on critical accounts, remove shared passwords, adopt a password manager. | 3–5 hours | Low |
| Week 3 | Backups: verify scope, establish a separated copy, run a restore test. | 4 hours | Low-medium |
| Week 4 | Updates, removal of unused components, team awareness session, write the incident plan. | 4 hours | None |
Roughly 15–20 hours in total, largely without product purchases. Completing it moves a business's risk profile clearly below the average for its sector — and most attacks seek targets below average.
Five gaps you can close without budget
- Shared accounts and passwords. An account belonging to nobody is closed by nobody. Individual access provides both traceability and a clean exit at departures — covered in our access shutdown checklist.
- Missing two-factor authentication on critical accounts. Domain, hosting and e-mail above all; the single setting that reduces most risk. Method choice matters too — see our 2FA article.
- Unpatched components. Content management system, plugins, themes and server-side software. Enabling automatic updates and removing abandoned components is a few hours' work.
- Untested backups. Taking a backup is an assumption; restoring one is a guarantee. Only a drill shows the difference.
- Departed employees' access. Accounts left open are both the easiest gap to exploit and the easiest to close.
The human side: the highest-return investment
- Two 45-minute sessions a year. Short and repeated beats long and occasional.
- Use real examples. Actual phishing messages received in your sector stay in memory far longer than theory.
- Build a "reporting is safe" culture. An employee who fears punishment for a wrong click will stay silent, and silence multiplies the cost.
- Require second approval for payment and invoice changes. A written rule stops even the most sophisticated fraud.
An incident response plan skeleton
- Who decides? One responsible person and a deputy, named in advance.
- Who gets called? Hosting provider, systems lead, legal adviser, and the bank where relevant — with phone numbers.
- What are the first three steps? Usually: isolate the affected system, revoke access, preserve logs.
- What gets recorded? A timestamped incident log, needed both for response and for any notification duties afterwards.
- Who must be notified? Affected customers, partners, and any authorities required by law.
- When is it over? Without a closure criterion written in advance, incidents drag on.
Netişlem expert view: security is a routine, not a product
The most common misconception we encounter is that security is something purchased and installed once. In most incidents we examine, what was missing was not software but a simple recurring check: updates not applied, backups never tested, a departed employee's account still open. None of those is a budget problem; they are calendar problems.
Our second observation is that businesses do not see themselves as targets. We hear "what would anyone want from us" often. But a large share of attacks aim not to steal data but to use your system for something else, to demand ransom, or to send fake invoices to your customers from your own mailbox. Targets are chosen by exposure, not by value.
Third, the most expensive item is usually downtime. Data loss can be costed; the real bill often arrives in the days the business stands still and in the trust lost with customers. Backup and continuity therefore belong before classic "security products".
Checklist
- Data, system and access inventory produced and reviewed annually.
- Two-factor authentication active on critical accounts.
- No shared accounts remain; everyone has individual access.
- A password manager is in use and passwords are not reused.
- Backup scope documented and a restore tested.
- One backup copy separated from the source system.
- All components current; abandoned ones removed.
- Departed employees' access closed with a written procedure.
- Second-approval rule for payment and invoice changes.
- A one-page incident response plan ready and accessible.
- Team awareness sessions scheduled twice a year.
- Supplier and integration access reviewed — see supply chain risk.
Frequently asked questions
Would a small business really be targeted?
Yes, and usually without being singled out. Automated tools scan systems across the internet and flag those with known flaws. What decides exposure is the state of the system, not the size of the business.
Isn't antivirus enough?
Necessary but not sufficient. A large share of today's incidents begin not with malware but with a stolen password, a phishing message or access left open. Those are stopped by authentication and access management, not antivirus.
Should I buy cyber insurance?
Worth considering above a certain scale. But insurance does not replace basic measures; policies generally require minimum safeguards to be in place. Foundation first, transfer second.
How do I get my team on board?
Scenarios work better than rules: a concrete example such as "a fake invoice arrived and was paid" lands harder than a long policy document. Showing how little the measures affect daily work also reduces resistance markedly.
Which measure gives the highest impact?
Two-factor authentication on critical accounts, and tested backups. The first closes the most common entry route; the second limits impact once something happens. Together they reduce more risk than any single product.
Doesn't my hosting provider handle security?
Providers protect the infrastructure layer: network, physical security, server-level measures. The application, passwords, plugins and access management remain yours. Having the boundary stated in the contract prevents mismatched expectations.
Conclusion
Cybersecurity is not an unreachable specialism for smaller businesses. A planned 30-day effort closes most of the risk, and most of it requires no purchases. What decides the outcome is turning security from a project into a calendar item.
If you would like us to assess your current security position, get in touch. You can review our secure hosting, corporate backup and WAF/DDoS protection solutions.