New corporate threats demand clear defences

An email from the CEO, a login that looks like it's from Microsoft, or a weak supplier key can be enough to halt operations. New corporate threats rarely appear as a dramatic attack that everyone sees immediately. Instead, they exploit everyday work practices, distributed devices, and small gaps that have been allowed to accumulate.

For managers, the key question is therefore not whether the company is too small to escape the attention of attackers. The question is whether the operation can withstand it when an employee opens the wrong link, a device is lost, or access to critical data is interrupted. Security is not just about preventing an attack. It is about keeping the company running, protecting customer trust, and controlling costs when something goes wrong.

New corporate threats are often threats to operations

Cyberattacks have changed. Previously, it was common to think of malware as an isolated problem on one computer. Now, attacks are often directed at user accounts, cloud services, payment processes, and partners. When an attacker gains entry with the correct login credentials, active defence on a device alone cannot solve the problem.

Four factors in particular need to be considered. Firstly, phishing attacks have become more credible. Fake messages are written in better language, suppliers are impersonated, and the timing is chosen so that an employee reacts quickly. Artificial intelligence has made it easier to create convincing text, fake voices, and messages that match the recipient's role.

Secondly, stolen credentials are valuable. Reused passwords, an inactive user access process, or a lack of multi-factor authentication can open the way to emails, documents, accounting systems, and customer communications. Someone with access to an inbox can even monitor real conversations before attempting to redirect a payment to the wrong account.

Thirdly, ransomware attacks have evolved. Attackers do not always try to encrypt data first and foremost. They copy it, threaten to publish it, and apply pressure where operations, reputation, and contractual obligations are at stake. A copy that only exists on the same network as the original data is not an automatic guarantee.

Fourthly, the technological environment has become more complex. Employees work in the cloud, at home, while travelling, and across multiple systems simultaneously. Every unpatched laptop, unmanaged mobile phone, or access by a former employee adds to the risk. The problem is rarely a single device. It is a lack of overview and responsibility for the whole.

Where do corporate defences tend to be weakest?

Most companies don't have problems because they lack technology. They have problems because the technology is not coordinated, not monitored, or not linked to clear operational responsibility. A defence that is installed but not maintained provides a false sense of security.

Access control is a good example. A company might have multi-factor authentication for most employees but leave exceptions for legacy systems, shared mailboxes, or admin accounts. One exception can be enough. The same applies to passwords: a password manager reduces risk only if it is adopted as a common practice, not as an optional solution for the interested.

Another common gap is unclear responsibility when an employee joins, changes roles, or leaves. Who revokes access? Who reviews mobile phones, cloud storage, add-ons, and access to supplier systems? If the answer is "someone in IT when they have time", the process is not secure enough.

Then there is update management. An operations team might postpone updates for understandable reasons, for example, because a specialised business system must not be interrupted. But the postponement must be a conscious decision, with a risk assessment and mitigating actions. Not knowing which devices are connected or whether they are up to date is not a viable option.

Start with what can stop the workday

It is tempting to buy a new security tool as threats increase. Sometimes, that is the right step. More often, the company first needs to decide what it really needs to protect and how long it can afford to be without access to it. Can the sales team work if email is down for a whole day? What happens if accounting data is inaccessible for a week? Which data would cause the most damage if it fell into the wrong hands?

These conversations move security from a vocabulary of technology to operational decisions. They also help with prioritisation. A company with sensitive personal data, for example, needs to place special emphasis on access control, incident logging, and data retention. A company that relies on specialised on-premises systems needs to test recovery differently than a company that works almost entirely in the cloud.

Good first steps are usually simple, but they need to become part of daily operations:

• Keep an accurate record of users, devices, systems, and administrator access.
• Use multi-factor authentication and unique, strong passwords in a password manager.
• Monitor updates, vulnerabilities, and unusual activity on devices.
• Take backups that are protected against modification and test recovery regularly.
• Train staff with realistic examples of scams, payment requests, and data handling.

The list is not an independent security policy. It is a foundation that allows the company to see deviations, react quickly, and reduce the likelihood that a single mistake becomes an operational disaster.

Recovery needs to be tested, not just purchased

Backups are often called the last line of defence. This is true, but only partially. A backup has limited value if no one knows how long recovery will take, what data is recoverable, or if access to the backups themselves is protected against attack.

Managers should get clear answers to two questions: How much data loss is acceptable, and how long can a critical system be offline? The answer determines how often backups need to be taken, where they are stored, and which recovery plan is suitable. A company that can tolerate a few hours of data loss needs a different setup than a company that deals with real-time transactions.

Regular testing also reveals weaknesses that reports don't find. Is an access key missing? Is there enough storage space? Does staff know who makes the decision to shut down a system or inform customers? When these issues are discussed and practiced in advance, the response will be more considered when it matters.

The human element requires clear processes, not accusations

Employees are often called the weakest link, but this is an oversimplified and unfair description. People work under time pressure, receive many messages, and need to react quickly. Attackers design their scams precisely with this in mind.

A better approach is to build a culture where an employee can stop and ask without fear of appearing ignorant. For example, a payment request that changes bank details should always go through confirmation via a different communication channel. A request for a password, gift card, or unusual file sharing should raise questions, even when it appears to come from a manager.

Training works best when it is short, repeated, and linked to actual work. A single annual course is rarely enough. Staff also need to know where to report suspicious incidents and receive quick, helpful feedback when they do.

Integrated responsibility is more cost-effective than disjointed tools

When security, user support, device management, and backups are handled by different parties, critical tasks can fall through the cracks. One party sees the alert, another has the device, and a third manages the backup. The company is then left as the coordinator in the middle of an incident.

For many small and medium-sized businesses, it makes sense to have a single responsible party who knows the environment, manages daily operations, and can link security decisions to costs and operational needs. This doesn't mean one tool or one service provider solves everything. It means the responsibility is clear and the processes work together.

At nexIT, we approach this as a continuous operational service: we manage devices and users, strengthen defences, monitor deviations, and help companies prepare for recovery before it becomes urgent. The goal is not to make IT more complicated. The goal is for it to support operations with predictable costs and reduced risk.

The next good step is to choose one likely scenario, for example a stolen Microsoft account or a locked accounting system, and review what would happen in the first hour. If the responsibilities, communication, and recovery are clear on paper and tested in practice, the company is in a much better position when the threat becomes real.