Small businesses are increasingly a deliberate target for cybercriminals, not despite having less to steal, but precisely because they typically have far weaker defences than large corporates. Ransom demands, SIM swap fraud and phishing are all well-established, prevalent threats in South Africa today.
Start by understanding what you actually have
Many small businesses grow their network organically, adding devices and services over time without ever mapping what’s actually connected. Get a clear picture of your systems before anything else, since businesses are often caught out by basics like missing backups rather than sophisticated attacks.
Get the basics in place first
A basic backup system and even a free anti-virus programme prevent the majority of nasty surprises. Keep every system updated. A cyber security “strategy” doesn’t need to be complicated, getting the fundamentals right consistently matters more than a sophisticated plan you never execute.
Work out who would actually target you
Every business has something worth protecting, data, customer information, financial access, or simply network resources an opportunistic hacker could exploit. You may never be a deliberate target, but you can still be caught by an opportunistic attack if basic protections aren’t in place.
Fix the most common mistake: weak passwords
Passwords like “123456” remain shockingly common. Treat changing your passwords like a basic hygiene habit, not an occasional chore.
Eight practical steps to take now
- Update your software regularly, and upgrade when a newer version is available.
- Keep regular backups, both online and offline.
- Install a basic anti-virus programme.
- Use a dedicated password manager to keep passwords secure and unique.
- Enable two-factor authentication so a single compromised password isn’t enough on its own.
- Separate your networks, keep guest Wi-Fi and your internal network apart.
- Use a reputable VPN for an added layer of protection.
- If you’re ever threatened with ransomware, do not pay. There’s no guarantee you’ll get your data back, and paying funds further criminal activity.
Frequently asked questions
Are small businesses really targeted by hackers, or only large companies?
Small businesses are increasingly targeted specifically because their defences tend to be weaker, not because they have less worth stealing.
Should I pay a ransom if my business’s data is held hostage?
No. There’s no guarantee of getting your data back, and payment funds further criminal activity. Report the incident and work with a security professional instead.
What’s the single most cost-effective cyber security step for a small business?
Regular backups combined with basic anti-virus software and consistent software updates address the majority of common vulnerabilities at minimal cost.
Is two-factor authentication really necessary for a small business?
Yes. It significantly reduces the risk of a single compromised password giving an attacker full access to an account.
Security as a habit, not a project
None of these steps require a large budget or deep technical expertise. Treat basic cyber hygiene, backups, updates, strong passwords and two-factor authentication, as an ongoing habit, and you’ll close off the vast majority of the attacks small businesses actually face.
Further reading: 8 Things Cybersecurity Experts Say You Should Be Doing | No More Ransom, an official law enforcement initiative for ransomware victims
Originally published in July 2019. Updated September 2026 to refresh this cyber security guidance and fix a broken link to the official No More Ransom initiative. The underlying security fundamentals remain durable.
