An SME can have tidy dashboards and still be exposed for one very simple reason: real work lives in workarounds. The sales rep who shares a login because it is faster. The finance lead who unlocks access over WhatsApp. The technician who runs a backup “just in case” and never tests a restore. It all looks efficient until the day it becomes an incident.
The useful question is not whether your company “has cybersecurity”, but whether it can keep operating when an account, a laptop or a backup fails.
October, with European Cybersecurity Month, is a good moment to stop speaking in generalities and check four controls an SME can review this week. You do not need a large transformation programme; you need one uncomfortable conversation, one practical technical check and one clear decision about who acts when something breaks. ENISA describes the campaign as the EU’s annual initiative to promote cybersecurity among citizens and organisations. (enisa.europa.eu)
The real problem is usually friction, not technology
In many companies, the biggest risk is not a sophisticated attack but everyday exceptions. The temporary access that became permanent. The shared password for “just one portal”. The external supplier who still has privileges long after the project ended. These are small decisions made to avoid slowing people down, yet they leave a very real operational gap.
There is a practical lesson here: if a security measure forces too many detours, people will route around it. That is why it helps to start with the control that touches daily work, not the prettiest one. October is useful because it puts a spotlight on the places where security and productivity collide every day.
Four checks that change daily work
The first is who has access and whether that access still makes sense. It is not enough to know how many accounts exist; you need to know how many remain active out of habit. Review joins, leavers and third-party access. If someone changes role, do their permissions change, or do exceptions simply keep piling up?
The second is MFA, multi-factor authentication. MFA means asking for more than one proof of identity, such as a password and a phone app. It is not perfect, but it greatly reduces the impact of a stolen password. The practical test is not “do we have MFA?” but “where is it active, and where can someone still walk in with one key only?”
The third is backup, but not as a ritual. A backup that cannot be restored is a promise, not protection. The honest test is simple: recover a file, a folder or an account in a test environment and measure how long it takes. That recovery time tells you more than any continuity slide deck.
The fourth is response. Who decides to disable an account? Who tells the team? Who contacts the supplier? If response depends on one specific person and not on a minimal procedure, the company does not have a plan; it has luck.
A small scenario: when a shortcut becomes a cost
Imagine a distribution company with twenty employees. Sales uses a shared login for the customer portal because it feels simpler. Finance receives invoices by email and stores them in a shared folder. IT, internal or external, runs nightly backups, but nobody has asked for a restore test in two years.
On a Monday, one email account is compromised. The problem is not just the mailbox: the attacker reaches the shared folder, forwards invoices and triggers a chain of internal calls. The financial damage does not come from one breach alone; it comes from several decisions that felt harmless. That is the uncomfortable lesson: security often fails at the points where the business chose not to interrupt itself.
The uncomfortable trade-off: less convenience now, less chaos later
This is where resistance usually appears. “If we remove shared access, the team will lose speed.” “If we force a test restore, we will waste time.” “If we close old privileges, someone will get locked out.” All of that may be true. The question is whether you prefer a controlled inconvenience now or a disorderly interruption later.
The goal is not to turn the company into a bunker. It is to draw boundaries where improvised work has become the norm. A good policy is not one nobody argues with; it is one the team can actually follow on a messy Tuesday.
A small experiment for this week
Instead of launching a big project, try this for seven days:
- Pick one critical service and review all active access.
- Enable or verify MFA on the most privileged accounts.
- Restore one file or folder from backup and time the process.
- Write down, on one page, who decides and who communicates if an incident happens.
If those four steps create surprise, you now have a reliable map of where the risk sits. If they do not, even better: you may already have a solid base to build on.
The real question is not whether your SME can afford an hour for this. It is whether it can afford not to. At Codefuente, we usually start with these small tests because they reveal far more than an abstract audit.
Three actions for this week: review access for one critical service, test one real restore, and name the person who would make the first decision if an incident happened tomorrow.