Six cybersecurity practices every growing company should have in place

A data breach costs money, time and trust: recovery work, legal advice, lost sales and customers who wonder whether to stay. The encouraging fact is that most breaches start with the same ordinary gaps, and closing those gaps doesn’t need a large security team.

These are six practices to have in place, in roughly the order we would tackle them. For a view of the threats they are aimed at, see our guide to the ten cybersecurity threats growing companies face.

1. Train people, and make reporting easy

Staff are often the first and last line of defence. Phishing emails, fake login pages and convincing phone calls are designed to fool careful people, not careless ones.

• Run short, regular training on spotting suspicious messages, handling payment requests and reporting something odd. A few minutes each quarter works better than one long annual session.
• Test with simulated phishing emails, and use the results to teach rather than blame. We explain how in our guide to running a phishing simulation.
• Make reporting painless. Give people a single address or button, thank them for reporting, and never punish an honest mistake. A person who clicks and says so quickly saves you hours.

2. Use strong sign-in everywhere

• Turn on multi-factor authentication for email, banking, cloud storage, accounting and anything with administrator rights. The extra step defeats most stolen-password attacks, and the US cybersecurity agency CISA offers a plain explanation.
• Prefer long passphrases. NIST’s guidance on digital identity favours length over complexity and says not to force regular changes without a reason. Check passwords against lists of known breached ones where your tools allow it.
• Never reuse passwords. Give everyone a password manager so that a different strong password for every service is easy.
• Use passkeys where services offer them. They replace the password with a key held on your device.

3. Keep software up to date

Software flaws are published and exploited quickly. An unpatched system is a known opening.

• Switch on automatic updates for operating systems, browsers and business software.
• Keep a simple list of what you run, including who owns each system, so nothing is forgotten.
• Retire software that its maker no longer supports.
• Scan for known weaknesses regularly, or have a supplier do so.

4. Back up data, and test the backups

Losing all your critical data is the biggest single loss you can suffer, and ransomware is designed to cause it.

• Back up on a regular schedule, with at least one copy kept separate from your main network so malware can’t reach it.
• Test restoring from the backups twice a year, and record how long a full recovery would take.
• Make sure the backups cover cloud services such as email and shared drives, which many providers do not back up for you.

5. Secure the network and limit access

• Firewalls filter traffic in and out and should be switched on and kept updated.
• Wi-Fi. Use strong modern encryption (WPA2 at minimum, WPA3 where available), change default passwords and keep guests on a separate network.
• Least privilege. Give each person access to what they need for their job, and remove it when they change role or leave.
• Devices. Encrypt laptops and phones, require a screen lock and know how to wipe a lost device remotely.
• Physical security. Lock server rooms and unattended screens, and don’t leave paperwork with customer details on desks.

6. Check your suppliers and plan for the worst

Verizon’s 2025 breach report found that third parties were involved in 30% of breaches, double the previous year. The vendors that hold your data are part of your security.

• Ask important suppliers how they protect your data, who has access and what they will tell you if something goes wrong.
• Write a short incident plan: who decides, who to call, how to reach customers and staff, where the backups are, and who needs to be told by law. Under GDPR, for example, a breach affecting personal data generally has to be reported to the regulator within 72 hours of discovery.
• Rehearse it once with the leadership team.

When to add managed services

The six practices come first. After that, a managed detection and response service can watch your systems around the clock and act when something looks wrong, and log-collection tools can give you a clearer picture of what is happening. They make sense when you hold sensitive data, can’t watch your systems out of hours, or need to satisfy a customer or insurer. Ask any supplier what they monitor, how fast they respond and what you get to see.

Make it a routine

Security isn’t a one-off project. Put a short review in the diary every quarter: who has access, what has changed, whether the backups restore and whether staff know how to report something suspicious. If you’d like help with a first review, you can talk to us. Our guides to protecting customer data and securing remote work cover two areas many companies find hardest.