In a company with 15 employees, the IT manager is usually also the bookkeeper, the buyer or the owner. Security gets handled when there is time, and there rarely is. Meanwhile, criminals use automated tools that send the same fake invoices and login attempts to thousands of firms at once, regardless of size. A small business is hit by the same attacks as a large one but has fewer hands to deal with them.
On the other hand, the measures that work best are also the cheapest. Most of what follows can be done in a couple of afternoons.
Begin with what costs the least
The Danish Business Authority and the Agency for Digital Government have collected seven pieces of IT security advice (in Danish) for small and medium-sized companies. Four of them can be put in place without buying anything new.
Two-step login on email and accounting. It is built into the most widely used email and office suites and most accounting software. Turn it on for everyone, including the owner. A stolen password is the most common way in, and two-step login closes that route for the vast majority of attempts.
Automatic updates. Set computers, phones and the router to update themselves. Old versions of Windows or a router from 2017 are open doors.
A backup that has been tested. A backup is only worth something if it can be restored. Once a year, try to retrieve a folder, and make sure at least one copy is kept somewhere that is not connected to your network.
Separate users. Everyone has their own login, and nobody works as administrator day to day. When an employee leaves, the account is closed the same day.
If you are unsure where you stand, take the security check on sikkerdigital.dk. It is free, takes about fifteen minutes and gives you a list of recommendations suited to your size.
Agree responsibilities with your IT supplier
Most small businesses buy operations from a local IT supplier or a cloud provider. That is sensible, but it does not move the responsibility. Ask the supplier specifically: Who takes backups, and how often? Who watches alerts outside working hours? How fast do you respond if we are hit? The answers should be in the contract.
Write the supplier’s on-call number down on paper too. If the systems are down, you may not be able to look it up.
The part your supplier cannot handle
Once the technical basics are in place, the biggest remaining risk is the same as in large companies: an employee who is deceived. In the annual 2025 Data Breach Investigations Report, a human element was part of around 60 percent of breaches.
In small businesses this has a particular twist. Decision paths are short and trust is high, which is a strength day to day. It also means that one person can often both create and approve a payment, and that an email from “the managing director” about an urgent transfer is seen by nobody else. That kind of fraud requires no technical break-in.
Two simple rules cover most of it:
- Changes to account numbers and payments above an agreed amount are always confirmed with a call to a number you already know.
- Anyone who clicks on the wrong thing or is in doubt says so straight away, and is thanked for it.
Training that fits a small business
Rules on a notice board quickly become invisible. They need to be practised, and small businesses typically have three options.
Free material exists, including the employee package from sikkerdigital.dk (in Danish). It is a fine place to start if the budget is zero, but it is general and requires someone in the company to run it.
An off-the-shelf standard course is quick to roll out. The drawback is that the examples are written for every industry at once, and a carpenter and an accountant rarely recognise themselves in the same situations.
The third option is e-learning adapted to the company. Many assume that is only for large organisations. At Grape, you can buy a ready-made course that is quality-assured by subject-matter experts and have it customised. The scenarios can be adapted to your own working day, so a small business gets training that looks like its own situations without paying for a course developed from scratch. You choose between the standard programme, an adapted version or a fully bespoke course when you look at our solution for IT security in your business.
For a company with few employees, the modules that match everyday work are often enough: scam messages, passwords, mobile devices and what to do in a security breach. Four short modules spread over six months are easier to complete than one long course.
A plan for the first 30 days
- Week 1: Turn on two-step login for email and accounting. Take the security check.
- Week 2: Review backup and user accounts with your IT supplier. Close old accounts.
- Week 3: Introduce the rule about calling when account numbers change. Write a short list of who to call if something goes wrong.
- Week 4: Put employee training in the calendar and agree a fixed date for follow-up.
If you do not have an incident response plan, we describe the employees’ part of it in the article on what employees do when a security breach happens. And if you would like to hear how training can be adapted to a company of your size, you can write to us.
