In this article, we covered some of the big cybersecurity risks that businesses should be aware of, focusing mostly on new AI threats. There is, however, one major threat that didn’t fit into that article but still needs to be covered. Ask a cybersecurity expert in private and they’ll tell you the biggest cybersecurity risk to any business is an employee who doesn’t know what they’re doing: they’re clicking on suspicious links in emails, responding to texts from unknown senders, downloading attachments they weren’t expecting to receive, reusing old passwords, failing to setup 2FA, sharing sensitive information with a chatbot, or deploying AI agents without strict limitations on access, all without understanding the consequences.
While naïve or careless users will exasperate your IT department, the problem here isn’t necessarily the people. These are all process problems. Hacking is easier today than it’s ever been, but keeping up with cybersecurity threats is a full-time job. When an IT department is already working at full capacity, staying on top of every new threat becomes nearly impossible. But it’s not all on IT to do it alone. It’s the responsibility of small business owners to educate employees and develop processes that keep their businesses safe.
Develop Cybersecurity Processes
Don’t leave employees to their own devices when it comes to their devices. Set up guidelines specifying on which devices they can access business accounts and how they can access those accounts. That means asking employees to not reuse old passwords and to set up multi-factor authentication on all of their accounts. Logging in safely is much easier if you give them access to a tool like Bitwarden or LastPass.
Next, develop processes for dealing with common email occurrences. What do you do when a client asks for access to a Google Doc? What about when someone sends you an attachment? What is the process for when an employee emails HR asking to have their paycheck sent to a different bank account? These processes should be documented so that every employee can confirm that they are familiar with them.
These processes need to be documented because threats aren’t always obvious. That client asking for access to a document might have been hacked, and if you grant them access, you’ve given hackers access to your file system. That PDF that looks like an invoice or service you never purchased may contain a Trojan that steals password data from your computer or ransomware that takes control of a device, promising to give access back if a ransom is paid. That employee asking to change their bank account could be a scammer trying to steal an employee’s paycheck.
We’ve actually seen that attempt recently, but we have a process in place for dealing with these requests that involves contacting the employee through a different channel. If it had been the employee who requested the change, they would be given instructions on how to do it themselves. But the employee had not requested the change, and the process kept us from getting scammed.
Ask your employees to document these occurrences. Make the rest of the team aware of these kinds of emails and develop a process for reporting them and determining their legitimacy. It feels like a lot of extra work, but giving cybersecurity this kind of time and attention helps employees recognize and avoid threats.
Educate Your Team
New and increasingly sophisticated threats emerge every day, so it’s important to keep employees educated. Designate someone in your organization to be responsible for staying on top of the latest threats and educating employees on how to avoid being the victim of an attack. Hackers will never stop trying to find a way into your systems and accounts. Your best defense is education and constant vigilance. What’s important in documenting these threats and educating your team is not so much knowledge of the specifics of the threats themselves but the reinforcement of a certain posture of vigilance and wariness in digital communication.
Cybersecurity Is a Growing Cost, But Hacks Could Cost You Everything
Cybersecurity is one of the fastest growing business costs. Both the number and sophistication of scams and hacks are increasing, and insurance costs are soaring with them. Ignoring cybersecurity could end up costing much more. Develop processes for handling digital communication that keep your employees vigilant even if they’re not so digitally savvy. While you will have employees fall for a phishing scam every now and then, it is often the case that security breaches are not caused by carelessness but by a lack of a documented process for securing accounts and communicating online safely.
People often do the wrong thing not because they’re stupid or have bad intentions but because the right thing is unintuitive, more work than they have time for, or outside of their current understanding. Well-designed processes remove the friction from doing things the right way. It’s another instance of something we say often at the WeRX brands: solve the processes, and you solve the people.
