Updated on: June 29, 2026
Cybersecurity threats are becoming more frequent, more sophisticated, and more expensive for businesses of all sizes. From ransomware attacks to credential theft and internal misconfigurations, the reality is that many breaches don’t happen because of advanced hacking techniques, but because of simple, overlooked security gaps that remain unaddressed.
To better understand where businesses should focus their attention, SafetyDetectives asked cybersecurity experts a simple question: What is the most important security tip or practice every business owner should follow?
Their answers consistently point away from complex, expensive solutions and toward foundational security habits that are often ignored in day-to-day operations. From access control and account hygiene to backups and basic security discipline, the experts highlight practical steps that significantly reduce risk when applied consistently.
Below, cybersecurity professionals share their key recommendations, and why these fundamentals remain some of the most powerful defenses any business can implement.
What is the single best way to reduce the risk of ransomware attacks?
The single best way to reduce the damage from ransomware is to maintain tested, secure backups.
Ransomware locks your files and demands money to restore access. But when a business has clean backups, it can recover without depending on the attacker. Backups should be automatic, stored safely, and separated from the main system. A backup that ransomware can also encrypt is not very useful.
It is also important to test backups regularly. Many businesses only discover their backups are broken when they actually need them.
Of course, backups should be combined with MFA, employee awareness, and software updates. But if we choose one strongest defense against ransomware damage, it is this: have reliable backups before an attack happens, not after.
Vasantheeswaran R, Incident Response at Zoho
What security process should every business document and test regularly?
Every business, regardless of size, must document and regularly test a Disaster Recovery Plan (DRP), with a strong focus on data backup and restoration procedures. In today’s threat landscape, security is no longer just about building higher walls; it is about resilience. The reality is that it’s not a matter of how an organization would face a cybersecurity incident, but when. When a ransomware attack or data breach hits, confusion is the enemy.
A well-documented DRP acts as the ultimate playbook, ensuring the team knows exactly how to contain the threat and communicate efficiently under pressure. However, a plan is only as good as its last rehearsal. Organizations frequently make the mistake of assuming their backups work, only to discover corrupted data during a crisis. Regularly testing the entire restoration pipeline—rather than just checking ‘backup successful’ logs is what guarantees business continuity. Practicing these scenarios minimizes costly downtime and ensures operations can be restored with total confidence without ever paying a ransom.
Pablo Russo, CEO of Fixear – fixear.net
What is one cybersecurity mistake that is easiest to fix but often overlooked?
One of the most common and easily preventable cybersecurity mistakes is failing to enable Multi Factor Authentication (MFA) on business accounts. Many organizations still rely solely on passwords, even though compromised credentials remain one of the leading causes of security breaches. Enabling MFA adds an extra layer of protection and can significantly reduce the risk of unauthorized access with minimal cost and effort.
Yaya Waliyudini, Founder & CEO of Nexbyt Technology
What is one overlooked area of cybersecurity that deserves immediate attention from business owners?
One overlooked area of cybersecurity that deserves immediate attention from business owners is executive accountability for digital risk. Many companies still treat cybersecurity as a technical function, delegated to IT. But the real problem is broader. Business owners need to understand that information security management and cybersecurity are not the same thing, although they are connected. Information security is about protecting information as a business asset: customer data, financial records, contracts, intellectual property, employee information, strategic plans and operational knowledge, as well as information security risks within business processes. This involves governance, people, processes, suppliers, culture, legal exposure and business decisions.
Cybersecurity is about protecting the organization in cyberspace: the Internet, networks, cloud, connected identities, SaaS, e-commerce, the use of AI, digital operations and exposure to attacks. The mistake is delegating both as if they were only technical matters. A CEO, president or board member does not need to configure a firewall. But they must know which information is critical, who has the power to access it, who can approve sensitive transactions, which suppliers can stop the business, what level of risk is acceptable and how the company will respond when — not if — something goes wrong. Technology can be delegated. Accountability cannot.
The most overlooked area is not a tool, a system or a checklist. It is governance. Cybersecurity and information security must be treated as responsibilities of the owners, because when an incident becomes public, financial, legal or reputational, it is no longer an IT problem. It becomes a business leadership problem.
Jeferson D’Addario, CEO of Daryus – daryus.com.br
What is the single most effective security habit every business owner should adopt today?
