Most cyber attacks on Indian small businesses are not sophisticated. They are a phishing WhatsApp message that looks like a bank alert, a former employee whose login still works, a website running software from three years ago, or a laptop with the only copy of your accounts. The good news: the defenses against these are neither expensive nor technical. They are habits.
Here is a practical cybersecurity baseline for a small business - the things worth fixing before you spend a rupee on anything fancier.
1. Passwords and MFA: the cheapest real protection
Reused passwords are how most small-business breaches start. One shopping site leaks a password, and attackers try it on your email, your banking, your Instagram page. The fixes:
- Use a password manager for the business. It generates and remembers a different strong password for every account. The owner remembering three clever passwords is not a system.
- Turn on two-factor authentication (MFA) on email first, then banking, social media, and your website admin. An app-based code is better than SMS where offered.
- Email is the master key. Whoever controls your email can reset every other password you own. Protect it accordingly.
2. Updates are not optional
When software announces a security update, attackers read the same announcement and start scanning for businesses that have not applied it yet. This is not theory - this month alone, critical PHP vulnerabilities discovered by AI forced emergency patching across government and business websites worldwide, because so much of the web (including most WordPress sites) runs on PHP. If your website, plugins, or computers are months behind on updates, you are relying on luck.
Practical rule: automatic updates on for operating systems and browsers, and a fixed monthly slot to update the website - or a maintenance arrangement with whoever built it.
3. Backups you have actually tested
Ransomware and simple hardware failure share a property: the business without a current backup pays, or closes. The classic guideline is 3-2-1: three copies of important data, on two different kinds of storage, with one copy off-site or in the cloud. Whatever the scheme, the test that matters is whether you have ever actually restored from it. An untested backup is a hope, not a backup.
4. Phishing: your team is the firewall
The most common attacks on Indian SMBs arrive as messages, not code: a fake KYC expiry warning, a "bank" calling about a blocked account, a courier link, a QR code that pulls money instead of receiving it. Two habits stop most of it:
- Verify on a second channel. Any request involving money, passwords, or OTPs gets confirmed by calling the person or institution back on a number you already have - never one supplied in the message itself.
- Never share OTPs or approve payment collect requests you did not initiate. No legitimate bank or official asks for these. UPI collect requests and QR codes are for receiving money only when you created the request yourself.
Say these rules out loud to everyone who touches money or email in your business. Once a year is not enough; a five-minute reminder every few months works better than a policy PDF nobody reads.
5. Access: who can reach what
- Every employee gets their own login - no shared accounts, so you can see who did what and switch off one person without disrupting everyone.
- When someone leaves, their access leaves the same day: email, social pages, website admin, cloud storage, banking portals.
- Admin rights are for admins. The person doing data entry does not need the keys to the whole website.
6. Know who to call
If something does go wrong - fraud, account takeover, ransomware - speed matters. In India: report financial cyber fraud immediately to your bank and the national cybercrime helpline 1930, and file a report at cybercrime.gov.in. Fast reporting materially improves the odds of freezing stolen funds. Save these details now, not during the incident.
The honest catch
No baseline makes you unhackable, and anyone selling that promise is selling something else. What these six areas do is move you out of the easiest-target category. Attackers scanning thousands of Indian small businesses a day are looking for the ones with no MFA, no updates and no backups. Do not be one of those.
The bottom line
Cybersecurity for a small business is 90% discipline and 10% tools: unique passwords with MFA, prompt updates, tested backups, a team that verifies before it pays, clean access control, and the helpline number saved. A weekend of setup covers most of it.
If you want a security review of your website and business accounts - or a maintenance plan that keeps updates and backups handled - talk to us for a free consultation.
