Security tips for small teams in 2026: passkeys, MFA, backups and AI-era phishing

Two things changed the security picture for small organisations in the last two years. Attackers use AI to write convincing messages, clone voices and automate the boring parts of a break-in. And the defences that actually stop them — passkeys, phishing-resistant multi-factor authentication, tested backups — became cheap and mostly a matter of switching them on. This is the list we work through with clients, in the order that removes the most risk for the least effort.

1. Passkeys and phishing-resistant MFA first

Start with the accounts that unlock everything else: email, your identity provider (Microsoft 365 or Google Workspace), your domain registrar, cloud console and banking. Turn on passkeys where they are offered and hardware keys or authenticator apps where they are not. SMS codes are better than nothing and worse than everything else; move away from them for admin accounts. A phished password with a passkey behind it is a near miss instead of an incident.

2. A password manager for everyone

Buy a business password manager, require it, and move shared credentials into shared vaults with access by role. This ends password reuse, gives you an audit trail, and makes offboarding a matter of removing one person from the vaults rather than guessing what they knew.

3. Backups you have actually restored

Every client we ask has backups. Far fewer have restored from them in the last year. Schedule a quarterly restore test of one real system — the website, the CRM export, the shared drive — and time it. Keep one copy that a compromised admin account cannot delete. Our backups and disaster recovery guide has the checklist.

4. A call-back rule for money and access

AI voice cloning and flawless AI-written email mean that “it sounded like them” and “the email looked right” no longer protect you. Write a one-line rule: any request to move money, change bank details, or grant access is confirmed by calling the person back on a number you already have. Print it. Tell suppliers you do it. It costs nothing and it is the single most effective control against business email compromise.

5. Least privilege and a real offboarding list

Most people do not need admin rights, and most ex-employees still have some. Review who is an admin on each system, reduce it to those who need it, and keep an offboarding checklist that lists every system a person could hold access to: email, drive, CRM, website, social accounts, ad accounts, domain, cloud, password vaults. Run it the day someone leaves.

6. Keep the website and devices patched

For WordPress and other CMS sites, keep core and plugins updated on a schedule, remove plugins you do not use, and put the site behind a web application firewall. For laptops and phones, turn on automatic updates and disk encryption, and use device management if you have more than a handful. See what website maintenance includes.

7. Rules for AI tools and data

Decide what may be pasted into AI assistants, require business tiers with no-training terms, and treat AI-generated links, invoices and attachments with the same suspicion as any other. A short written policy beats an unwritten assumption; we outline one in writing an internal AI policy.

Most small-business breaches are not clever. They are a reused password and an email that looked fine.

None of the steps above requires a security team. They require an afternoon, a decision, and a quarterly reminder. If you want an outside pair of eyes on your accounts, website and processes, our cybersecurity services start with exactly this review.