Honestly? Turn on multi-factor authentication for every business account you have. Do it today. Here’s the thing: most businesses don’t get hacked by some genius in a hoodie. They get hacked because someone’s password leaked or got guessed. That’s it. MFA fixes this almost completely. Even if a criminal has your exact password, they’re stuck without your phone or authenticator app. It works.
What I love about MFA is that it doesn’t rely on you being careful every single day. We all have tired, distracted days when we might click the wrong link. MFA quietly protects you anyway. Start with your email; that’s the master key to everything else. Then move to banking, cloud storage, and accounting tools. Skip SMS codes if you can; an authenticator app is safer. And don’t stop with yourself; get your whole team on board. It’s free, takes an afternoon, and genuinely might save your business.
Amit Gorai – Founder & Director – Enterprise Business at Xploreteq
How should business owners approach third-party software and SaaS security to reduce risk?
Here’s something I see constantly: business owners assume their SaaS provider has security handled. They don’t. Read the fine print of any major SaaS contract. The provider protects the platform ,but your data? That’s on you. Accidental deletion, ransomware, recovery -none of it is covered unless you pay for an extra tier or bring in something like Druva or HYCU. We see this all the time with M365 and iManage customers who only find out when something goes wrong.
And the number of platforms people are running now makes this extremely hard to manage. Every vendor is pushing SaaS and subscriptions,which is fine. It reduces the need to maintain your own infrastructure, however your data is now spread across dozens of environments you don’t fully control or even track. Then AI came along and made it messier. Employees are pasting customer data, contracts, even source code into Claude, ChatGPT, Copilot, Gemini. These tools running on servers nowhere near your premises, with terms and conditions nobody has read. You can set guardrails, but you can’t fully stop it. And most businesses have no idea how much is already out there.
The bit that really worries me is what I call the Shadow SaaS layer. Notion, Grammarly, random AI tools someone expensed on a personal card. No central visibility, no data agreements, no oversight. So where do you start? Not with a consultant or a big security programme. Start with a 30-minute exercise. Map what tools your team actually uses, what data touches each one, and whether you have a Data Processing Agreement in place for anything handling personal information. That one audit will immediately surface your biggest risks. And then give your team one simple question to ask themselves before they paste anything into an AI tool: “Would I be comfortable if a competitor could read this?”
Visibility first. Everything else follows.
Srinath Ramachandran, Solutions Director at Constor Solutions
What is one proactive security step that can prevent the majority of common cyberattacks?
The most impactful step is to treat cybersecurity as a continuous business governance function, not just a technical or compliance exercise. While technology remains essential, the majority of cyber incidents occur because organisations have gaps across people, process, and technology, making a unified strategy critical.
From a technology perspective, organisations should continuously validate their security posture through regular penetration testing and continuous security assurance programmes such as Penetration Testing as a Service (PTaaS). These help identify vulnerabilities before threat actors can exploit them. From a process perspective, Governance, Risk and Compliance (GRC) provides the structure to embed cybersecurity into business decision-making, ensuring risks are prioritised, managed, and aligned with organisational objectives. Equally important is the people dimension, building cyber awareness, developing skilled cyber professionals, and fostering a culture where security is viewed as a shared business responsibility.
Cybersecurity leadership is also evolving. Today’s CISOs and security leaders are expected to move beyond managing controls and regulatory compliance to becoming business enablers who guide digital transformation, AI adoption, resilience, and enterprise risk safely and widely. This shift requires governance models that balance innovation with security, rather than treating them as competing priorities.
Across Singapore and Southeast Asia, many organisations have invested in cyber whether big or small, but the next stage of cyber maturity is integrating governance, continuous assurance, and talent into a single operating model. Organisations that unify people, process, and technology under strong business governance will not only reduce the likelihood of common cyberattacks but also build sustainable cyber resilience strategy and greater business confidence in an increasingly digital economy.
Victor Lim, Regional Director at SoftScheck – softscheck-apac.com
What is the biggest blind spot organizations have when assessing their cybersecurity risk?
Most organizations evaluate their security posture from an internal perspective, focusing on patch management, endpoint protection, and compliance requirements. However, attackers rarely have this privileged view. Their reconnaissance activities begin by analyzing only what is externally exposed. One of the biggest blind spots is the lack of continuous External Attack Surface Management (EASM). Organizations should regularly identify and monitor internet-facing assets, including forgotten subdomains, publicly accessible development environments, misconfigured cloud storage, abandoned SaaS instances, legacy applications, and exposed administrative interfaces.
