After more than 25 years in technology and cybersecurity, I have walked into a lot of offices. Insurance agencies, professional practices, and growing small businesses across Wesley Chapel, Tampa, and the surrounding area. Every office is different, but the security gaps are remarkably similar.
The encouraging part is that the most common problems are also the most fixable. None of them require a massive overhaul or a large IT department. If I walked into your office tomorrow, here are the five things I would want to fix first, and why.
1. Accounts Without Multi-Factor Authentication
Multi-factor authentication, or MFA, requires a second proof of identity beyond a password, such as an app approval or a code. It is one of the single most effective protections a small business can turn on, and yet nearly every office I visit has at least a few accounts without it.
Email is the most important place to start. A compromised email account gives attackers the ability to reset passwords for other services, impersonate you to clients, and quietly read sensitive conversations. After email, move on to banking, accounting software, your agency management or line-of-business system, cloud storage, and remote access tools.
The fix: make a list of every business account, check which ones have MFA enabled, and close the gaps one at a time. Prioritize app-based authentication over text message codes where possible.
2. Old Logins Nobody Turned Off
Over the years, accounts pile up. A former employee whose email was never disabled. A vendor account set up for a one-time project. A generic admin login that three different people have used. A shared account with a password everyone knows.
Each of these is an open door. Former employees may still have access to sensitive information. Forgotten accounts are rarely monitored, so if one is compromised, nobody notices.
The fix: review every account in your email system, your management software, and your network. Disable anything that is not actively needed. Then create a simple offboarding checklist so that when someone leaves, their access is removed the same day.
3. Backups Nobody Has Tested
Almost every business has some form of backup. Very few have tested whether it actually works. I regularly find backups that stopped running months ago, backups that miss critical data, and backups stored on the same network ransomware would encrypt.
A backup you have never restored is a guess, and you do not want to find out it was a bad guess on the worst day of your business year.
The fix: confirm your backups are running, then restore a few files to prove they work. Make sure at least one copy is stored offsite and isolated from your network, and confirm that cloud data like Microsoft 365 email is covered too. Then schedule a restore test every quarter.
4. One Flat Network for Everything
In many small offices, the computers, printers, phones, cameras, smart TVs, and guest devices all share a single network. Often the Wi-Fi password for that network is printed on a sign at the front desk.
That means a visitor's infected laptop, or someone sitting in the parking lot, can be on the same network as the computer where your team handles client information.
The fix: separate your network. Guests should have internet access only, completely isolated from business systems. Business devices should sit on their own segment, and connected gadgets ideally on another. Business-grade networking equipment makes this straightforward and adds monitoring and security updates that consumer routers lack.
5. No Written Plan for "Something Bad Just Happened"
When an employee clicks a bad link, a laptop gets stolen, or ransomware locks up your files, the first hour matters enormously. Yet most small offices have no written plan for what happens next. People panic, make guesses, and sometimes make the situation worse by deleting evidence or waiting too long to call for help.
The fix: write a short incident response plan. It should answer who employees report to, who makes decisions, who to call (your IT provider, your cyber insurance carrier, your attorney, your bank), and how to communicate with clients if needed. Then walk through a realistic scenario with your team once a year so the plan feels familiar.
Why These Five Matter So Much
These five gaps show up again and again in real-world incidents affecting small businesses. Attackers rely on them precisely because they are so common. Close these doors and you move your business out of the easy-target category, which is exactly where you want to be.
A Note for Florida Insurance Agencies
Every item on this list directly supports the safeguards Florida Rule 69O-128.032 expects agencies to maintain. MFA and access reviews are technical and administrative controls. Network separation is a technical safeguard. Tested backups protect the integrity and availability of customer information. An incident response plan prepares you to meet notification obligations under the Florida Information Protection Act. Fixing these five things and documenting the work strengthens your written information security program significantly.
Want Me to Take a Look?
Main Event Managed Services is based right here in Wesley Chapel, and we work with businesses throughout the Tampa Bay area. Our on-site assessment is designed to find exactly these kinds of gaps and give you a clear, prioritized plan to fix them. Visit maineventmsp.com and let's set up a time for me to walk through your office.
