Five common security gaps to review, with practical steps for protecting accounts, devices and backups.

1. Letting updates fall behind

Security work starts with knowing which devices and applications the business uses, who maintains them, and whether they still receive support. A successful update policy also needs a way to detect failed installations.

Use supported software, test changes where business applications need it, and confirm updates finish. Prioritize actively exploited vulnerabilities and exposed systems rather than waiting for a monthly date in every case. Agree on maintenance windows and recovery steps before changing critical equipment.

2. Relying on passwords alone

Give each person a separate account and a unique password stored in an approved password manager. Shared administrator logins make access harder to control and investigate. Remove unnecessary privileges and review accounts when people leave.

Enable MFA for email, remote access and administrative accounts. Prefer phishing-resistant options such as passkeys or security keys where supported. MFA reduces risk; it does not make account compromise impossible.

Do not force password changes every 90 days as a universal security rule. NIST guidance rejects routine periodic changes and calls for changes when there is evidence of compromise. Long, unique passwords and checks against compromised passwords are more useful than predictable resets.

3. Confusing a backup job with recoverability

A green backup status is a starting point. The business still needs to know what is protected, how far back it can recover, and how long restoration could take. File synchronization and retention features may not cover every recovery scenario.

Keep recovery copies protected from the same credentials and incidents that can affect production. Where appropriate, use offline or immutable copies, monitor failures and perform isolated restore exercises. Include applications, configuration and encryption-key recovery in the plan, not only documents.

For Microsoft 365, compare built-in retention and recovery capabilities with your retention needs and recovery targets. Decide whether an additional backup service is needed from those requirements, rather than assuming that cloud storage alone answers the question.

4. Making suspicious messages hard to report

Training works better when employees can report concerns without being blamed. Show people how to report a suspicious email and who to call if they entered a password, opened a file or approved an unexpected sign-in prompt.

Practice verification for payment changes and sensitive requests using a trusted contact method. Treat a polished message from a familiar account as something to verify when the requested action is unusual.

5. Leaving ownership unclear

Make a short list of the systems that keep the business operating. Assign an owner for updates, account reviews, backup checks and incident decisions. Document the contact path for a serious outage and keep recovery information available when normal email is unavailable.

An internal team, an outside provider or a combination can own this work. What matters is a documented scope and evidence that the agreed checks happen. Buying a tool or service does not, by itself, complete the work.

Where to start

Choose the highest-impact gap, assign an owner and agree on how you will verify the fix. A useful first review covers administrator MFA, supported devices and an actual restore test. Guerrero Consulting can help assess the environment and prepare a written scope for the next steps.

References

Technical references reviewed October 21, 2026. Product features and licensing can change.

Back to all articles

5 Cybersecurity Mistakes Small Businesses Should Review