Most cybersecurity advice aimed at small businesses is either terrifying or useless. It either implies you are one click from ruin, or it tells you to use strong passwords and hope.
The reality is narrower and more manageable. Small businesses are not usually taken down by exotic attacks. They get hit by three patterns, over and over, and each has a defense that is well understood and unglamorous.
1. Someone gets your password
This is the most common starting point, and it is rarely dramatic. There is no code-breaking. The usual routes are:
- A convincing email. A message that looks like Microsoft, your bank, or a vendor, asking you to log in. The page looks right. You type your password into it.
- Reuse. A password you used on your work email was also used on a site that got breached years ago. Attackers buy those lists and try the combinations everywhere.
- A phone call. Someone claiming to be IT support, asking you to confirm a code. This works more often than people expect.
What stops it: multi-factor authentication, on every account, with no exceptions. A stolen password alone becomes useless. This is the single highest-value security control available to a small business, and it is usually included in software you already pay for.
The second control is a password manager, so that one breached site does not hand over the keys to everything else. Asking staff to memorize twenty unique passwords does not work, and pretending otherwise is how reuse happens.
2. Ransomware
Ransomware encrypts your files and demands payment. It typically arrives through an attachment, a compromised remote access tool, or an unpatched system exposed to the internet.
The part businesses get wrong is the recovery plan. Nearly everyone has a backup. Far fewer have a backup that would actually survive the event, because modern ransomware deliberately looks for backups and encrypts those too. A backup drive permanently connected to the machine it is backing up is not a safeguard.
What stops it, or limits the damage:
- Patching, promptly and on a schedule. A large share of successful ransomware exploits vulnerabilities that had fixes available.
- Endpoint protection that detects behavior, not just known file signatures.
- Backups kept somewhere the attacker cannot reach from a compromised machine, with versioning so you can go back to before the encryption started.
- Restore testing. If nobody has restored from your backup, you do not have a backup. You have an assumption.
Locking down remote access matters too. Remote desktop exposed directly to the internet is one of the most reliable ways to get hit.
3. Invoice and payment fraud
This is the one that costs the most and gets discussed the least. It is often called business email compromise, and it does not necessarily involve any malware at all.
An attacker gets into an email account, usually with a stolen password. Then they wait. They read your invoicing, learn who pays whom, note how your people write. Eventually they send a message that looks completely ordinary, from a real address, asking for payment to updated bank details. Sometimes they create a rule that hides their own messages from the real account owner.
By the time anyone notices, the money has moved.
Laredo businesses are unusually exposed here, because payments across the border are routine. New banking details for a counterparty in Mexico do not look strange the way they might elsewhere.
What stops it:
- Multi-factor authentication, again, since the attack usually starts with a compromised mailbox.
- A verbal callback rule. Any change to payment details gets confirmed by phone, using a number you already had, never one supplied in the email requesting the change. This costs nothing and prevents most of these losses.
- Email security that flags external senders and lookalike domains, so a message from a domain one letter off from a real one is visibly different.
- Alerting on mailbox rules, since attackers create hidden-folder rules to stay unnoticed.
What we would do first
If you did nothing else this quarter, these four would remove most of your realistic risk:
- Turn on multi-factor authentication everywhere, especially email. No exempt accounts, including the owner’s.
- Write down a callback rule for payment changes and tell your finance staff it is not optional, even when the request appears to come from you.
- Restore a file from your backup this week. Not check that the backup ran. Actually restore something.
- Remove access for everyone who has left. Old accounts are attractive because nobody is watching them.
None of these require a large budget. They require someone to own them.
Common questions
How do small businesses actually get hacked?
Most incidents start with a stolen password, obtained through a phishing email, password reuse from an unrelated breach, or a phone call impersonating support. Ransomware and invoice fraud usually follow from that initial access rather than being the first step.
What is business email compromise?
An attack where someone gains access to an email account, studies normal invoicing and payment patterns, then redirects a legitimate payment by requesting a change to bank details from a real, trusted address.
What is the single most effective security control for a small business?
Multi-factor authentication on all accounts, particularly email. It makes a stolen password insufficient on its own and prevents the majority of account takeovers.
Is antivirus enough?
No. Traditional antivirus recognizes known threats. It does not stop an attacker who simply logs in with a valid stolen password, which is how most small business incidents begin.
If you are not sure where you stand
Most businesses we talk to are partway there. Multi-factor is on for some accounts but not all. Backups run but have never been restored. Someone who left last year still has a login.
None of that requires panic, just a list and someone working through it. If you would like help building that list, call 956-849-6174 or get in touch. We support businesses across Laredo and Webb County in English and Spanish, and we work without long-term contracts.