Small businesses are attacked because they are easier, not because they are valuable. The controls that prevent most incidents are unglamorous and cheap, and the single most expensive attack on South African small businesses is not sophisticated hacking. It is a compromised email account used to send a customer or supplier changed banking details.
Eight things, in order of how much they prevent.
The four that stop most attacks
Two-factor authentication on email and banking, which defeats a stolen password. Unique passwords held in a password manager, so one breached service does not open the rest.
Updates applied promptly, since most successful attacks exploit known flaws that were already patched. And tested backups, because a backup that has never been restored is an assumption, and ransomware encrypts every backup it can reach.
The banking details rule
Verify every change of payment details by phoning a number you already held, never one supplied in the message requesting the change. Treat urgency in any payment request as a warning rather than a reason to act quickly.
This single habit prevents the most costly incident most small businesses will face, and it costs nothing.
Limit access and train the people
Give staff access only to what their job needs, and remove it the day someone leaves. Shared logins make it impossible to tell who did what, which matters enormously after an incident.
Most breaches begin with someone clicking something. Telling staff what a suspicious message looks like, and making it safe to report a mistake rather than hide it, is more effective than any product.
What the law requires
Businesses holding personal information carry obligations under the Protection of Personal Information Act, overseen by the Information Regulator, including securing it and notifying the regulator and affected people where a breach occurs.
Size is not an exemption. Know in advance who you would call, and note that cyber insurers increasingly require specific controls as a condition of cover, so not having them can void a claim.
Frequently asked questions
Why would anyone target a small business?
Because it is easier, not because it is valuable. Weak controls make small businesses efficient targets.
What is the single most effective control?
Two-factor authentication on email and banking, which defeats a stolen password.
What is the most expensive attack in practice?
Email compromise used to send changed banking details to a customer or supplier. The money is rarely recovered.
How do I prevent that specifically?
Verify every change of banking details by phoning a number you already had, never one supplied in the message.
What does the law require after a breach?
Securing personal information, and notifying the regulator and affected people. Business size is not an exemption.
Originally published in July 2018. Updated September 2026 into a practical cybersecurity guide for small businesses.
