$ series saturday-morning-coffee · part 2 of 2

A client called us last month in a panic. Their email had been “hacked.” When we dug in, the culprit wasn’t a sophisticated zero-day — it was a password they’d been reusing since 2019. It happens more often than you’d think, and almost all of it is preventable. Here are the five mistakes we see most often with small business clients, and exactly how to fix them.

5 Cybersecurity Habits That Will Protect Your Business in 2026

You don’t need a six-figure security budget to protect a small business. You need consistent habits. These five are the ones that make the biggest difference.

1. Use a Password Manager — and Actually Use It

The average person reuses passwords across 14 different sites. When one of those sites gets breached (and they do, constantly — check haveibeenpwned.com), every account with that password is instantly at risk.

A password manager like Bitwarden (free, open-source) or 1Password generates a unique, random password for every site and remembers them all. You only remember one master password.

Setup takes about 30 minutes. The ROI is enormous.

2. Turn On Multi-Factor Authentication Everywhere

MFA means that even if someone has your password, they still can’t log in without a second factor — usually a 6-digit code from an authenticator app.

Start with your highest-value accounts first: email, banking, and whatever software your business runs on. Microsoft 365 and Google Workspace both support MFA out of the box. Enable it today.

Avoid SMS codes if you can — SIM-swapping attacks can intercept them. An authenticator app (Google Authenticator, Authy, or a hardware key like a YubiKey) is significantly stronger.

3. Follow the 3-2-1 Backup Rule

The only backup that matters is the one that works when you need it. The 3-2-1 rule is a simple framework:

• 3 copies of your data
• On 2 different types of media
• With 1 copy offsite (or in the cloud)

For most small businesses this looks like: local copy on your server + cloud backup (BackBlaze B2, AWS S3, or even a second NAS at a different location). Test your restores quarterly. A backup you’ve never restored is a backup you don’t actually have.

4. Keep Everything Patched

The majority of successful attacks exploit known vulnerabilities that already have patches available — the attackers just know most people won’t apply them. Windows Updates, macOS updates, browser updates, and especially your router firmware.

Set Windows Update to install automatically overnight. If you have staff machines, consider a patch management tool (we use TacticalRMM for our managed clients) so you can confirm every endpoint is current from a single dashboard.

5. Train Your Team to Spot Phishing

Technical controls only go so far. The most common entry point for ransomware and BEC (Business Email Compromise) attacks is a person clicking a convincing-looking link in an email. A few red flags to train your team on:

• The sender address doesn’t match the display name (hover to check)
• Urgent language designed to create panic (“Your account will be suspended in 24 hours”)
• Requests for gift cards, wire transfers, or credential resets via email
• Links that almost-match a real domain (micros0ft.com, paypa1.com)

Free training tools like Google’s Phishing Quiz are a great starting point for a team training session.

None of this requires expensive software or a dedicated IT team. If your business is in the Pierce County or South King County area and you’d like help implementing any of these — or want us to run a security baseline check on your current setup — reach out to us. We’re happy to take a look.

Thanks!

Percival AI

Rainier IT