During incident response engagements and security assessments, it is not uncommon to find that the initial access vector was not a sophisticated zero-day vulnerability, but rather an unmanaged asset that the organization itself was unaware of and had failed to include in its inventory. Companies should not only ask themselves “Are our systems patched?” but also “Can we accurately enumerate every asset an attacker can discover about us today?”. If the answer is no, the organization is likely operating with a level of risk it does not fully understand.
What is one practical step businesses should take to prepare for the rise of AI-powered cyber threats?
The single most important step businesses can take to prepare for AI-powered cyber threats is to shift from a reactive to a proactive security posture and that starts with implementing continuous threat monitoring combined with AI-assisted anomaly detection. For decades, cybersecurity has operated on a fundamentally reactive model: build walls, wait for an alarm, then respond. That approach is dangerously inadequate against AI-powered attacks. Adversarial AI can now generate polymorphic malware that mutates its own code to evade signature-based detection, launch hyper-personalized phishing campaigns at a scale no human team could produce, and autonomously probe networks for vulnerabilities faster than any traditional scanner. By the time a conventional alert fires, the damage is often already done.
Proactive security flips that dynamic. Rather than relying on known threat signatures, AI-driven monitoring tools establish a behavioral baseline for every user, device, and system on the network and flag deviations in real time. An employee account suddenly downloading gigabytes of data at 2 a.m., a device communicating with an unusual external server, a login from a geography that doesn’t match any prior pattern, these are the signals that precede a breach, and they’re invisible to legacy tools. Businesses that deploy this layer of intelligence aren’t just better at catching attacks; they’re catching them before they escalate.
Beyond technology, this shift also requires organizations to conduct regular AI-specific threat modeling asking not just “what are today’s attack vectors?” but “how would an AI-powered adversary target us specifically?” That kind of forward-looking thinking, paired with the right tooling, is what separates businesses that survive the next wave of cyber threats from those that become headlines.
Ernest-Bright Connings, Founder of Cybanext Technologies – cybanext.com
What incident response capability should every organization implement before experiencing a security breach?
Most cybersecurity investments are focused on preventive technologies, while forensic preparedness is often overlooked. However, the effectiveness of an incident investigation largely depends on the quality, integrity, and availability of the evidence collected before a compromise occurs. Organizations should adopt a Forensic Readiness strategy supported by a formally documented and regularly tested Incident Response Plan (IRP). An effective IRP should go beyond being a static document and clearly define procedures for detection, analysis, containment, eradication, and recovery, as well as the roles and responsibilities of technical, legal, executive, and communications teams. In addition, companies should ensure the centralized collection and preservation of authentication events, endpoint telemetry, network logs, cloud audit trails, and privileged activity records. These logs should be retained according to the organization’s risk profile, protected against tampering, and synchronized through reliable time sources.
Validating the IRP through tabletop exercises, ransomware simulations, and privileged account compromise scenarios helps organizations identify operational gaps before a real incident occurs. When an intrusion takes place, the critical questions quickly shift from “How did the attacker get in?” to “What assets were compromised?”, “What data was accessed or exfiltrated?”, “What persistence mechanisms were established?”, and “Can we reconstruct the complete attack timeline?”. Without an adequate forensic readiness strategy and a periodically validated IRP, containment and eradication decisions are often based on assumptions rather than evidence, significantly increasing the likelihood of reinfection, regulatory impact, and financial losses.
Manuel Martínez, Security Researcher and Cybersecurity Consultant
What is the one thing business owners should check regularly to avoid security breaches?
The one most important thing business owners should check regularly is their user access and administrative privileges. This practice is not just a recommendation; it is the fundamental cornerstone of implementing the Principle of Least Privilege (PoLP). PoLP dictates that every user, program, or process should be granted only the essential permissions needed to perform its required task—and nothing more. This systematic approach forms a critical layer in a strong defense-in-depth security strategy.
Statistics consistently show that a significant percentage of internal and external data breaches involve privilege misuse or misconfiguration. This vulnerability often arises when business owners onboard new staff, integrate third-party services, or collaborate with external contractors. In the rush of daily operations, roles are assigned that unintentionally grant excessive power, frequently culminating in unnecessary Administrator rights across core systems.
