How small businesses actually get hacked, and the fixes that stop it: phishing and email fraud, stolen passwords, ransomware, and locking down Microsoft 365, phones and office networks. Written in plain English for owners without an IT department.
14posts
If you prepare tax returns, the FTC Safeguards Rule applies to you, even as a one-person firm. How to count toward the 5,000-consumer exemption, what it does and doesn't excuse, and a practical checklist for a small practice.
A red screen says your computer is infected and to call Microsoft. It's a scam page, not a virus. How to close it, stop it coming back, and what to do if you already called.
Forgotten remote desktop rules, unpatched VPN boxes and vendor support tools are how a lot of ransomware gets in. Here's a 5-minute check to see what you're exposing, and how to close it.
When a phone with work email is lost or someone leaves on bad terms, can you remove the company data? Here's what to do today, and how app protection policies fix it without taking over anyone's phone.
Endless sign-in approval prompts mean someone has your password and is trying to wear you down. Here's what to do right now, and how to set up passkeys so the attack stops working.
If your guests, cameras, card reader and accounting PC share one Wi-Fi network, one cheap gadget can open the door to all of them. Here's how to split it up without breaking printing.
If fake invoices are going out under your name, or your real mail lands in spam, your domain is missing its email security records. Here's a two-minute check and a step-by-step fix.
Someone scanned a QR code in an email and signed in to a fake page. Here's what to do in the first hour in Microsoft 365 or Google Workspace, and why QR phishing gets past your filter.
Microsoft 365 defaults are usable, not safe. Here's how to check where your tenant stands in five minutes, the settings most small businesses never enable, and a prioritized action plan.
Passwords from old breaches get tried against your business email for years. Here's how to check whether yours are exposed, spot suspicious sign-ins in Microsoft 365 or Google Workspace, and shut the door.
'We have backups' often isn't enough: drives stay plugged in, sync gets mistaken for backup, and email isn't covered. Here's a 10-minute self-check and the 3-2-1 setup that survives ransomware.
Stop staff landing on known malware and phishing sites by changing one router setting. Lock your domain registrar account first, then set up free DNS filtering, close the browser loophole and test it.
A caller says they're your bank's fraud team, your IT support or the owner, and they need a code, a password or a payment right now. Here's how to check, what to do if you already answered, and a one-page phone policy for the office.
Business email compromise cost Americans about $3 billion in 2025. Here's how the scam works, what actually stops it, and what to do if you've already sent the money.