How Do You Protect Your Business From Hackers? 10 Essential Steps

How Do You Protect Your Business From Hackers? 10 Essential Steps

You read about it in the news every week: another business hacked, another data breach, another ransomware attack that has brought an organisation to a standstill. And every time you think: that won't happen to us. Until it does. In the Netherlands, 76% of SMEs have already faced a cyberattack or cyber threat. The question is not if, but when your business will be targeted. In this article you will learn, in 10 practical steps, how to protect your business effectively against hackers.

Key takeaways (TL;DR)

• 76% of Dutch SMEs have already faced a cyber threat or attack.
• 95% of all data breaches are caused by human error. Technology alone is not enough.
• The average cost of a cyberattack on an SME is between €150,000 and €250,000 in direct and indirect damage.
• Multi-factor authentication (MFA) blocks 99.9% of all automated attacks on accounts.
• A good backup strategy is your last line of defence and makes the difference between days and weeks of recovery.
• The 10 steps in this article are based on the CIS Controls framework and the recommendations of the Dutch National Cyber Security Centre (NCSC).
• You don't have to do everything at once: start with steps 1-5 and build from there.

Why Hackers Target SMEs

Many business owners think: "We're too small to interest hackers." That is a dangerous misconception. SMEs are in fact a favourite target, for three reasons:

1. Weaker security, easier access Large companies have entire security teams and multimillion budgets. SMEs do not, which makes them easier to hack. For a cybercriminal it is more efficient to attack 100 poorly secured SMEs than one well-secured large company.

2. Valuable data Even as an SME you process valuable information: customer details, bank accounts, contracts, quotes, personnel records. This data is worth money on the black market or can be used for targeted attacks on your customers.

3. A gateway to larger organisations Hackers increasingly use SMEs as a stepping stone to their larger customers. This is called a supply chain attack. If you supply a large organisation and you are hacked, the attacker can get into your customer's systems through you.

The 10 Steps to Protect Your Business

Step 1: Implement Multi-Factor Authentication (MFA) Everywhere

This is the fastest and most effective measure you can take. Multi-factor authentication means a stolen password on its own is not enough to log in. You always need a second factor, such as a code on your phone.

Where to enable MFA:

• Microsoft 365 and all cloud services
• Email accounts
• VPN connections
• Accounting and CRM software
• Banking and financial applications
• Management portals and admin accounts

The impact: Microsoft reports that MFA blocks 99.9% of all automated attacks. It is by far the best cybersecurity investment you can make.

Step 2: Train Your Employees, Because They Are the First Line of Defence

Technology can stop a lot, but 95% of all successful attacks start with human error. An employee who clicks a phishing link, opens a suspicious file or shares sensitive information. Security awareness training is therefore not a luxury but a necessity.

Effective training includes:

• Monthly phishing simulations to test alertness
• Short, interactive training modules (not dull e-learning)
• Realistic scenarios based on current threats
• Clear procedures: what do you do when you spot something suspicious?
• Rewards for reporting suspicious emails, no punishment for mistakes

Result: Businesses with a good awareness programme see the click rate on phishing emails drop from 30% to under 5%.

Step 3: Keep All Software Up to Date

Outdated software is an open door for hackers. Every month, hundreds of vulnerabilities are discovered in widely used software. Vendors release patches to close them, but only if you actually install them.

What you need to update:

• Operating systems (Windows, macOS)
• Microsoft 365 and Office applications
• Browsers (Chrome, Edge, Firefox)
• Firmware on routers, switches and firewalls
• Plug-ins and extensions
• Industry-specific software

Important: Windows 10 support ends in October 2025. Still running Windows 10? Then you will no longer receive security updates and you are vulnerable to new attacks. Migrate to Windows 11 as soon as possible.

Tip: Automate the update process with a patch management system. That way you can be sure nothing is skipped.

Step 4: Make Watertight Backups With the 3-2-1 Rule

Your backup is your last resort. If every other layer of defence fails and ransomware encrypts your systems, your backup strategy determines whether you are back up and running within hours or out of action for weeks.

The 3-2-1 backup rule:

• 3 copies of your data
• 2 different storage media (for example cloud + external drive)
• 1 copy offsite (outside your office/network)

Crucial additions:

• Test your backups at least monthly by actually performing a restore
• Keep backups going back at least 30 days (ransomware can lie dormant for weeks before it strikes)
• Make sure backups cannot be reached directly from your network (air-gapped or immutable storage)
• Document your disaster recovery plan and rehearse it every year

Step 5: Secure Your Email, the Most Important Attack Channel

More than 90% of all cyberattacks start with an email. Phishing, business email compromise (BEC), malware attachments: email is cybercriminals' weapon of choice. Email security is therefore essential.

What you need to implement:

• SPF (Sender Policy Framework): Prevents others from sending emails on behalf of your domain
• DKIM (DomainKeys Identified Mail): Proves that an email genuinely comes from your organisation
• DMARC: Combines SPF and DKIM and determines what happens to suspicious emails
• Advanced spam filtering: Blocks phishing, malware and suspicious attachments
• Sandboxing: Opens attachments in a safe environment before they reach the user

Step 6: Secure Your Network With Segmentation and Monitoring

A flat network, where everything is connected to everything, is a security nightmare. If a hacker gets in through one device, they immediately have access to everything. Network security is all about limiting that freedom of movement.

