ABOUT THIS EPISODE
October is Cybersecurity Awareness Month, and this year's theme is Don't Make It Easy for Them. Jason Russell counts down ten moves that make a small business a harder target, from locking down your Wi-Fi to the one setting Microsoft's research found cuts the risk of account compromise by more than 99%.
First, he retires a statistic you've probably seen: that 60% of small businesses close within six months of a cyberattack. Reporters found no study behind it, and the organization it's usually credited to has asked people to stop using it. What does hold up: the FBI logged more than one million internet crime complaints in 2025, with nearly $21 billion in reported losses, and Florida ranked third in the country for both.
The countdown
- #10 Lock down your Wi-Fi and retire the old router. Why the FBI says end-of-life routers should be replaced.
- #9 Protect the devices themselves. Screen locks, encryption, remote wipe, and why EDR watches for what antivirus misses.
- #8 Give people only the access they need. Separate admin accounts, same-day offboarding, and the vendors who can still log in.
- #7 Use a password manager. A unique password for every account, and why to take the passkey when a site offers one.
- #6 Write a one-page incident plan, and print it. Who to call first, and how the FBI froze $679 million in 2025 for victims who reported fast.
- #5 Train your team for the scams they'll actually get. In Verizon's phishing tests, text and phone scams drew a 40% higher click rate than email.
- #4 Keep everything updated, and retire what can't be. Software flaws are now the top way attackers get in, plus what Microsoft's Windows 10 extension does and doesn't change.
- #3 Back up like you'll actually need it. Offline, immutable and tested, because a backup you've never restored from is just a hope.
- #2 Verify every payment change with a phone call. Business email compromise cost victims more than $3 billion in 2025, and voice cloning is now part of the playbook.
- #1 Turn on multi-factor authentication, starting with email. Why email comes first, which kinds of MFA are strongest, and what to cover next.
Chapters
- 0:00 Intro
- 0:10 The 60% statistic that isn't real
- 1:17 Don't Make It Easy for Them
- 2:01 #10 Wi-Fi and old routers
- 2:53 #9 Protecting the devices
- 3:43 #8 Access and offboarding
- 4:44 #7 Password managers and passkeys
- 5:39 #6 The one-page incident plan
- 6:47 #5 Training for texts and calls
- 8:04 #4 Updates and end-of-life tech
- 9:37 #3 Backups
- 10:37 #2 Verifying payment changes
- 12:08 #1 MFA, starting with email
- 13:24 Recap and where to start
- 14:16 How to reach Jason
Mentioned in this episode
- Episode 1: How to Answer Cyber Insurance Renewal Questions Without Voiding Your Policy
- Episode 2: Your Email Domain Is Being Spoofed (Here's How to Stop It)
- Episode 3: how to find and vet a managed service provider
Sources
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report
- Verizon, 2026 Data Breach Investigations Report
- Verizon, 2026 DBIR and Breach Impact Study insights for SMBs
- National Cybersecurity Alliance, Cybersecurity Awareness Month 2026
- FBI, Operation Winter SHIELD
- FBI, Cyber Criminal Proxy Services Exploiting End of Life Routers
- Microsoft Research, How Effective Is Multifactor Authentication at Deterring Cyberattacks?
- Microsoft, Windows 10 Extended Security Updates
- Tom's Hardware on the Windows 10 extension
- Nextgov, How a Fake Cyber Statistic Raced Through Washington
Need help with your list?
If you couldn't check off more than a few, email Jason directly at jason@harmony-msp.com. Tell him which numbers you're stuck on, and he'll help you figure out where to start.
Harmony MSP provides managed IT and cybersecurity for small businesses, medical and dental practices, law firms, and accounting firms across Central Florida. harmony-msp.com
