Sure, AI threats make all the recent headlines, but the foundation of small business cybersecurity remains consistent: protect accounts with good passwords and 2FA, maintain computers and networks with the latest software updates, verify unusual requests, and keep recoverable backups.
Yup. The more things change, the more they stay the same.
Now, what we can say is the bad guys are using AI to launch more convincing attacks. The FBI warns that criminals use AI to make phishing messages and voice impersonations more convincing. For a small office, one successful scam can interrupt payroll, expose client records, or derail a week’s work.
Here are five best-practices to reduce risk (they work in the age of AI, too!).
1. Protect and secure every business login.
Yeah, you’ve heard this before. Use unique passwords for every website stored in a business password manager, and require multifactor authentication for email, cloud files, and remote access. MFA adds another check beyond a password, making stolen passwords less useful. When you can, choose phishing-resistant options such as security keys. Give employees access only to what their jobs require, and remove accounts promptly when someone leaves. CISA’s MFA guidance explains why that extra protection matters.
2. Keep computers and network equipment updated
Security updates close known holes attackers can exploit, whether they use AI or not. Include laptops, browsers, business applications, firewalls, and Wi-Fi equipment in your maintenance schedule. Assign someone (or hire someone) to confirm updates are actually installing, including on laptops used away from the office. Schedule restarts and replace equipment that no longer receives security fixes. Postponing maintenance indefinitely leaves avoidable openings.
3. Maintain protection across your network
Use business-grade security software on every work computer, maintain your firewall, and enable email filtering. Keep guest Wi-Fi separate from business systems, and have your IT provider review unnecessary remote access configs. Someone also should also be around to review security alerts and respond (rather than just ignore them). Protection that is installed but ignored can leave a problem unnoticed while it spreads. These controls support the layered approach described in CISA’s ransomware prevention guidance.
4. Teach employees to verify unusual requests
Perfect spelling no longer makes an email trustworthy. Train staff to pause when messages request passwords, urgent payments, or changes to banking information, even when the sender seems familiar. Confirm sensitive requests through a known phone number, not contact details supplied in the message. Require a second person’s approval for banking changes, and make reporting suspicious messages easy and blame-free.
5. Back up important data—and test recovery
Automate backups of essential business files, including cloud data where needed. Keep a protected copy that an attacker cannot easily alter or delete. Cool. Then test restoring it. A successful backup notification does not prove you can recover payroll records before payday. CISA recommends protected backups and regular recovery testing.
Make the basics dependable
I feel we should access we can’t stop every attack,, but we can make your business harder to disrupt.
If you’re in Vancouver, WA or Portland, OR, contact Mickler & Associates, Inc. for practical help with cybersecurity, professional IT support, Microsoft 365, cloud services, or managed IT. We’ll help you identify where your everyday defenses might need a little TLC.
R
