Picture a four-person studio the day before a deadline. The video is rendering, the client has asked for one more change, and an email arrives from a supplier: their payment details have changed. The message has a signature, a logo and the usual sense of urgency. Someone takes care of it between exports.
The mechanism is familiar: an apparently legitimate payment request can send money to a different account. The FBI describes this kind of fraud as business email compromise. It can work while the working day still looks perfectly ordinary.
That is a more useful way to think about cybersecurity for a small business. What needs to keep working tomorrow? Who can open projects, manage financial accounts and speak to clients on the company’s behalf? These questions fit the everyday life of an agency, a shop or someone working alone.
Start with the email account that recovers everything else
Your inbox holds approvals, contracts and conversations. It also receives password-reset links. Anyone who takes control of it can therefore try to access other services and impersonate you. The UK NCSC’s guide for small organisations, reviewed in July 2026, puts email protection near the beginning.
Make a short inventory: email, storage, banking, website, domain and social media. Record who manages each account and how to recover it. For a studio, include client platforms your team can access. This list reveals dependencies that remain invisible while everything is working.
If a service offers passkeys, they are worth adopting. These access credentials are managed by your device or password manager, and you usually use them by unlocking your device. They resist scams designed to capture credentials on fake websites. The NCSC recommends prioritising them for important business accounts. If a password remains enabled as an alternative, it still needs protection.
A different password, without the memory test
For accounts that use passwords, combine a long, unique password with multifactor authentication, or MFA. This requires another proof of identity beyond the password. CISA recommends phishing-resistant methods, such as physical security keys, wherever possible. Authenticator apps are another option; text-message codes offer more limited protection, but they are better than relying on a password alone.
A password manager helps you create and store different passwords. That way, the password for a forgotten tool is no longer the same one protecting your email. Secure the manager itself with a strong, unique password and MFA where available.
Sort out recovery while everything is fine. Your phone could break just when you need to sign in. Set up the alternatives the service offers and keep recovery codes somewhere safe that you can reach without that device. This preparation is part of the NCSC’s guidance on two-step verification. Discovering that your only way back in is stored inside the locked account is an unwelcome surprise.
The freelancer has finished. Has their access ended too?
Projects end; permissions can linger. Does the person who worked on a campaign six months ago still manage your social accounts? Can the maintenance provider open every folder? An access review turns these questions into concrete tasks.
Give each person the access their work requires and remove what they no longer need. Where the platform allows it, choose individual invitations with defined roles rather than passing the same login around the group. Before deactivating someone’s account, transfer the files and responsibilities your business needs to retain.
The NCSC advises removing or disabling unused accounts and periodically reviewing who can access important services. The NIST guide for small businesses recommends limiting access to sensitive information to those who need it. When you wrap up the next project, the review can sit alongside handing over the files and sending the invoice.
The backup test is opening the project
“It’s in the cloud” still leaves questions unanswered. What was copied? Are previous versions available? Who can recover the files? How long does your plan retain that data? The answers depend on the service and its settings.
Choose a project and try restoring a copy into a separate folder without overwriting the original. Open the file and check that the images, videos and other necessary elements came with it. An editing project without its linked media can be a rather incomplete reminder of your work.
The NCSC recommends checking what your backups contain and knowing how to restore them. It also advises disconnecting external storage when it is not in use, because some malicious software affects connected drives. Combine backups and protections to suit your operation, including MFA for online storage.
Decide how much work you would be willing to redo. Someone producing work all day may need more frequent backups than someone updating a few documents each week. That choice gives your backup schedule a practical purpose.
The urgent payment can wait for a phone call
Back to the supplier in the opening scene. One simple rule changes the outcome: a change of bank account must be confirmed through an established contact, outside that message. The FBI recommends verifying payment requests and changes to payment details with the person responsible. A phone number inside the suspicious email could lead to the same scammer.
Agree on this rule before the urgent request arrives, including for requests from the boss. Nobody then has to improvise a conversation about trust while the deadline approaches. The pause is already part of the job.
It is also worth agreeing on whom to notify about a suspicious link, an unfamiliar login or an approval made by mistake. The NCSC points out that fraudulent messages can be convincing. Looking only for glaring spelling or grammar mistakes is far too narrow a filter.
Prepare the way back
Set aside time to keep operating systems, browsers and apps up to date. Enable automatic updates where appropriate and check that they have been applied. According to the NCSC, updates fix flaws that criminals can exploit; some browsers need to be reopened to finish the process. If a program no longer receives security fixes, plan to replace it.
Finally, write a page listing support contacts, the person responsible for the accounts, where backups are kept and what needs to come back first. Keep it available even if email becomes inaccessible. The NIST guide includes recovery responsibilities and priorities: knowing who does what saves you from making every decision in a panic.
None of these measures guarantees complete security. They help reduce risk and prepare you to get back to work. To start today, choose your main email account, review its protection and check its recovery options. Then open a backup. The next deadline already has enough complications in the brief.
