The 5 Security Gaps I Find Most Often in SME Systems
I completed a 60-hour Cyber Security Engineer bootcamp covering penetration testing, SQL injection, XSS, DevSecOps, SIEM, and digital forensics. The most useful thing I took from it was not a technique.
It was this: the gaps attackers actually use are almost never sophisticated. They are ordinary oversights that nobody owned.
Here are the five I encounter most in small and mid-sized business systems, drawn from production infrastructure work rather than a textbook.
Why smaller organisations get hit
“We are too small to be a target” is the most expensive assumption in this space, because it misunderstands how most attacks work.
The majority are not targeted at anyone specifically. Automated scanners sweep the internet looking for unpatched services and weak credentials. The scanner does not know or care whether you are a multinational or a five-person company. It sees one thing: an open door.
Smaller organisations are often the better return — the data still has value, and the defences are thinner.
Gap #1: Credentials reused across services
Consistently the most common finding, by a wide margin.
The pattern is always similar: one password across email, the admin panel, banking, and social accounts. When any one service is breached — and large services are breached periodically — attackers replay those credentials everywhere else. It is called credential stuffing, and it is fully automated.
How to close it
- Deploy a password manager (Bitwarden’s free tier is sufficient for most teams)
- Enforce MFA on email and financial accounts at minimum
- Make the email password unique — email is the reset path for everything else
Gap #2: Departed staff still hold access
I find this repeatedly: someone left eight months ago and their account is still active, sometimes with admin rights.
This is not about suspecting former colleagues. The real risk is that dormant accounts are unmonitored accounts. If one is compromised, nobody notices, because nobody expects activity there.
How to close it
- Make access revocation part of the last-day checklist, not a follow-up task
- Review the user list quarterly — it takes fifteen minutes
- Grant least privilege by default, not admin for convenience
When I standardised security across 12+ Docker containers during an infrastructure migration, most findings were not technical weaknesses. They were accumulated excess permissions that no one had revisited.
Gap #3: Backups exist but restore was never tested
This is the one that hurts most when it goes wrong.
Plenty of organisations have automated backups and feel covered — right up until someone needs a restore and discovers the archive is corrupt, only partial tables were included, or the process takes three days when the business needs to be running tomorrow.
An untested backup is not a backup. It is an assumption.
How to close it
- Perform a real restore to a separate environment at least quarterly
- Time it. That duration is your actual recovery objective
- Keep one copy offline or in a separate account — ransomware encrypts connected backups too
Gap #4: Software that never gets patched
Known vulnerabilities with published fixes, left unapplied. The easiest gap to prevent and among the most commonly ignored.
The reason is usually reasonable: fear that an update breaks something. That is a legitimate concern — but the answer is a way to test updates, not deferring them indefinitely.
How to close it
- Enable automatic updates for operating systems and browsers
- Schedule maintenance windows for business applications
- Maintain a staging environment for anything critical
For context: part of the reason for the Odoo v14 → v18 migration I led was not new features. The old version had stopped receiving security patches. Running unsupported software is security debt that accrues interest.
Gap #5: Sensitive data sent over ordinary channels
Identity documents in group chats. Passwords over messaging apps. Customer lists attached to plain email.
The exposure is not only in transit. That data persists — on every recipient’s device, in their cloud backups, on hardware that may later be lost, sold, or handed to someone else.
How to close it
- Send sensitive documents as expiring links, not attachments
- Share credentials through the password manager, never through chat
- Set one clear rule: customer data does not leave the system of record
The 30-minute checklist
No technical help required:
| Time | Action |
|---|---|
| 5 min | Enable MFA on the primary business email |
| 5 min | Audit the user list; revoke dormant accounts |
| 5 min | Confirm backups are running (check the last successful date) |
| 5 min | Apply pending OS and browser updates on work machines |
| 10 min | Replace reused passwords, starting with email and banking |
Doing only these five closes most of the routes commonly used against organisations your size.
FAQ
Do we need to hire a security consultant? Not for the five items above — those are all self-service. A consultant becomes worthwhile when you hold significant volumes of customer data, face compliance obligations, or have already had an incident.
Isn’t antivirus enough? No. Antivirus addresses malicious files. It does nothing when valid credentials are stolen or a former employee’s account is abused. Most breaches use legitimate access, not malware.
We think we have been compromised. What is the first step? Isolate the affected accounts, reset credentials from a known-clean device, and document the timeline before deleting anything. Do not rush to erase traces — those traces explain how entry was gained, and you will need them.
Is cyber insurance worth it? For most SMEs, that budget does more good closing the five gaps above first. Insurance makes sense once the fundamentals are in place.
If you are unsure where your systems stand, I am happy to look at your setup and point out what is most urgent — often the answer is simpler than expected.