If an account possessing broad, high-level permissions is compromised—whether through a phishing attack, weak password, or a zero-day exploit—or simply misused accidentally by a fatigued employee, the resulting damage is vastly amplified. The potential for large-scale data theft, catastrophic system damage, or a major regulatory breach increases dramatically when lateral movement across the network is unchecked by granular access controls.
Therefore, establishing a routine of regularly checking and auditing all user accounts is non-negotiable. This process ensures that every employee, contractor, or automated service operates with the absolute minimum access required to perform their specific duties, thereby drastically reducing the organization’s overall attack surface.
Key components of this essential security audit include:
- Systematic Role Review: Reviewing user roles and permission levels within all critical content management systems, enterprise applications, and cloud environments to ensure no one holds unnecessary, high-level permissions or accumulated legacy access from past roles.
- Proactive Onboarding and Off-boarding: Establishing and strictly following protocols for the immediate and systematic revocation of access for temporary users, contractors, or former employees the moment their duties conclude.
- Segregation of Duties: Confirming that administrative privileges are strictly limited and segregated among essential IT and security staff, and that all standard employee accounts are never granted elevated rights. Furthermore, implement multi-factor authentication (MFA) for all accounts, especially those with privileged access, to provide an extra layer of protection against credential compromise.
By meticulously limiting access to only what is vital to each role and function, business owners significantly reduce the risk of both internal human error and external malicious compromise. This single, proactive, and regular check on privilege management is the foundational element required to prevent small, common security lapses from escalating into devastating and costly major security breaches.
Irumva Yves Ngabonziza, Chief Engineer at ITS Ltd – itsltd.online
If you had to eliminate one common security weakness found in most companies, what would it be?
The unglamorous answer: people having access to far more than they need to do their job. Every CEO wants to talk about ransomware and AI-powered attacks. Meanwhile, half the company can open the shared drive where someone saved the payroll spreadsheet two years ago.
Here’s the pattern I see again and again. Someone’s credentials get compromised. A dodgy link, a reused password, a leak from a service they signed up to in 2019. On its own, that’s a manageable incident. The damage comes from what that account can touch. The attacker logs in, has a poke around, and discovers they’ve effectively been handed a master key: finance, customer records, shared drives full of contracts, an old admin panel nobody remembered existed. A small problem becomes a very bad week, and sometimes a very bad year.
The fix isn’t expensive or clever. Access should match the job, and only the job. When someone changes roles, the old access comes off. When someone leaves, it’s gone the same day, not next quarter when someone gets around to it. Every few months, a human being needs to actually look at who can reach what and ask whether it still makes sense. Pair that with multi-factor authentication on everything, and you’ve taken most of the teeth out of an attack before it starts.
At Affinity MSP, this is the first thing we look at when a new client comes on board, and it’s almost always the quickest win. The question I’d put to any business owner is this: if one of our team members had their account compromised tomorrow, what could someone reach with it? If the honest answer makes you wince, that’s your starting point. You don’t need a bigger budget. You need a tidy-up.
Nick Ower, Founder & CEO of Affinity MSP
What is the most practical way for non-technical business owners to improve their security quickly?
The most practical way is to focus on simple security basics that block common attacks. Start with multi-factor authentication, a password manager, software updates, and regular backups.
Business owners do not need to understand complex cybersecurity tools to begin. They should first protect the accounts that matter most, such as email, banking, cloud storage, website admin panels, and social media. Turning on MFA adds an extra layer of protection even if a password is stolen.
Next, use a password manager so every account has a strong and unique password. Also, keep devices, apps, plugins, and business software updated. Many attacks happen because old software is left unpatched.
In simple words, start with the basics and make them consistent. Good security is not about doing everything at once. It is about closing the easiest doors attackers use.
Cyber Edition – thecyberedition.com
What is the most impactful first step a small business should take to improve its cybersecurity posture?
For small businesses in the region, the most effective first step is not to purchase individual security products, but to decide where and how to deploy the infrastructure. Everything else depends on this choice: resilience, recovery from attacks, and regulatory compliance.
The reality is this: it is practically impossible for an SMB to build a comprehensive cybersecurity framework in-house. This would require your own server room, a team of administrators, individual information security specialists, round-the-clock monitoring, and security licenses. For a company of 30-100 people, such costs are not economically justified, and most importantly, they do not deliver the necessary quality. Cyberattacks today occur 24/7 and are highly automated, while small businesses often have only one or two IT specialists to manage their security.
