A routine email arrives asking you to update a vendor’s banking details. Your phone prompts you to approve a login you did not initiate. A critical application stops working, and the backup nobody has tested becomes your only recovery option. Cybersecurity often comes down to ordinary moments like these—not just sophisticated attacks against large organizations.
The FBI’s 2025 Internet Crime Report records 1,008,597 complaints submitted to its Internet Crime Complaint Center, or IC3, and $20.877 billion in reported losses. Those figures describe complaints received by IC3, not the full extent of cybercrime. They nevertheless underscore why protecting accounts, payments and business operations deserves consistent attention.
The practical response is not to buy every security tool available. It is to build reliable habits around five priorities: stronger authentication, unique passwords, independent verification, software updates and tested recovery. None guarantees complete protection. Together, they reduce common opportunities for attackers and improve your ability to recover when something goes wrong.
1. Strengthen Account Security
A password alone provides limited assurance that the person signing in is the legitimate account owner. Multifactor authentication, or MFA, adds another requirement, such as possession of an authenticator or security key.
Start with accounts whose compromise would create the greatest damage: business email, administrator accounts and remote access. For individuals, primary email deserves particular attention because it often receives password-reset messages for other services.
CISA recommends MFA and emphasizes phishing-resistant methods. Where available, prefer appropriately implemented passkeys or FIDO security keys. These methods bind authentication to the legitimate service, helping prevent a look-alike website from capturing a usable login credential.
Understand the differences between MFA methods
Manually entered one-time codes are not phishing-resistant. An attacker can create a fake login page that collects your password and code, then immediately uses both on the real service. Codes can still improve protection compared with passwords alone, but they should not be treated as equivalent to phishing-resistant authentication.
Never approve an unexpected authentication prompt. Repeated prompts may indicate that someone is attempting to access your account. Reject them and investigate through the service’s official website or your organization’s support team.
Practical example: A business protects its email with a security key but leaves an administrator account password-only. That overlooked account remains a serious weakness. Review privileged accounts and recovery options, not just everyday employee logins.
Your next step: Check the authentication options on your most important accounts and enable the strongest supported method. Store recovery codes securely, and make sure account recovery does not depend on an outdated phone number or an unprotected email account.
2. Stop Reusing Passwords
Password reuse turns one company’s breach into a potential problem across many unrelated accounts. Attackers can try stolen username-and-password combinations against email, shopping, banking and business services—a technique known as credential stuffing.
The solution is straightforward: every account that requires a password should have a long, unique one. The challenge is managing those credentials without relying on memory or predictable variations.
NIST recommends password managers and emphasizes password length. A password manager can generate and store unique credentials, making safer behavior practical rather than burdensome.
Protect the password manager itself
- Use a long, unique master password or passphrase.
- Enable MFA where supported, preferably a phishing-resistant option.
- Keep recovery information secure and accessible to the appropriate person.
- For businesses, use controlled credential-sharing features rather than distributing passwords through email or chat.
Practical example: Adding an exclamation point to a password you already use elsewhere does not create meaningful independence between accounts. Generate a genuinely different password instead.
Your next step: Replace reused passwords on email, financial services and business systems first. If a service notifies you that a password was compromised, change it there and anywhere else you reused it.
3. Verify Requests Before Transferring Money
A convincing message is not proof that a payment request is legitimate. Attackers may impersonate an executive, compromise a supplier’s mailbox or insert themselves into an existing email conversation. The message can contain accurate names, invoice details and familiar language.
AI-generated writing, audio and video can also make impersonation more persuasive. The right defense is not expecting employees to recognize every fake. It is designing a process that does not rely on appearances alone.
FBI guidance on business email compromise recommends independently verifying payment changes and transactions in person or through a known telephone number. Do not use contact details supplied in the suspicious request.
Make verification a rule, not a judgment call
Establish a callback procedure for changes to vendor banking details, payroll instructions and other sensitive payments. Use a previously verified number from your records. Where practical, require separate approval before changing payment information or releasing funds.
Practical example: A supplier emails new bank details just before an invoice is due. Rather than replying for confirmation, the accounts payable employee calls the supplier using the number already on file. The payment remains on hold until the change is independently verified.
Your next step: Document who verifies changes, which contact records they use and who approves the transaction. Make clear that urgency, seniority or secrecy never overrides the procedure.
A security process should still work when a message looks authentic and the person receiving it feels rushed.
4. Keep Software Updated—and Assign Responsibility
Software vulnerabilities can give attackers a path into devices and business systems. Updates often close those openings, but protection depends on actually installing the fix—not simply receiving a notification that it exists.
Include operating systems, browsers, applications, business security tools and network equipment in your update process. Enable automatic updates where appropriate, and confirm that devices restart when required.
For organizations, CISA’s cybersecurity essentials guidance recommends software updates and using its Known Exploited Vulnerabilities Catalog to help identify urgent patching priorities. Vulnerabilities already being exploited warrant particular attention, especially on internet-facing systems.
Close the ownership gap
“Our IT provider handles it” is not enough unless responsibilities are explicit. Determine who maintains each system, who monitors failures and who confirms that updates were completed. Unsupported software needs an upgrade, replacement or documented plan to reduce exposure.
Practical example: Employee laptops receive automatic updates, but a remote-access appliance is maintained manually. Without an assigned owner, that device can remain vulnerable even while the laptop dashboard looks healthy.
Your next step: List your important systems and assign an update owner to each. For critical business applications, plan testing and rollback without allowing routine caution to become indefinite delay.
5. Test Recovery—not Just Backup Completion
A successful backup notification does not prove that you can recover the files, applications or operations you need. Backups may be incomplete, inaccessible or vulnerable to the same attacker who compromises your production systems.
CISA’s ransomware guidance recommends offline, encrypted backups of critical data and regular restoration testing. Separation matters because attackers may delete or encrypt backups they can reach.
Cloud synchronization is not automatically a recovery strategy. Depending on the service and configuration, deletions or damaged files may synchronize too. Understand retention, version history and restoration capabilities before relying on them.
Test what the business actually needs
- Identify critical information: Include customer records, financial data, essential documents and necessary system configurations.
- Protect backup access: Restrict permissions and secure the credentials and encryption keys needed for recovery.
- Restore in a controlled environment: Test a representative file or system without disrupting production.
- Document the outcome: Confirm that recovered information is usable and record obstacles and recovery time.
Practical example: Restoring an invoice spreadsheet is useful, but it does not establish that an accounting application can restart. Test the components and dependencies required for the workflow you need to recover.
Your next step: Schedule a restoration test, assign an owner and correct any problems it reveals.
Turn the Basics Into an Operating Habit
Businesses need more than individual good intentions. Assign ownership for these controls, limit access to what each person needs and make suspicious activity easy to report. Employees should know whom to contact without worrying that an honest mistake will be punished.
Keep a short incident-response plan with essential contacts and immediate actions. If a fraudulent transfer is suspected, contact the financial institution promptly. If an account or device may be compromised, involve the responsible IT or security team and preserve relevant messages and records.
Your Cybersecurity Checklist: Start Today
Cybersecurity improves through consistent execution, not a one-time purchase. Start with this manageable checklist:
- Strengthen one important account with the best authentication method available.
- Replace one reused password with a long, unique credential.
- Establish a payment-verification rule using independently trusted contact information.
- Review software updates and confirm who owns outstanding work.
- Test a backup and verify that the recovered information is usable.
Then expand those practices across your accounts and business. The goal is not to eliminate every risk. It is to make compromise harder, detect problems sooner and recover with less disruption. Choose one action today, give it an owner and confirm that it works.