Essential measures:

• Network segmentation: Split your network into zones (office, guests, servers, IoT)
• Next-generation firewall: Inspect traffic at application level, not just at port level
• VPN or Zero Trust Network Access: For secure remote access
• Network monitoring: Detect unusual traffic automatically
• DNS filtering: Block access to known malicious websites

Consider a Zero Trust approach: trust nothing and no one by default, verify everything.

Step 7: Manage Passwords Professionally

Weak and reused passwords are responsible for 81% of all hacking-related data breaches. Yet many businesses still do not use a password manager.

Implement the following:

• A business password manager (such as Bitwarden, 1Password Business or Keeper)
• A password policy: At least 14 characters, unique to each account
• No password reuse: A different password for every service
• Automatic checks for leaked passwords (Have I Been Pwned integration)
• A shared vault for team passwords with an audit trail
• Passwordless authentication wherever possible (passkeys, FIDO2)

Tip: Always combine a password manager with MFA (step 1). Together they form an almost impenetrable barrier.

Step 8: Protect Endpoints, Because Every Laptop Is a Way In

Every device that connects to your business network is a potential entry point for hackers. Laptops, desktops, smartphones and tablets all need to be protected.

Endpoint security includes:

• Endpoint Detection & Response (EDR): Goes beyond traditional antivirus by detecting suspicious behaviour
• Disk encryption: BitLocker (Windows) or FileVault (macOS) on every device
• Mobile Device Management (MDM): Manage and secure smartphones and tablets
• Automatic screen lock: After 5 minutes of inactivity
• Remote wipe: The ability to erase data remotely if a device is lost or stolen

Read more about endpoint management and MDM for a complete approach.

Step 9: Create an Incident Response Plan

The question is not whether you will face a security incident, but when. And at that moment you do not want to be thinking about what to do for the first time. An incident response plan makes sure everyone knows what needs to happen.

Your plan should include:

• Contact details: Who do you call first? (IT partner, management, legal)
• Classification: How do you determine the severity of the incident?
• Containment: How do you limit the damage? (isolating systems, blocking accounts)
• Communication: Who do you inform internally and externally?
• Notification: When and how do you report to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)?
• Recovery: How do you get back online?
• Evaluation: What do you learn from it?

Rehearse the plan at least twice a year with a tabletop exercise. Just like a fire drill: you don't want your first practice to be during a real fire.

Step 10: Have Your Security Tested Regularly

You can only know how good your security is by having it tested. A penetration test simulates a real attack on your systems and shows where the weak spots are.

Testing methods:

• Vulnerability scan: An automated scan that finds known vulnerabilities (quarterly)
• Penetration test: Ethical hackers try to break in manually (annually)
• Phishing simulation: Tests how employees respond to phishing (monthly)
• Red team assessment: A comprehensive test of your entire security chain (annually for larger organisations)

Start for free: Request a free security scan from TRON Group for immediate insight into your current level of security.

What Does All This Cost?

The cost of cybersecurity for SMEs ranges from €50 to €300 per employee per month, depending on the level. But remember: doing nothing costs far more. A single ransomware attack can cost you €150,000 to €500,000.

What's more, you don't have to do everything at once. Start with the steps that have the most impact:

Start today (steps 1, 2, 3): MFA, awareness training, updates This month (steps 4, 5): Check backups, email security This quarter (steps 6, 7, 8): Network, passwords, endpoints This year (steps 9, 10): Incident response plan, penetration test

Frequently Asked Questions

How do I know whether my business has already been hacked?

Many hacks are only discovered after months. Warning signs include slow systems, unexplained files, suspicious login attempts, unknown processes, or customers reporting spam coming from your email address. If in doubt, always have a security scan carried out.

Isn't an antivirus program enough?

No, definitely not any more. Modern attacks use techniques that traditional antivirus does not detect. You need a layered approach with multiple lines of defence. Antivirus is just one layer.

Should we outsource cybersecurity or do it ourselves?

For most SMEs, outsourcing IT security is the smartest choice. An in-house security specialist costs €60,000-€90,000 a year, and then you have one person with limited availability. A managed security provider gives you a whole team for a fraction of that cost.

How do I protect employees who work from home?

Working from home requires extra attention to security. Provide a secure VPN connection, MFA on everything, a modern workplace with device management, and clear guidelines for working safely outside the office. Also read our guide to securing hybrid working.

How quickly can a hacker get into my business?

Research shows that an experienced hacker can gain access to a poorly secured SME network within 4 hours on average. For businesses with basic security measures (MFA, updates, a good firewall), this rises to weeks or months. Often long enough to detect and stop the attack.

What if we have already been hacked?

Don't panic, but act quickly. Isolate affected systems, inform your IT partner and follow your incident response plan. Read our step-by-step plan for data breaches for a complete guide.

Getting Started

You don't need to be a security expert to protect your business. These 10 steps give you a solid foundation. Start today with step 1 (enabling MFA) and work through the list systematically.

Would you like help implementing these steps? Or do you want to know where you currently stand on security? Get in touch with TRON Group. We are happy to help you with a tailored security plan. Call +31 85 303 5869 or request a free security scan right away.