Forget ghosts. These are the things that should keep you up at night.
As Cybersecurity Awareness Month wraps up on Halloween, we wanted to share the real horrors we encounter when assessing small business networks around Wesley Chapel and Tampa Bay. None of these are exaggerated. All of them are common. And every one is fixable.
1. The sticky note password
The admin password is written on a sticky note under the keyboard, on the monitor, or taped inside a drawer. Anyone who walks by, including cleaning crews, vendors, and visitors, has the keys to your systems.
The fix: Move every credential into a business password manager, then change the ones that were exposed.
2. The "Passwords" spreadsheet
A shared file with every login the business uses, often accessible to the entire office and synced to personal devices.
The fix: Same answer. A password manager allows secure sharing with access controls and an audit trail.
3. Zombie accounts
Email and app accounts for people who left months or years ago, still active and unmonitored.
The fix: Review every account against your current staff list, disable the rest, and build an offboarding checklist.
4. Backups that quietly died
The backup software shows a green check mark from long ago. Nobody noticed it stopped running. Or it runs, but no one has ever tested a restore.
The fix: Monitor backup jobs daily and test restores on a schedule. Keep at least one copy isolated from your network.
5. The factory default firewall
The firewall or router still uses the login printed on the sticker. Its firmware hasn't been updated since installation.
The fix: Change default credentials, update firmware, and turn off remote management you don't use.
6. Email with no MFA
Business email protected by a password alone. It's the single most common entry point for business email compromise and ransomware.
The fix: Turn on MFA today, and move toward passkeys for admin and finance accounts.
7. The secret forwarding rule
A hidden inbox rule sends copies of every email to an outside address. Sometimes an employee set it up for convenience. Sometimes an attacker did.
The fix: Audit mailbox rules and block automatic forwarding to external addresses.
8. Computers that time forgot
PCs running operating systems that no longer receive security updates, like Windows 10 after its end of support, or older.
The fix: Upgrade or replace them. A computer that can't be patched can't be secured.
Why these keep showing up
Most small businesses don't have someone whose job is to look for these problems. Technology gets set up once and then left alone. Nothing seems wrong until something goes very wrong.
For Florida insurance agencies
Each item on this list is a gap in the administrative, technical, or physical safeguards Rule 69O-128.032 expects licensees to maintain. Several are also standard questions on cyber insurance applications.
Your Halloween challenge
Grab a coffee (or some leftover candy) and walk through this list for your own business. Count how many apply. If it's more than zero, you know where to start in November.
Main Event Managed Services helps small businesses and insurance agencies across Wesley Chapel and Tampa Bay find and fix these hidden risks. Visit maineventmsp.com to start the conversation.
