7 Security Myths I Hear from Small Business Owners Every Week
I have these conversations so often I can predict the script. Here are the seven things business owners tell themselves about security — and why every single one is wrong.
Myth #1: "We are too small to be a target."
This is the one I hear most often, and it is the one that does the most damage. Here is why it is wrong: attackers are not targeting you specifically. They are running automated scans that hit every business with an internet connection. Your website gets scanned thousands of times a day by bots looking for vulnerabilities. Your email domain gets spoofed automatically by phishing kits. Ransomware does not check your revenue before encrypting your files.
Myth #2: "We have nothing worth stealing."
You have a bank account. You have customer email addresses. You have employee Social Security numbers in your payroll system. You have an email system that can be used to phish your customers and vendors. You have computing power that can be used to mine cryptocurrency. You have data that can be held for ransom.
And even if you genuinely have nothing worth stealing — which you do not — ransomware does not care. It encrypts everything and demands payment to unlock it. The attacker does not need to find anything valuable. They just need you to need your files back.
Myth #3: "Our IT person handles security."
Your IT person is probably very good at keeping your computers running and your printer connected to the network. That does not mean they are good at security. IT and security are different disciplines. IT is about making things work. Security is about making things harder to break. These goals conflict.
I have done assessments where the MSP had been managing the client's IT for five years and had never: enabled MFA, tested a backup, reviewed third-party app permissions, or conducted a security risk assessment. Not because they were incompetent — because they were IT people, not security people, and their client never asked.
Myth #4: "We use a Mac, so we are safe."
Macs have excellent built-in security. They are not immune to phishing. They are not immune to credential theft. They are not immune to someone tricking you into approving an MFA prompt. The attack vectors that hit small businesses — phishing, credential theft, BEC, MFA fatigue — are platform-independent. They target the human, not the operating system.
Myth #5: "We have cyber insurance, so we are covered."
Cyber insurance is a safety net, not a security strategy. It covers financial losses from a breach — sometimes. It does not cover the 3 AM panic attack. It does not cover the lost clients. It does not cover the months of rebuilding trust. And your policy has exclusions you probably have not read. Many policies now exclude coverage if you did not have MFA enabled or backups in place when the attack happened.
Insurance pays for the cleanup. It does not prevent the mess. And if you lied on your application about your security measures, it might not even do that.
Myth #6: "Security is expensive."
The most effective security measures are free or nearly free. MFA is free. A password manager has an excellent free tier. Windows Defender is built into Windows. Cloudflare's basic WAF is free. Automatic updates are free. Security awareness training costs your time, not money.
What is expensive is recovering from a breach that these free measures would have prevented. The average cost for a small business data breach is somewhere between $50,000 and $250,000 depending on the details. That is expensive.
Myth #7: "We will deal with security when we get bigger."
This is like saying "we will buy fire insurance after the fire." Security is not a growth milestone. It is not a phase 2 initiative. It is a basic operational requirement, like having a lock on your front door. The time to implement security is before you need it. And the best time was six months ago. The second best time is today.
The Truth Nobody Wants to Hear
Every business owner I have talked to after a breach said some version of the same thing: "I knew I should have done something sooner. I just kept putting it off." The breach was not a surprise. The timing was. They knew they had weak spots. They knew they were putting it off. They just assumed they had more time.
Attackers do not care about your timeline. They do not care that you were planning to set up MFA next quarter. They do not care that backups were on your to-do list. They care that your email account does not have MFA right now.
So here is the uncomfortable question: which of these seven myths are you still believing? And what are you going to do about it today?