Most small business breaches we get called about don’t start with some clever hack. They start with a reused password, a fake invoice email, or a laptop that hadn’t installed an update in four months. So this list is the boring stuff, in the order we’d actually do it.
For everyone on the team
Use long passphrases and stop rotating them on a schedule. NIST’s current password guidance (SP 800-63B) says length beats complexity and that forced changes every 90 days mostly produce weaker passwords. Four or five unrelated words is easier to remember and harder to crack than a short jumble of symbols. Change a password when there’s a reason to, like a breach or a departing employee. We wrote more about this in rethink your password routine.
Use a password manager so every account gets its own password. Reuse is the real problem. When one site gets breached, attackers try that same email and password everywhere else within days.
Turn on multi-factor authentication for email first, then banking, payroll and anything with client data. A phone app or a hardware key is better than text codes. Passkeys are better still where the site supports them (see our Microsoft passkeys post).
Slow down on email that asks for money, gift cards, login details or a change to bank info. Call the person back on a number you already have, not the one in the email. That one habit stops most invoice fraud.
Lock your screen when you walk away (Windows key + L) and don’t let the browser save passwords on a shared front desk PC.
For whoever runs the business
Keep every computer on a supported version of Windows or macOS with updates turned on. Windows 10 stopped getting regular security updates on October 14, 2025, so any machine still on it needs a plan.
Give each person their own login. Shared accounts make it impossible to tell who did what, and you can’t shut off one person’s access without locking out everyone.
Back up the business data, keep one copy off site, and test a restore a couple of times a year. A backup nobody has ever restored from is a guess. Our backup and recovery page explains how we set this up for offices here in Southwest Florida.
Put guests and personal phones on a separate Wi-Fi network so they have no path to your files or printers. More on that on our wireless networking page.
Don’t give everyday user accounts administrator rights. Most malware needs admin rights to dig in, and a normal user account blocks a lot of it before it starts. When someone needs to install software, have them ask.
Tell people who to call when they click something they shouldn’t have. The worst outcome is an employee who is too embarrassed to say anything for a week. A quick call in the first ten minutes is usually a password reset. A week later it can be a mailbox forwarding every invoice to someone overseas.
Turn off access the day someone leaves, including email, cloud apps, remote access and any shared passwords they knew.
If you’d like someone to go through this with you, that’s the kind of thing we do every week for small offices in Fort Myers, Cape Coral and Naples. Start with our cybersecurity services or call (239) 234-2334.
HenkTek is a local IT company in Fort Myers that looks after the technology Southwest Florida businesses depend on, from Cape Coral and Bonita Springs to Naples. We handle managed IT, cybersecurity, backups and help desk support, and we explain things in plain English.