This is a subjective list. It is not complete, and it is not trying to sell you anything. It comes from what I have actually watched go wrong at small and mid-sized companies over the past couple of years. Treat it as a starting point, or as a conversation to have with your IT people if you have them.
Keep the basics current
Updates. Not just your servers and applications. The software libraries your projects are built on carry vulnerabilities too, and almost nobody ever looks there. Keep them patched.
HTTPS. It is 2025 and I still feel slightly stupid asking, but do you have SSL certificates enabled on every one of your websites? If not, fix that today.
Firewall. Open only the ports you actually need. Consider blocking traffic from countries you do not do business with. If you worry that cuts off staff while they are on holiday, that is what a VPN is for.
Web application firewall. If you run anything customer-facing, consider one. There are plenty of options and some are free. Check the GDPR implications first, then get one. In 2025 this matters more than it used to.
Protect the devices that leave the building
Encryption. I keep watching owners and CEOs travel with unencrypted laptops and USB sticks full of interesting data. If that laptop is stolen and it is not encrypted, someone can pull the saved logins straight off it. That means access to your services without ever knowing a single password. Encrypt the laptops, the drives, all of it.
Multi-factor authentication. Turn it on. If you have single sign-on and the SSO account is itself protected by MFA, use that. Plenty of owners hate the little numbers on their phone, and I understand why. But the whole group is only as secure as its weakest link, and that irritation is often exactly where the weak link sits.
Assume someone is trying to impersonate you
AI phishing. Phishing moved to a new level. Anyone who wants to reach you now has AI on their side, and because we all publish so much online, gathering intelligence on you and turning it against you has become trivial. When something feels off, verify through a different channel. Annoying your boss with an extra phone call beats a fraudulent transfer of a few hundred thousand euros.
Email. Review your email configuration so it is harder for someone to impersonate your domain.
Expired domains and IP addresses. This one is sneaky. Domains and IPs often get whitelisted for security and then forgotten. If you let a domain lapse or drop one you no longer want, someone can buy it back in minutes, point a bogus email server at it, and inherit the trust you left behind. Before you retire any domain or IP, strip out the security connections tied to it.
Know the moment something goes wrong
Backups. Take them seriously, and actually verify them at least once a quarter. An untested backup is a guess.
Logging. Where you log matters. If the machine storing the logs is the same machine running the service, an attacker who gets in simply erases the evidence of how they entered. Send logs to a separate machine over the network and they have to break in twice. Knowing how someone got in is worth a great deal.
Monitoring. This is not the same as logging. Monitoring actively watches for things happening against your wishes. If you have nothing, start with basic uptime monitoring wired to an SMS alert. When you are being actively exploited, one of the first signals is often a machine dropping or CPU and memory spiking. Make sure you get told when it does.
Your weakest link is usually a person
Supply chain. Your own security can be flawless and still fail through a partner. Review your suppliers regularly. If you do not know where to start, open your GDPR document and work through the list of subprocessors.
Physical security. Some companies guard everything online and leave the front door open. A little social engineering and someone walks in and collects what the whole online army was protecting. Control who gets into your office, keep a record of who comes and goes, and do not make it easy for strangers to wander in unless you actually run a reception.
Be careful what you tell AI
When we talk to AI we relax, and we hand over things we would never say out loud in a normal conversation. You never know who is on the other side. Terms and conditions are promises with the potential for enforcement, and a lot of ifs stand between a broken promise and any real consequence. Think about the temptation facing whoever governs all that data, because there are plenty of juicy secrets sitting in it.
One last thing
This list is deliberately incomplete and based on what I have seen, not on what I want to sell you. Take it as a conversation starter with your IT. And remember: not every point applies to you. If your IT person tells you a particular point is not worth worrying about, they are probably right.
If you have nobody to have that conversation with, we can start from exactly this list.
