Seven Cyber Security Mistakes Small Businesses Still Make

Cybersecurity is not a new problem. Yet many of the weaknesses small businesses face today remain surprisingly familiar: phishing, weak access controls, delayed updates and poor preparation. FSB’s own guidance for small businesses continues to highlight practical steps such as spotting phishing scams and improving day-to-day cyber habits.

From ransomware attacks and data breaches to phishing scams and supplier compromises, the threats facing businesses continue to evolve. Yet despite growing awareness, many cyber incidents still result from the same fundamental weaknesses.

Many organisations are still neglecting the very foundations of cyber security.

For small businesses, these foundations can make a significant difference. While no organisation can eliminate cyber risk, addressing common mistakes may help reduce vulnerabilities and improve resilience.

Here are seven cybersecurity mistakes small businesses still make in 2026.

1. I’m a small business, we won’t get targeted!

One of the most persistent myths is that cyber criminals only target household names and multinational corporations.

In reality, attackers increasingly use automated tools to scan the internet for vulnerable organisations regardless of size. A small business may be just as likely to appear on a cyber criminal’s radar as a larger company if weaknesses are visible online.

Small businesses often hold valuable information, including:

• Customer data
• Employee records
• Payment information
• Financial details
• Access to supplier networks

Cyber criminals are not always interested in who you are. Often, they are interested in what systems they can access.

Thinking “it won’t happen to us” can lead to important cyber risks being overlooked.

2. I’m using the same password everywhere; it’s just easier to remember.

Weak or reused passwords remain one of the easiest ways for attackers to gain access to systems.

If the same password is used across multiple platforms, a breach affecting one account could potentially expose several others.

The National Cyber Security Centre (NCSC) recommends using strong, unique passwords and supports the use of password managers to help businesses manage credentials securely.

Simple steps include:

• Using a unique password for every account
• Avoiding easily guessed information
• Using a password manager
• Reviewing unused accounts regularly

While password security may seem basic, compromised credentials remain a common starting point for cyber incidents.

Many effective cyber controls are surprisingly affordable. Our article on Low-Cost Cyber Measures For Small Businesses That Really Work explores several practical steps businesses can take.

3. These extra security checks are annoying. Can we turn them off?

Multi-factor authentication is one of the most effective cybersecurity controls available.

MFA requires users to provide a second form of verification alongside a password, such as a code generated by an authentication app or sent to a trusted device.

Even if a password is compromised through phishing, malware or a previous breach, MFA may help prevent unauthorised access.

Many major business platforms now offer MFA at no additional cost, making it one of the simplest security improvements many businesses can implement.

4. Another update? Remind me tomorrow, again.

Software updates are often postponed because they can be inconvenient.

However, updates frequently contain security patches that address vulnerabilities already known to attackers.

Leaving systems unpatched can create opportunities for cyber criminals to exploit weaknesses that software providers have already identified and fixed.

Businesses should consider keeping the following up to date:

• Operating systems
• Web browsers
• Business software
• Mobile devices
• Firewalls and routers
• Anti-virus solutions

Cybersecurity does not always require complex technology. Sometimes it starts with applying the updates already available.

5. It was from our bank… wasn’t it?

Phishing remains one of the most common forms of cyber attack affecting UK businesses.

Modern phishing attempts are often highly convincing and may impersonate:

• Suppliers
• Customers
• Delivery companies
• Banks
• Government organisations
• Senior colleagues

A single click on a malicious link could result in stolen credentials, malware infections or financial fraud.

As cyber threats evolve, businesses are increasingly finding that digital risks extend beyond traditional IT systems. Our guide to The Critical Need for Cyber Insurance in the Digital Age explores some of the wider consequences a cyber incident may create.

Regular awareness training can help employees identify suspicious messages before they cause harm.

Businesses should also make it easy for staff to report concerns without fear of embarrassment. It is often better to investigate a false alarm than overlook a genuine threat.

6. We don’t need to check up on our supplier, I’ve known them for years!

Many businesses rely on external providers for critical services, including:

• Cloud software
• Payroll
• Accounting
• Website hosting
• IT support
• Payment processing

Cyber risk does not stop at your own systems.

A security incident affecting a supplier may also affect the businesses that depend on them. This can include service outages, compromised data or wider disruption across supply chains.

Digital risk is rising and prevalent.

As businesses become increasingly connected, understanding who has access to systems and data is becoming an important part of cyber risk management.

The growing use of AI tools, cloud platforms and third-party software means digital risks are becoming increasingly interconnected. Businesses using AI may also wish to read If AI Goes Wrong, Who’s Liable? A 2025 Guide for UK Small Businesses.

7. It can never happen here, so why worry?

Many organisations focus on preventing incidents but spend little time considering how they would respond if one occurred.

When a cyber attack occurs, confusion and delays can make the situation worse.

Even a simple cyber incident response plan can help businesses identify:

• Who should be contacted
• Which systems are critical
• How incidents should be reported
• How customers may be informed
• What actions should be taken first

The flip from business as usual to full-blown crisis can happen in seconds.

A recent example can be seen in our analysis of the Peter Green Chilled ransomware attack, which highlights how quickly a cyber incident can disrupt operations.

Having a plan in place before an incident occurs may help businesses recover more quickly and reduce disruption.

Cybersecurity Is an Ongoing Process

Cybersecurity is not about achieving perfection.

It is about understanding risks, implementing sensible controls and regularly reviewing areas that could leave a business vulnerable.

Many successful cyber attacks still rely on avoidable weaknesses. The good news is that many of these weaknesses can be addressed through straightforward measures that do not require large budgets or specialist expertise.

Many organisations are still neglecting the very foundations of cyber security.

Reviewing these seven areas could be a valuable starting point for improving cyber resilience and reducing the likelihood of disruption.

However, cybersecurity is only one part of broader business resilience. Businesses may also benefit from reviewing their wider continuity arrangements, including disaster recovery and operational planning.

Want Greater Visibility of Your Cyber Risks?

Many businesses are surprised by how much information about their digital footprint may already be visible online.

Through our partnership with Coalition, eligible businesses can access a complimentary cyber risk review that may help identify potential cyber exposures and areas for improvement.

Whether you are reviewing your cybersecurity arrangements for the first time or looking to strengthen existing controls, understanding your risks is often the first step.

To learn more, call FSB Insurance Service on 020 3883 7976 today.

This content is for general information only and is not intended to provide advice or a personal recommendation. Insurance cover is subject to the terms, conditions, and exclusions of the policy. Always consider your individual circumstances and seek professional advice before arranging insurance. External websites are not under our control and we are not responsible for their content.