Half an Hour, Five Checks: The Security Walkthrough Most Small Business Owners Keep Postponing

Most small business breaches don't make the news. There's no ransomware headline, no FBI press conference. Instead, a bakery in Ohio spends a weekend rebuilding its booking system, or a three-person accounting firm discovers its client portal was scraped through a router that still shipped with "admin" as the password.

The uncomfortable truth is that the majority of these incidents begin with the same handful of oversights — and every one of them can be found with a timer, a notepad, and thirty minutes. No consultant. No jargon. Here is the walkthrough.

Check One: The Router Nobody Has Touched Since Installation

Start where the internet enters your business. Log in to your router's admin panel (the address is usually printed on the device or available from your internet provider) and confirm three things:

• The admin credentials have been changed. Factory passwords like "admin" or "password" are public knowledge, and automated scanners find unsecured routers within hours of them coming online.
• Remote administration is turned off unless someone on your team genuinely needs it. This setting lets people reach your router's controls from outside your network — a convenience attackers appreciate far more than you do.
• The firmware is current. Most routers released in the last five years offer an update button right in the admin panel. If yours doesn't, budget for a replacement; a $100–150 router is cheaper than one incident.

And yes — the Wi-Fi password on the sticky note. Move it into a password manager or a locked document. A password visible to every customer who walks past the register is not a password; it's an invitation.

Check Two: Password Reuse Across Accounts

Pick your three most critical accounts — email, banking, point-of-sale dashboard — and ask a blunt question: is the password used anywhere else? If an employee's reused credential leaks in some unrelated breach (and breaches leak constantly), attackers will try it against your accounts automatically.

The fix is a password manager for the business. Team plans run a few dollars per person per month, and every account gets a unique, unguessable credential. Turn on two-factor authentication for the email account first; whoever controls your email can reset the password to nearly everything else you own.

Check Three: Software Running on Hope

Outdated software is the quietest hole on this list. Walk through every device and application the business depends on — the register tablet, the office laptop, the website's content management system, the browser plugins — and check for pending updates.

Two spots deserve special attention:

• Your website's platform. If your site runs on WordPress or a similar system, outdated plugins are the single most common entry point for site defacements and injected spam. Log in and update everything today.
• Anything running an operating system that no longer receives security updates. Windows machines past their support window should be replaced or isolated from any device that touches customer data.

Check Four: Access That Outlived the Employee

Every business accumulates digital residue: the former bookkeeper who still has banking access, the summer intern whose login to the scheduling system was never removed, a shared account whose password has been texted to four different people.

Make a simple list. For each service your business uses, write down who currently has access. Then remove anyone who no longer needs it. While you're at it, eliminate shared logins where you can — individual accounts mean you can cut access in seconds when someone leaves, rather than changing one password and hoping it didn't get written down somewhere.

Check Five: Customer Data Lying Around

Finally, look at where customer information actually lives. Spreadsheets of emails on a desktop. Card numbers scribbled in a notebook "temporarily." A mailing list exported to a laptop that also gets used at home.

The standard to aim for is simple: you should be able to say, in one sentence, where every piece of customer data is stored and who can reach it. Anything that collects payment information should be handled by your payment processor — Square, Stripe, and their competitors are built for this, and storing card numbers yourself puts you in scope for regulations you do not want to navigate alone.

When to Stop and Call a Professional

This audit covers the openings attackers check first, and for many small businesses, fixing these five items removes the majority of practical risk. But some findings warrant outside help:

• You discover evidence someone already has access — unfamiliar logins, password reset emails you didn't request, files you didn't create.
• Your business handles sensitive categories of data, such as medical or financial records, where compliance requirements apply.
• You find the same critical problem in multiple places and don't have anyone on staff who can remediate it confidently.

A reputable IT provider will assess a small business network for a few hundred dollars — a reasonable price once, and a reasonable recurring investment if your operation has grown past a handful of employees.

Put It on the Calendar

Security isn't a project you finish; it's a habit you schedule. Set a recurring calendar reminder to repeat this walkthrough quarterly. Thirty minutes, four times a year, is the entire cost of not becoming the next cautionary tale at the local chamber of commerce meeting.