When I tell people what we do, "we protect small businesses from hackers," the next question is almost always "okay, how?"
The honest place to start is passwords. A lot of break-ins don't look like hacking at all. Nobody breaks anything. Someone simply logs in with a real password that belongs to one of your people.
How passwords get stolen
You usually can't tell that a password has been stolen until someone uses it. The common ways it happens are ordinary:
- A fake sign-in page. An email says a document has been shared with you, or your mailbox is full. The link opens a page that looks exactly like your normal sign-in screen. You type your password, and it goes to the criminal.
- Reuse. The same password is used for work email and for a shopping site, a forum or an old app. That other site gets breached, and the password ends up on a list that criminals try everywhere.
- Guessing. Season-plus-year passwords and the company name with a "1!" on the end are the first things tried.
- A compromised home computer. Malicious software on a family PC can capture whatever is typed on it, including the work password.
None of these require your IT to be "bad." They just require one person to have one ordinary day.
A password alone shouldn't be enough
The fix that does the most is multi-factor authentication, often called MFA. It means a password alone isn't enough to get in. After the password, the person also has to confirm a second step, usually an approval or a code on their phone. A criminal with only the password is stuck.
How much difference does it make? Microsoft's researchers found in 2023 that MFA cut the risk of an account being compromised by 99.22%.
That doesn't make it magic. Criminals have tricks for some kinds of second step: fake sign-in pages that pass the code along in real time, or sending approval request after approval request, hoping someone taps "Approve" just to make it stop. Which is why the second half of the answer matters.
Watching the sign-ins
The second half is sign-in threat detection: watching for logins that don't fit. A sign-in from another country at 3 a.m. A login from two places hundreds of miles apart within a few minutes. A sign-in that suddenly comes from a device nobody has seen before. Those get flagged so they can be stopped and looked at, instead of being discovered weeks later when a customer calls about a strange invoice.
MFA makes the stolen password far less useful. Sign-in monitoring catches the attempts that try to get around it.
A 10-minute check you can do this week
You don't need to be technical for this. Grab a sheet of paper:
- List the logins that matter. Work email, the bank, payroll, accounting, your domain registrar and your website.
- Next to each one, write yes or no: does it ask for a second step? Where the answer is no, turn it on this week. Most banks and payroll services have it in the security settings.
- Check the exceptions. MFA is often switched on for "everyone" except the shared mailbox, the owner who found it annoying, or the account of someone who left last year. Those exceptions are exactly what criminals look for.
- Agree on one rule with your team: if your phone ever asks you to approve a sign-in you didn't start, tap Deny and tell IT right away. It means someone has your password.
- Stop reusing the email password. It should not be used anywhere else, ever.
If you get through that list with all yeses, you're ahead of a lot of businesses. If you don't, you now know exactly where to start.
What we do
Our managed plans include Microsoft 365 account protection: multi-factor authentication and sign-in threat detection, on every account, not just the ones people remembered. Every user also has a Microsoft 365 Business Premium license as part of the plan.
It's one layer of several. A stolen password is also the start of most fake-invoice schemes, so it works alongside email security and staff training, which is the next question in this series.
No one can honestly promise that nothing will ever get through. Our job is to make it much harder to get in, notice fast when someone tries, and get you back up if something does.
Ask us how
This post is one of ten plain answers to the questions owners ask when they hear what we do. All ten are on one page: How we protect small businesses from hackers.
If you'd like us to look at your business, book a free assessment. Short on time? The free email and domain security check takes about a minute and shows whether someone could send email as you.
We protect small businesses from hackers. Ask us how.