Therefore, the practical first step is to migrate production systems to an enterprise-grade cloud provider and consume security services as a service. The minimum required set typically includes the following: backups with mandatory immutable storage are the only working protection against ransomware today as attackers usually target backups first. The next layer is MFA on all privileged and remote access, account management, and basic password hygiene. It is not expensive and can stop most of the mass attacks.
A separate use case involves functions that require 24/7 operation, such as incident monitoring, analysis of attacks on web applications, and DDoS filtering. It is not economically viable to maintain your own shift in a company for 50 people. The working model for SMB is to take SOC, WAF, and Anti-DDoS as a managed service from a provider and focus internal resources on product-related tasks.
The key point is that all these functions must be interconnected and work as a single service under the provider’s SLA. This gives the business a clear area of responsibility that it can actually control, and a reliable partner who takes care of the rest.
Nikolai Lushnikov, General manager at ITGLOBAL.COM
What AI‑driven cybersecurity threat should business owners be paying the most attention to right now?
AI‑powered social engineering has become the most dangerous and underestimated threat facing businesses today. What used to be easy‑to‑spot phishing attempts have evolved into highly convincing, context‑aware attacks generated by large language models that can mimic writing styles, reference real internal information, and adapt instantly to a target’s behaviour. These attacks no longer look like “spam” —-they look like a message from your CFO, a supplier, or even a colleague asking for a quick favour.
The real risk is scale. Attackers can now generate thousands of personalised messages in seconds, each tailored to bypass human intuition and traditional security filters. This means the weakest point in a company’s defences is no longer its infrastructure – it’s the moment an employee receives a message that feels legitimate enough to trust.
Business owners need to recognise that AI has shifted the threat landscape from broad, generic attacks to precision‑crafted psychological manipulation. The most effective defence is a combination of real‑time message analysis, automated threat scoring, and continuous user awareness – tools that can keep up with the speed and sophistication of AI‑generated attacks.
This is exactly why we built Excelitte. Our platform includes an AI Phishing Message Scanner, an AI Robotic Penetration Tester, and a new Browser Extension that automatically scans every URL and file a user interacts with. It gives businesses an always‑on, AI‑powered safety layer designed for the threats of today – not the threats of five years ago.
Trevor Dominic, Application Support Lead & Solutions Architect at Temsconsu
If you could recommend one compliance-focused step that would significantly reduce cybersecurity risk for most businesses, what would it be?
If businesses conducted regular access reviews to ensure that only appropriate personnel have access to the right data inside their organization, they would significantly reduce their cybersecurity risk. Many tools like ComplyJet make this process much more efficient, which helps in adhering to the discipline of periodic access reviews.
Upendra Varma, CTO at ComplyJet – www.complyjet.com
What is the best defence against ransomware attacks?
When organizations discuss ransomware protection, the conversation often revolves around firewalls, antivirus solutions, artificial intelligence, and the latest cybersecurity tools. While these technologies are important, they miss a fundamental truth:
The single best defence against ransomware is not technology—it’s preparedness. Ransomware succeeds because organizations assume they won’t be the next victim. Cybercriminals understand this mind-set and exploit gaps in planning, governance, and response readiness rather than merely technical vulnerabilities.
An organization can have world-class security tools and still fall victim to a phishing email, a compromised credential, or a software vulnerability. What separates resilient organizations from the rest is their ability to continue operating when prevention fails. Preparedness means knowing what data is critical, maintaining tested backup and recovery processes, establishing incident response procedures, defining decision-making authority, and regularly conducting cyber crisis simulations. It means ensuring that employees, leadership teams, IT departments, legal advisors, and insurers know exactly what to do during the first few hours of an attack.
The reality is that ransomware is no longer just a technology problem; it is a business continuity risk. Organizations that focus solely on preventing attacks often overlook their ability to recover from them. In cyber risk management, success should not be measured by the absence of incidents but by the ability to withstand and recover from them. The most resilient organizations understand that while technology can reduce risk, preparedness determines survival. The question is no longer, “Can we prevent ransomware?” The real question is, “How quickly can we recover when it happens?”
Dr K. Madhavan, Principal Consultant at RYSKMEN Cyber Consulting Services