(STL.News) A Soulard bakery. Downtown law office. A dentist’s office in Clayton. The customers are different, but the problem remains the same: attackers don’t care about your size; they only care about how easy you look. According to the 2025 Data Breach Investigations Report, ransomware is now a part of 88% of small and medium businesses’ breaches. A hefty amount for a team with no IT department.

Contents

1. Start With Strong Passwords and MFA 2. Secure Your Connection Outside the Office 3. Teach Your Team to Spot Phishing 4. Update Everything, Always 5. Back Up Like You Mean It 6. Give People Only the Access They Need 7. Write a Simple Incident Response Plan 8. Consider Cyber Insurance and Outside Help Start Small, Start Today

The good news? A large number of the tips available for business owners about cybersecurity are inexpensive and easy. With that in mind, here are eight measures to help protect businesses from cyber threats, and they are easy to start with!

1. Start With Strong Passwords and MFA

Every year, “password123” can be found in lists of compromised passwords. Reused passwords are even worse – 10 doors open with one leak. Use a password manager, use long and unique passwords, and encourage passwords for your employees.

Next, add two-factor authentication. Microsoft claims to block over 99% of attacks on its accounts that use automation. Switch it on for email first, because if a thief has hijacked your email account, they will be able to reset all the rest. The next category of apps is Banking and Cloud. The next category of apps is Banking and Cloud. It only takes 10 minutes.

2. Secure Your Connection Outside the Office

Your owner checks invoices at a coffee shop on Washington Avenue. A sales rep logs in from a gate at Lambert Airport. Public Wi-Fi is handy, and it is also open ground for snoops.

A VPN wraps your traffic in encryption, so anyone listening sees scrambled noise instead of passwords and client files. VeePN, for example, offers advanced VPN applications for Windows, macOS, iOS, and Android, so a whole team stays covered on whatever device they carry. Good VPN apps run quietly in the background, which means people actually keep them switched on. Pick one tool, install it on every work device, and make it a habit.

3. Teach Your Team to Spot Phishing

The statistics from Verizon’s study indicate that 60 percent of breaches are a human problem. In just one click, even the best and costliest firewall is completely useless. In 2024, reported losses to the FBI’s Internet Crime Complaint Center (IC3) reached a staggering $16.6 billion, with many of those incidents starting with a seemingly mundane and innocuous message. Conduct a periodic training session, send out a bogus test message, and commend the person who notifies us of it.

Rule of thumb: if an email creates panic, asks for money, or wants a password, stop and call the sender.

4. Update Everything, Always

Old software is an open window. According to Verizon, approximately one out of five breaches is caused by vulnerabilities that have been exploited. Those holes are sealed by patches, but not until someone puts them in place. Enable automatic operating system, browser, point-of-sale system, and website plugin updates.

Don’t neglect routers and printers. People never consider printing. Attackers do. Replace the device if the manufacturer ceases to provide support for it.

5. Back Up Like You Mean It

Ransomware works because you need your files back. A solid backup removes that leverage. Follow the 3-2-1 rule:

Keep three copies of your data
Store them on two different types of media
Keep one copy offsite or offline

Test a restore every few months. A backup you have never opened is just a hope.

6. Give People Only the Access They Need

Do you require payroll files? Probably not. Reduce the number of logins required for each account to what is necessary for the job and delete logins the same day the person leaves. A hidden, prevalent danger is former workers who have active accounts.

Double-check visibility of files twice per year. If freelance workers or remote employees need access to your internal tools, be sure to log in via a VPN platform like VeePN, instead of logging in without one. Otherwise, your credentials could be transmitted over a home network or the public Wi-Fi of a café, leaving them completely exposed.

7. Write a Simple Incident Response Plan

If something breaks at 4:45 on a Friday, no one thinks straight. A one-page plan helps you avoid making a lot of educated guesses. It should address three questions:

Who do we call first (IT help, insurer, lawyer)?
How do we isolate infected devices?
How and when do we tell customers?

Missouri has a data breach notification law – consult with a lawyer to see if any rules apply. And print the plan. Without the network, a file on the server will be useless to anyone.

8. Consider Cyber Insurance and Outside Help

According to the 2025 Cost of a Data Breach Report by IBM, the average cost of a data breach is $4.44 million worldwide. A small company will get a smaller bill, one that may still be its death knell. Downtime and legal expenses can be covered under cyber insurance. But wait, there is an exception: insurers will usually require MFA and backups before they’ll sign.

There is also free assistance available. CISA’s cyber hygiene services are free, and a local managed IT service provider in St. Louis can perform a security audit for you if you don’t have an expert on staff.

Start Small, Start Today

You don’t need to spend a ton of money to stay safe. Select two tips from this list and complete them this week, then two more next week and so on. A good plan beats no plan, but steady progress beats a perfect plan that never leaves the drawer.

Read Technology News at STL.News