“Too small to hack” is the most expensive sentence

Small businesses are rarely singled out by name. Most attacks are automated, carried out by tools that scan the internet for weak passwords, out-of-date software and people who are likely to click a bad link, and those tools don't check the size of a company first.

The scale of the problem is real. In 2025, the Canadian Anti-Fraud Centre received more than 112,000 fraud reports involving over $704 million in losses, and it estimates that only 5 to 10 percent of victims report at all.

Start with the Cyber Centre's baseline

The Canadian Centre for Cyber Security publishes 13 baseline controls for small and medium organizations. They are built on the 80/20 rule, which aims to deliver most of the protection for a small share of the effort. You don't need all 13 on day one, and the steps below cover the most ground for a small team.

A day-one baseline for a small team

• Turn on two-step login for email, banking, accounting software and every administrator account, starting with email, since email can be used to reset everything else.
• Use a different password for every account so that one leaked password can't open the others.
• Set up each device properly, with disk encryption switched on (BitLocker on Windows or FileVault on a Mac), a screen lock and automatic updates.
• Install security software on every laptop.
• Agree on a rule that any change of banking details or urgent payment request is confirmed by phone, using a number you already have.
• Make sure backups run automatically, and test them by restoring a file.

Write it down

Keep a one-page record of what is in place and who has access to which systems. Insurers, larger clients and contracts increasingly ask how you protect data, and a written answer is far more convincing than a shrug. Add a short plan for what to do if something goes wrong, covering who to call, where the important logins are kept and what to switch off first.

A worked example

Picture a four-person accounting office in which one employee uses the same password for their work email and an old shopping account. The shopping site is breached, the password appears in a leaked list, and an automated tool tries it against the work email. The password works, and the attacker quietly reads the inbox for a week before sending a client an "updated banking details" message from a real address in the middle of a real conversation.

Two-step login on that mailbox would have stopped the attack at the first step, and a rule requiring phone confirmation for payment changes would have stopped it at the last.

Turning on two-step login

• In Microsoft 365, an administrator can require multi-factor authentication for every account, and each person then adds an authenticator app from the Security info page of their account.
• In Google Workspace, an administrator can enforce 2-Step Verification for everyone from the Admin console, with a grace period that gives people time to enrol.
• For other services, look in the security or login settings, and choose an authenticator app over text-message codes wherever you can.

Turning on device encryption

• On Windows, look for Device encryption or BitLocker in the Privacy and security section of Settings, and save the recovery key somewhere safe outside the laptop.
• On a Mac, turn on FileVault in the Privacy and Security section of System Settings.
• On modern iPhones and Android phones, setting a passcode switches encryption on.

With encryption in place, a lost or stolen laptop becomes an inconvenience rather than a data breach.

Training people briefly and often

The Canadian Anti-Fraud Centre recommends that businesses educate employees regularly about current frauds and include fraud awareness in onboarding. For a small team, spending ten minutes at a monthly meeting on one real scam example is enough to build the habit.

Considering cyber insurance

Guidance on the Cyber Centre's baseline controls also suggests that businesses consider a cyber insurance policy. Insurers will ask which controls you have in place, which is one more reason to keep your baseline written down.

Frequently asked questions

Is antivirus software enough?

Antivirus software is only one layer of protection. Two-step login, automatic updates and tested backups prevent far more of the problems that small businesses actually face.

Do we need a firewall?

Your internet router and your computers already include basic firewalls. Make sure they are switched on, and change the router's administrator password from the default.

Should we use separate admin accounts?

Using separate accounts is a good idea if you can manage it. Day-to-day work should happen in normal accounts, with a separate account used only for administrative tasks such as adding users or changing settings, which limits the damage if an everyday account is compromised.

What should we do if we think we have been hacked?

Change the affected passwords from a device you trust, and call your bank if money or payment details are involved. Report the incident to the Canadian Anti-Fraud Centre online or by phone at 1-888-495-8501, and to your local police.

Key takeaways

• Most attacks are automated, so being small offers no protection.
• Two-step login, updates, encryption and tested backups prevent most common problems.
• Confirm every change of payment details by phone, using a number you already have.
• Write down your baseline and a short incident plan, since clients and insurers will ask for them.