Skip to main content

Cybersecurity Guides: Accounts, Passkeys and Small Business

Cybersecurity is mostly a set of boring habits done consistently. This section covers accounts, devices, backups and incident response for people and small businesses that do not have a security department.

We prioritise controls that reduce the most likely risk for the least effort, and we test the recovery path, not just the setup. A measure that locks people out or gets disabled after a week is not protection.

How we judge security advice

We start with the attacks people actually face: a reused password, an unpatched laptop, a convincing invoice email, a backup that has never been restored. Controls that address those risks come first.

We also check the recovery path. A passkey that leaves you locked out of your own account is not an improvement, and a backup you cannot restore is a hope rather than a plan.

Accounts are the front door

Email is the priority because it can reset almost everything else. Unique passwords, a password manager and multi-factor authentication on email, banking and admin panels remove most simple account takeovers.

Give every person their own account and grant the minimum access they need. Shared logins make it impossible to know who did what, and a departed employee's login is a permanent risk.

Passkeys change the login

Passkeys replace the password with a key held by your device. They resist phishing because they are bound to the website's domain, and there is no shared secret to steal from a server.

The weak point is recovery. Register a passkey on at least two devices, keep a fallback that does not depend on one phone, and update onboarding and offboarding in the same week.

Where to start

Start with the small-business checklist to cover accounts, updates and backups, then read the passkeys guide before you change how your team signs in.

Rehearse the first hour of an incident before you need it: who to call, what to disconnect and where to report. Speed matters, but so does a clear head.

Latest Cybersecurity guides