On Thursday, October 22, I spoke to a room of business owners and managers at the North Tampa Bay Chamber in Wesley Chapel about cybersecurity basics for small business. The timing fit, right in the middle of Cybersecurity Awareness Month. If you couldn't make it, here's the recap, built around the four areas we covered and the steps you can take this week. If you'd rather watch, the full video is below, and the slides are available as a PDF from the download button.
Passwords and MFA: the front door
Passwords alone fail for predictable reasons. People reuse them, write them on sticky notes, and pick something that feels clever but isn't, like Spring2026!. When any site you've used gets breached, criminals try that same email and password everywhere else. You can check whether your email has shown up in a known breach at HaveIBeenPwned.com, and most business password managers run the same check for you.
A password manager is the fix. 1Password is easy to roll out to non-technical teams, Keeper leans into compliance and audit reporting, Bitwarden is open source and a strong value but takes more setup, and Dashlane includes built-in security monitoring.
One question is worth repeating: what about saving passwords in Chrome, Edge, or Safari? Browser vaults sync to personal user accounts, so your company credentials end up in an employee's personal profile. Your security becomes only as strong as Steve from Accounting's home computer. The one his kids play on.
Multi-factor authentication (MFA) adds a second proof that it's really you: something you know, something you have, or something you are. Even with a stolen password, a criminal can't get in without that second piece. Not all MFA is equal, though. Hardware security keys and passkeys are the strongest. Authenticator apps and push notifications are a solid middle ground. SMS codes beat nothing but are vulnerable to SIM swapping, and email codes are only as secure as the email account itself.
Watch out for MFA fatigue attacks. An attacker with your password triggers prompt after prompt, often at 2 a.m., hoping you'll tap Approve just to make it stop. If you get an MFA prompt you didn't start, don't approve it. Someone has your password. Change it immediately.
Email security and phishing: the most common way in
The classic phishing signs still matter: urgency, mismatched sender addresses, and unexpected links or attachments. But AI has changed the game. Phishing emails now arrive with perfect grammar, personalized with details scraped from LinkedIn. Voice cloning can mimic someone from a few seconds of audio, and deepfake video calls are no longer science fiction.
Business Email Compromise (BEC) is especially dangerous for small businesses because there's often no link or attachment at all. A criminal pretends to be your boss, a vendor, or a client and simply asks for money or information. Build these habits into your team:
• Verify with a phone call to a number you already have on file, never one from the email.
• Require two people to approve money transfers and payment changes.
• Slow down whenever a request leans on urgency or secrecy.
• Look closely at the sender address.
Behind the scenes, ask your email provider or IT team about SPF, DKIM, and DMARC (the records that tell the world which servers may send for your domain and what to do with impostors), plus advanced filtering, link and attachment scanning, impersonation protection, and external sender warnings.
Endpoint protection: every laptop and phone is a door
Traditional antivirus works from a list of known threats. Endpoint Detection and Response (EDR) watches behavior and reacts to new attacks, including AI-driven ones that move faster than a person could notice. You need both.
From there, the basics carry a lot of weight:
• Keep everything updated, not just Windows or macOS. Turn on automatic updates where you can and retire anything that no longer gets security patches.
• Limit admin rights. Malware gets the same power as the account that's logged in, so daily work belongs on a standard account.
• Encrypt your devices, and lock them when you walk away. Encryption only protects a locked device.
• Manage every device that touches company data, including employee phones that get company email. Device management doesn't mean watching what employees do. It means a device has to meet your security standards before company data syncs to it.
Ransomware protection: plan for when, not if
Ransomware locks your files and demands payment. Today, criminals often steal your data first and threaten to publish it, so backups alone don't fully solve the problem. The usual entry points are the ones we already covered: phishing, stolen passwords, exposed remote access, unpatched systems, fake downloads, and trusted vendors.
Start with the 3-2-1 backup rule: three copies of your data, on two different types of storage, with one copy offsite. Then test it. A backup you've never restored is like a spare tire you've never checked, and you don't want to find out it's flat on the side of I-75. Every owner should be able to answer four questions. How far back do our backups go? What exactly is being backed up? When was our last successful restore test? How long would a full restore take?
Limit the damage when something does get through. Give people only the access their job requires, keep guest Wi-Fi off your business network, keep backups out of reach of everyday admin accounts, remove old employee and vendor accounts, and stop keeping data you don't need. Old customer records and scanned ID cards are a liability, not an asset.
Finally, write down your incident response plan. Include who to call first with phone numbers (your cyber insurance carrier belongs near the top), who makes decisions and who talks to customers, what not to do, and how you'll communicate if email is down. Florida's breach notification law generally requires notifying affected individuals within 30 days, so assign that responsibility before you need it. Keep printed copies at the office and at home, and review the plan at least once a year. For Florida insurance agencies, the controls in this recap also support compliance with Rule 69O-128.032.
Where to start this week
You don't have to do everything at once. Pick one item from each section: roll out a password manager, set a call-back rule for payment changes, confirm EDR is on every machine, and test one restore. Those four steps put your business ahead of most.
Thank you to the North Tampa Bay Chamber for hosting and to everyone who joined us in Wesley Chapel. If you'd like help putting any of this in place for your business anywhere in Tampa Bay, reach out through maineventmsp.com.
