Smaller organisations are frequent targets precisely because attackers expect weaker defences. The good news is that a few fundamentals go a long way.
Enable multi-factor authentication on email, cloud consoles and admin panels. This single step blocks the majority of account takeover attempts.
Keep operating systems, frameworks and plugins up to date, and remove software that is no longer used.
Back up critical data regularly, store copies offline or in a separate account, and test that restores actually work.
Train staff to recognise phishing and give them a simple way to report suspicious messages.
