Most of the businesses we work with never sat down and decided to let personal devices into the company. It just happened. Someone added their work email to their iPhone because it beat opening the laptop again at 9 p.m. The bookkeeper started logging in from home on Fridays. A field supervisor let Chrome save a password back in 2023 and hasn’t thought about it since.
None of that felt like a security decision at the time. Add it all up, though, and it’s where nearly every attack on a small business begins. Not with someone in a hoodie breaking through a firewall. With a line that quietly crossed between somebody’s personal life and your business.
I want to walk through how that actually plays out, because once you’ve seen it you can’t unsee it, and most of it costs very little to fix.
“We’re too small for anyone to bother with”
I hear this one weekly, usually from owners running shops of ten to fifty people. The logic makes sense on its face. Why would a criminal halfway around the world care about a strawberry operation in Watsonville or a two-attorney office off Main Street?
They don’t, specifically. That’s the part people get backwards. Nobody is choosing your company by name. Attackers run automated tools that rattle the doorknobs on thousands of businesses at once and stop wherever a door swings open. Being small doesn’t make you invisible. It usually makes you easier, because there’s rarely a dedicated security person keeping an eye on things.
So the useful question isn’t “are we a target.” It’s “how hard are we to get into.” And that you can control.
How These Attacks Really Work
Forget the movie version. The most common breach we clean up has no hacking in it at all.
An employee uses the same password at work that they use for their personal email and a couple of shopping sites. Fine, until one of those sites gets breached, which happens all the time and is completely out of your control. Now that email-and-password combination is sitting on a list that gets bought and sold. Criminals feed those lists into tools that try the same login everywhere. If it happens to work on your Microsoft 365 or your payroll portal, they’re in. Wearing your employee’s name. No alarm, no broken lock.
Phishing lands the same way. A text or email shows up on someone’s personal phone, “your package couldn’t be delivered,” “the boss needs you to grab some gift cards,” “verify your account before it’s suspended,” and one wrong tap turns a personal inbox into a business problem.
Notice that in both cases the technology worked exactly as designed. That’s what makes this category so easy to miss and so worth your attention.
The Three Places the Lines Cross Most
The phone in everyone’s pocket. A personal phone with your company email on it is holding a lot more than a few messages. It has your contacts, your conversations, your attachments, and the ability to reset passwords. The fix isn’t to ban phones, which no one will actually follow. It’s to manage them, so a lost or compromised phone doesn’t hand over the keys. We’ve been doing exactly this kind of mobile access work for years.
Home and coffee-shop Wi-Fi. Checking the news on open Wi-Fi is nothing to worry about. Logging into your bank or pulling up client records on it is a different animal, because open networks can be watched or faked. A properly set-up business connection, or even just a phone hotspot, is a safer habit and costs nothing to build.
Personal laptops doing real work. Plenty of small businesses run fine on personal computers, as long as there are guardrails: a written policy, current security software, work accounts kept separate from personal ones, and someone who actually knows which machines touch company data. The danger is the version where nobody knows, and there’s no policy at all.
The Four Habits That Stop Most of it
None of these are glamorous, which is probably why they get skipped. Together they prevent the large majority of the incidents we see.
Turn on multi-factor authentication everywhere you can. It’s the single most effective thing on this list. Even if a criminal has the right password, that second code on the phone stops them cold, and you can usually roll it out across your core systems in an afternoon. A lot of cyber-insurance policies now require it anyway.
Get real backups, and make sure they’ve been tested. Backups sitting on the same network get encrypted right alongside everything else when ransomware hits. What saves you is a tested, cloud-based backup living somewhere an attacker can’t reach, so a bad day stays a bad day instead of becoming the end of the business.
Keep your software patched. Most break-ins use known holes that already have fixes available. Staying current quietly removes a huge chunk of the risk.
Train your people. Staff get called the weakest link, which isn’t fair, since the real problem is that criminals have gotten genuinely good at pretending to be someone you trust. Once someone has seen a fake invoice or a boss-impersonation text pointed out to them, they spot the next one. That’s the whole game.
What to do the minute someone clicks
Someone eventually will. The businesses that recover fastest all share one thing, and it isn’t better software. It’s that their people speak up right away instead of hiding it.
The move is simple. Disconnect that device from the network, change the affected password from a different device, and call your IT partner immediately. Every one of those steps is more effective the sooner it happens, which only works in a workplace where admitting “I think I clicked something” isn’t a punishable offense. Speed beats blame every time.
Where to start if the budget is tight
You don’t fix all of this in a week, and you don’t need an enterprise budget to make real progress. Start with an honest look at where business and personal lines cross in your operation right now. From there you prioritize by impact, not price, and a surprising number of the highest-impact steps are close to free.
If you’d rather have that conversation in person, we’re hosting a free lunch session on Thursday, August 13 at the Hampton Inn in Watsonville, built around the exact questions Central Coast owners ask us most. Plain answers, no jargon, no pitch. Arrival is 11:30 a.m., seats are limited, and reservations are required. Grab a seat at rvstg.com/events.
Frequently Asked Questions
Is my small business really a target for cyberattacks?
Yes, and often because it’s small. Attackers use automated tools that scan thousands of businesses for easy openings rather than picking targets by name. Smaller organizations are attractive precisely because they rarely have a dedicated security team.
Should I ban personal phones for work email?
No. Banning them rarely works in practice. The better approach is managing them, so business email and access can be secured and, if needed, wiped from a lost device, while your team keeps the convenience of working from their own phones.
What is multi-factor authentication and do I actually need it?
Multi-factor authentication (MFA) requires a second proof of identity, usually a code on your phone, before a login succeeds. It’s the single most effective defense against stolen passwords and stops the vast majority of account takeovers. Many insurance carriers now require it.
Will backups protect me from ransomware?
Only the right kind. Backups on the same network can be encrypted along with everything else. A tested, cloud-based backup stored out of an attacker’s reach is what lets you restore quickly instead of paying a ransom.
What are the basics that stop most attacks?
Four habits do most of the work: multi-factor authentication, tested off-network backups, current software patches, and regular staff awareness training. None is expensive, and together they prevent most incidents.