5 most common IT security mistakes companies make (and how to avoid them)

Small and medium-sized businesses are often considered an “uninteresting target” for cyberattacks. After all, they don’t have million-euro turnovers or extensive databases. The reality, however, is different: attackers choose these companies precisely because they are much easier to attack.

Why companies are vulnerable:

• They do not have their own IT department or a cybersecurity specialist
• They use cheap or outdated solutions, often without basic protection
• Employees are usually not trained to recognize risky situations
• Security is not part of the company culture, but a “technical topic for someone else”

However, cybersecurity is not just about budget or technology—it is primarily a matter of discipline, responsibility, and healthy habits. Even a company without a specialist can do a lot simply by having clarity about basic rules.

Practical tip: Try asking yourself a simple question: “If someone deleted all our data today or blocked access to our account—would we know what to do?”
If the answer is not clear, the article you are reading will help you get started.

1. Weak, reused, or shared passwords

Passwords are often the first—and at the same time the only—barrier between an attacker and your company data. Despite this, in many companies we still encounter practices such as:

• using simple passwords like “Firma2023” or “admin123”,
• using the same password for multiple services (email, CRM, invoicing system),
• sharing login credentials among colleagues, often without control.

Why this is a problem:

• Simple passwords can be cracked in a few seconds using automated tools.
• If one password leaks (e.g., through a breach of another service), the attacker gains access to all systems.
• Shared accounts make it impossible to trace who did what—and in the event of an incident, you don’t know where to look for the problem.

What to do about it:

• Introduce unique passwords for each user and each service.
• Use a password manager that securely stores access credentials (e.g., Bitwarden, KeePass, 1Password).
• Enable two-factor authentication (MFA), especially for email, cloud tools, and system access.

Practical tip: If you don’t know where to start, choose one key account (e.g., email or invoicing system) and enable two-factor authentication on it today. It takes just a few minutes, but it can prevent a serious problem.

2. Ignoring software and operating system updates

Updates are often perceived as annoying pop-up windows that interrupt work. In reality, however, they represent a critical element of cyber defense. Many attacks exploit vulnerabilities that were fixed long ago—companies just didn’t install the patches.

Most common issues:

• Postponed updates, especially on work computers and servers
• Use of outdated software versions that are no longer supported (e.g., Windows 7, old versions of accounting software)
• Lack of responsibility—no one in the company tracks what is updated and what is not

Why this is dangerous:

• Every unpatched application or system contains known vulnerabilities that attackers actively search for
• A breach through unpatched software is often a matter of seconds, not days

How to address it simply:

• Enable automatic updates in Windows, Office, browsers, and antivirus software
• Regularly (e.g., once a month) check whether key tools are up to date
• Assign a person or an external partner who will have clear responsibility for updates

Practical tip: Create a simple monthly checklist—for example, reserve 15 minutes on the last Friday of the month to check updates on key devices and applications. Such a small step can make the company significantly more secure.

3. Insufficient or missing data backups

Backups are one of those things many people realize the importance of only when it’s too late. And at that point, the backup either doesn’t exist or doesn’t work. Whether it’s a ransomware attack, a technical failure, or a simple human error, the loss of company data can paralyze a business.

Typical mistakes:

• Backups are not done at all—it’s just assumed that “it works”
• Backups are done only occasionally, manually, and without verification
• Backups are stored on the same device or disk that is exposed to the same risk as the original data

Why this is risky:

• Without a functional backup, a company can lose invoicing data, contracts, documentation, or correspondence
• Recovery from an incident without backups can mean weeks of downtime—or even the end of the business

How to back up correctly:

• Follow the 3-2-1 rule:
  3 copies of data, on 2 different media, 1 outside the working environment (e.g., in the cloud or on an external drive outside the company)
• Back up regularly—ideally daily or at least weekly, depending on data sensitivity
• Once a month, test a restore—to be sure the backup is not just a “dead file”

Practical tip: Have automatic backups set up in your company—even simple cloud solutions today offer scheduling, encryption, and alerts for failed backups. A custom solution can also be prepared by an external IT partner without high costs.

4. Weak access control and “open” access to sensitive data

In many companies, there is an unwritten rule: everyone has access to everything—because it’s easier. Systems, documents, and shared drives are accessible to anyone who is logged in. Shared login credentials and the absence of controls, however, open the door to errors and abuse.

Common mistakes in practice:

• Shared accounts without individual access rights—no one knows who did what
• Access to all data even for employees who do not need it
• Missing records and control of access rights—no one knows who has access to what and why
• Forgotten access after an employee leaves—a former colleague still has access to email, cloud services, or internal systems

What you are risking:

• Data leakage—unintentional (copying, sharing) or intentional (retaliation after termination)
• Accidental deletion or modification of important documents
• Violation of legal obligations in the area of personal data protection (e.g., GDPR)

How to improve the situation:

• Introduce the principle of least privilege—everyone has access only to what they truly need
• Maintain records of access rights—who has access to what and on what basis
• Set up a process for revoking access when an employee leaves—ideally within 24 hours

Practical tip: Once a quarter, perform an internal “access audit”—review the list of employees, their permissions, and verify whether they are still justified. You will often find that many people have access to things they no longer need.

5. Underestimating employee training

Technology can be top-notch, but if a single careless click on a fake email is enough, the entire security setup collapses. That is precisely why employees are often the weakest, yet at the same time the most important, link in the cybersecurity chain.

What is usually the problem:

• Most people don’t know what phishing, spoofing, or a malicious attachment looks like
• Training is not done at all, or only as a formal obligation
• Without reminders, even learned things are quickly forgotten

What risks arise from this:

• Clicking on a fraudulent link can open the door to ransomware or data leakage
• Employees may unknowingly hand over login credentials on a fake login page
• The company loses trust and may face legal and financial consequences

How to conduct effective training:

• Run short and practical trainings—ideally 2–4 times a year
• Work with real examples of fraudulent emails—even from your own company
• Organize simulated phishing tests—to help people get used to thinking before clicking
• Create a simple internal procedure for reporting a suspicious email or incident

Practical tip: Take 2–3 fraudulent emails that you have received in the past, anonymize them, and use them as a test at the next company meeting. It’s not about control, but prevention—and it works better than any e-learning.

Cybersecurity is not just about technology, but mainly about everyday habits and a healthy setup within the company. Even without large budgets, a small or medium-sized business can significantly reduce its risk—if it avoids the most common mistakes and implements simple measures.

What not to forget:

• Strong and unique passwords, not “admin2023”
• Regular updates, even if they “interrupt work”
• Backups outside the work computer
• Access only for those who truly need it
• Employees as an active part of security, not a weakness

Challenge: Try to go through these 5 points in your company over the next month—and establish a basic security “order.” Sometimes one day is enough to prevent problems that would otherwise cost you thousands.