10 hidden cyberthreats

In today's article we'll cover hidden cyber threats that show up in just about every company. You can't fix what you can't see, so today we'll shine a light on the 10 most common hidden threats.

Outdated software

I get it — constantly updating every device is annoying, and updates bring their own issues. But those are negligible compared to a cyberattack. Almost every update fixes bugs in the system, bugs attackers can exploit to reach your data.

Weak passwords

Using weak passwords is like leaving the front-door keys hanging on the door handle. Passwords like "123456", "admin" or "password" are practically useless. Use strong, unique passwords on every account. Password managers are practically essential here. As an owner you can't expect employees to do this automatically — train them on creating proper passwords.

Insecure Wi-Fi

Make sure your Wi-Fi is secured with a password and that your router uses WPA2 or WPA3 encryption as another protective layer. For your most critical work, consider a VPN; it can shield you from anyone who might be eavesdropping.

Insufficient employee training

Your employees can be your greatest defence — or your greatest weakness. Human error causes roughly 88% of all data breaches. Without proper training, your staff may fall for phishing or accidentally expose the company network. So train them regularly on:

· Recognizing phishing emails

· Avoiding shady websites

· Using secure ways to share data

No backups

Imagine waking up to find all your data is gone. Without a proper backup setup, this can become reality very fast. Data doesn't only get lost to attackers — a flood or a simple disk failure can do it too. So follow the 3-2-1 rule: always keep at least three copies on two different media, with one copy off-site. Don't forget to test your backups regularly.

Not using MFA

Let's say you took the second point to heart and you have strong, unique passwords. Nice work — you're already further ahead than most, and your security has clearly stepped up. But once someone gets past your password, your defence ends — which is why multi-factor authentication matters. MFA forces another unique code after you've signed in with the password.

Mobile-phone risk

Phones have turned into work devices, so treat them accordingly. Make sure every work phone has a passcode and, where possible, biometric sign-in.

Shadow IT

Shadow IT is the term for unsanctioned apps your employees use on the company network. It can look harmless, but those apps can seriously undermine company security. Set hard rules for which apps may and may not be used, and update those lists regularly.

Worst-case plan

Unfortunately, even if you follow everything I covered today, someone may still successfully attack you. So have a plan for what to do when that happens — how to detect the attacker and the affected area, how to react to that information, and how to recover. Test and update the plan regularly so you're always prepared for the worst.