The five, in brief
None of these are exotic. That's the uncomfortable part.
- Believing you're too small to be a target. Attackers don't browse; they scan. The bot that finds your open remote access has no idea how many employees you have, and wouldn't care.
- MFA nowhere, or only somewhere. The common version is MFA with exceptions: the owner's mailbox, the old VPN account. Attackers only need the one door you left convenient.
- Backups nobody has ever restored. An untested backup is a hope, not a backup. Ransomware crews delete every backup they can reach before they trigger.
- Everyone's an admin. When everyday accounts have admin rights, every phishing click runs with full power. Least privilege is the difference between an infected laptop and an infected company.
- No plan for the bad day. The breach isn't the expensive part; ten days of improvising is. A one-page plan turns weeks into days.
The PDF adds:
- What each mistake costs, with the math
- The fix for each, ranked by effort (most take under a week)
- A self-check table to find out which ones are yours