Plenty of SME owners think: "I'm not a big company — why would hackers target me?" The truth is the exact opposite. Cybercriminals prefer small and medium businesses precisely because their defences are weaker and there's often no one dedicated to IT. Hong Kong Police figures show the city recorded around 34,000 technology crimes in 2023, with losses approaching HK$5.5 billion — and many of the victims were SMEs with limited manpower. This article won't ask you to hire an IT team. It just gives you five practical, low-cost steps to block the most common attacks.
The three most common attacks
1. Phishing
Attackers disguise themselves as your bank, a supplier, or even your own boss, sending an email that looks perfectly normal and asks you to click a link or enter a password. Industry data shows more than 80% of breaches involve human error, and phishing is the most common entry point. A single "boss asking you to transfer money now" message can wipe out a month's profit.
2. Ransomware
This kind of attack encrypts all the files on your computer — or across your entire company — then flashes a screen demanding a ransom. The average ransom for an SME runs into six figures in US dollars, and studies suggest nearly 60% of small businesses close within six months of a serious cyber attack. Refuse to pay and your data is gone; pay up and there's no guarantee they'll unlock it.
3. Business Email Compromise (BEC)
This attack doesn't rely on hacking technology — it relies purely on deception. Someone impersonates your boss or a business partner and asks accounting to wire money to a fake account. Because it involves no malicious software, antivirus tools can't detect it, which makes it the hardest to defend against.
Five low-cost defences
Defense 1: Turn on multi-factor authentication (MFA)
Every company account — especially email, banking and cloud services — should have MFA enabled. That means when you log in, you enter your password plus an extra one-time code sent to your phone. Even if a password is stolen, no one can get in without that second factor. Microsoft's research shows MFA blocks over 99% of automated attacks — the cheapest and most effective step you can take.
Defense 2: Make 3-2-1 backups
If ransomware ever hits, the cheapest fix is not paying the ransom — it's restoring from a backup. Remember the 3-2-1 rule: keep 3 copies of your data, on 2 different types of media, with 1 stored offline or in the cloud. Automate a daily backup at near-zero cost, and you can recover your whole company at any time.
Defense 3: Run regular phishing tests with staff
Most attacks start with "one wrong click". Once a month, send a simple simulated phishing email to test who falls for it, then teach them on the spot. The point isn't to punish people — it's to build awareness. Studies show regular training can cut the click rate from around 30% to under 20%.
Defense 4: Keep software updated and turn on antivirus
Many attacks get in through old software vulnerabilities. Set Windows, your browser and all business software to update automatically, and install a reliable antivirus or endpoint protection. It's free or very cheap each month, but it shuts out a large share of known attacks.
Defense 5: Least privilege + a password manager
Give each employee's account only the access they need to do their job: accounting doesn't need server admin rights, and an intern shouldn't see every customer's records. Pair this with a password manager so each account uses a different, sufficiently long password — never one password for everything. Then if one account is breached, the damage stays contained.
Cybersecurity isn't just a big-company concern. For an SME, a single phishing email can cost a month's profit. Most of the five steps above cost little — they're just fundamentals. Spend one day getting the basics right now, rather than regretting it after an incident.