Key Takeaways
- Most breaches exploit basic gaps, not advanced hacking.
- Fewer than half of UK businesses require MFA.
- Only one in four has an incident response plan.
- Every mistake on this list has a low-cost fix.
- A 30-day plan can close most gaps quickly.
For the full picture, read our guide to cyber security essentials for Hertfordshire small businesses.
The most common cyber security mistakes are basic ones. SMEs skip multi-factor authentication, delay updates and reuse passwords. They also leave backups untested and train staff too rarely. Many have no plan for when things go wrong. The good news is that each one is easy to fix. Most fixes cost little and take days, not months.
Why Do Small Businesses Keep Making These Mistakes?
Most SMEs don’t have an in-house IT team. Security gets pushed down the to-do list.
The numbers show the gap clearly. Only 5% of UK businesses hold Cyber Essentials. Just 24% have all five of its technical controls in place.
Meanwhile, the risk hasn’t gone away. Some 43% of UK businesses reported a breach or attack in the past year.
What Are the 8 Biggest Cyber Security Mistakes?
1. Not Using Multi-Factor Authentication
MFA adds a second check, like a code on your phone. Only 47% of businesses currently require it.
Fix: Turn on MFA for email, Microsoft 365 and every cloud app. Start with admin accounts.
2. Putting Off Software Updates
Every delayed update leaves a known hole open. Attackers scan for these gaps automatically.
Fix: Switch on automatic updates. Install critical patches within 14 days.
3. Reusing Weak Passwords
One leaked password can unlock several accounts. This is called credential stuffing.
Fix: Use a business password manager. Create long, unique passphrases for every account.
4. Never Testing Backups
A backup you can’t restore isn’t a backup. Many firms find out too late.
Fix: Keep one copy separate from your network. Test a full restore every quarter.
5. Training Staff Once and Forgetting
Phishing hit 38% of businesses and was rated the most disruptive attack. Staff are the main target.
Fix: Run short training sessions twice a year. Add simulated phishing tests in between.
6. Having No Incident Response Plan
Only 25% of businesses have a formal plan. Among micro businesses, it’s just 21%.
Fix: Write a one-page plan. List who decides, who to call and where backups are.
7. Ignoring Supplier Risk
Your suppliers can be your weakest link. Only 15% of businesses review risks from immediate suppliers.
Fix: Ask key suppliers about their security. Check whether they hold Cyber Essentials.
8. Thinking “We’re Too Small to Be Targeted”
Attackers use automated tools that look for any weak target. Size gives no protection.
Fix: Treat security as a business risk. Book a professional review at least once a year.
Quick Reference: Mistakes, Risks and Fixes
| Mistake | Main risk | Quick fix |
| No MFA | Account takeover | Enable MFA everywhere |
| Delayed updates | Known exploits | Auto-updates, 14-day patching |
| Reused passwords | Multiple accounts breached | Password manager |
| Untested backups | Permanent data loss | Quarterly restore tests |
| Rare training | Phishing success | Twice-yearly training |
| No response plan | Slow, costly recovery | One-page plan |
| Supplier blind spots | Invoice fraud, data leaks | Supplier security checks |
| “Too small” mindset | No defences at all | Annual security review |
How Can You Fix These Mistakes in 30 Days?
- Week 1: Enable MFA and set up a password manager.
- Week 2: Turn on automatic updates on every device.
- Week 3: Test a backup restore and write your response plan.
- Week 4: Run staff training and contact key suppliers.
Need help? Digit IT’s cyber security services cover every step for Hertfordshire businesses.
A Real-World Example
A Watford building supplier received an email from a “regular supplier”. It asked them to update bank details for future payments. The supplier’s email account had been hacked. Luckily, the finance manager phoned to check first. That one call saved an £8,000 payment. Afterwards, the firm made phone verification a standard rule.
Frequently Asked Questions
1. What is the most common cyber security mistake?
Not using multi-factor authentication. It’s simple to set up but still widely skipped.
2. How often should small businesses update software?
Enable automatic updates. Critical patches should be installed within 14 days.
3. Do small businesses need an incident response plan?
Yes. A one-page plan helps you act fast and limit damage.
4. Are password managers safe for business use?
Yes, when protected by MFA. They’re far safer than reused passwords.
5. How can I check if my suppliers are secure?
Ask about their security measures. Cyber Essentials certification is a good sign.
6. How much does fixing these mistakes cost?
Many fixes are free or low-cost. Managed support usually costs a monthly per-user fee.
