Small businesses rarely get taken down by exotic hackers. They get taken down by a backup that never restored, an ex-employee account that never got closed, and an inbox rule nobody noticed. Here are the 11 problems we find over and over in Central New York offices, what each looks like from your chair, and the 30 minute fix.
| # | The problem | The 30 minute fix |
|---|---|---|
| 1 | The backup nobody has ever restored | Restore one real file today |
| 2 | No MFA on email | Turn it on for every mailbox |
| 3 | Ex-employees with live accounts | Pull the user list, disable the leavers |
| 4 | Everyone runs as administrator | Separate admin from daily accounts |
| 5 | The inbox rule you did not write | Check every mailbox’s rules |
| 6 | Updates paused forever | Check update status on every machine |
| 7 | The router still on factory settings | Change the password, close remote admin |
| 8 | Passwords in a spreadsheet | Move the top five accounts to a password manager |
| 9 | The domain name one person controls | Find the registrar, take ownership, set auto-renew |
| 10 | The server in the closet nobody watches | Check disk space and drive health, set an alert |
| 11 | The whole IT department is one person | Write the one-page runbook |
None of these fixes cost money. All of them cost attention, which is why they do not happen. Take them one a day for two weeks and your business is meaningfully harder to kill.
1. The backup nobody has ever restored
The symptom. Somebody says the backups are fine. Nobody can remember the last time a file was actually brought back from one.
Why it happens. Backup software reports success when it runs, not when it produces something restorable. Jobs silently skip the folder that moved, the drive that filled, the database that was locked. Green checkmarks pile up on a backup that cannot restore the one thing that matters.
The 30 minute fix. Pick a file your business genuinely needs, the current books, a live customer folder, and restore it to a different location right now. Open it. Then check the backup actually covers the places people really save work, including the desktop folders nobody admits to using.
When to call someone. If the restore fails, or you cannot tell what the backup covers, get help before changing anything. And if a drive with the only copy of something has already died, stop using it immediately; data recovery succeeds far more often on drives that were powered off early.
2. No MFA on email
The symptom. Logging into company email needs a password and nothing else, from anywhere on earth.
Why it happens. MFA got postponed because someone important found the phone prompt annoying. Meanwhile every password in the company has had years of breach dumps and phishing attempts run against it.
The 30 minute fix. Turn on multi-factor authentication for every mailbox, starting with the owner and whoever pays the bills, the two accounts attackers want most. In Microsoft 365, enabling the built-in security defaults does this in one setting. CISA’s guidance on MFA is blunt about how much compromise this single control prevents.
When to call someone. If an old email protocol or copier-to-email setup breaks when MFA goes on, that is an afternoon of configuration, not a reason to turn it back off.
3. Ex-employees with live accounts
The symptom. Someone left in March. In October their email still receives, their VPN still connects, and their name is still an admin on something.
Why it happens. Nobody owns offboarding. HR handles the paperwork, the manager handles the goodbye lunch, and the accounts belong to whoever remembers.
The 30 minute fix. Pull the full user list from email and from any system that holds money or customer data. Disable every account belonging to someone who no longer works there. Do not delete them yet, mail and files may need to be kept, just disable. Then write a five-line offboarding checklist and name one owner for it.
When to call someone. If you find a departed account that was recently active, treat it as a live incident, not a cleanup item.
4. Everyone runs as administrator
The symptom. Anyone in the office can install anything on their machine, and the same account they browse with can change system settings.
Why it happens. Machines get set up in a hurry with one all-powerful account, and nobody downgrades it later because things work.
The 30 minute fix. On each machine, create a separate administrator account with its own password, then demote the daily account to a standard user. Malware that lands on a standard account gets that user’s files; malware that lands on an admin account gets the machine, and often the network behind it.
When to call someone. When a line-of-business app genuinely refuses to run without admin rights. There is almost always a correct fix for that, and it is never giving everyone the keys back.
5. The inbox rule you did not write
The symptom. A customer swears they replied, and the reply is nowhere. A vendor’s banking details changed over email. Mail is quietly forwarding somewhere, or vanishing into a folder named with a single dot.
Why it happens. When an attacker gets into a mailbox, the first thing they do is add rules that hide their tracks, so invoice fraud can run for weeks in plain sight. We wrote a step-by-step guide to checking your Microsoft 365 tenant for these rules.
The 30 minute fix. Open each mailbox’s rules and look for anything that forwards externally, deletes, or moves mail to RSS and junk folders. Check the tenant-level forwarding settings too. Delete anything nobody owns up to writing.
When to call someone. The moment you find a rule you cannot explain. That is evidence of a compromise, and changing the password alone does not end it.
6. Updates paused forever
The symptom. Machines that get restarted once a quarter, update prompts dismissed for months, and at least one computer still on Windows 10.
Why it happens. Updates interrupt work, so people defer them, and deferral has no immediate cost. The bill arrives later, because almost every mass attack exploits a hole that a patch had already closed.
The 30 minute fix. Walk the office. On every machine, open the update screen, install what is pending, and set active hours so restarts happen at night. List any machine running an operating system that no longer gets patches, that list is your replacement budget. And do not confuse antivirus with patching; our antivirus comparison covers what security software can and cannot do about an unpatched system.
When to call someone. When the machine that cannot be updated is the one running something critical. That is a project with a deadline, not a setting.
Rather have someone check all 11 for you? Book a quick scoping call and we will go through this list against your actual setup.
7. The router still on factory settings
The symptom. Nobody knows the password to the office router or firewall, or everybody does, because it is still admin.
Why it happens. The box the internet company installed worked on day one, so nobody touched it again. Factory credentials and remote management left open on the internet side are standing invitations.
The 30 minute fix. Log into the router. Change the admin password to something long and stored properly. Turn off remote management from the internet side unless you specifically use it. Check for firmware updates while you are in there, and write down which humans now hold the password.
When to call someone. If you cannot get in at all, or guest Wi-Fi, cameras and payment terminals all share one flat network, that is a network support visit, not a settings tweak.
8. Passwords in a spreadsheet
The symptom. A file named passwords.xlsx, emailed between staff, with the bank login on row two.
Why it happens. It started as one person being organized, and it works, which is the problem. Anyone who gets into any mailbox that ever received it now has everything.
The 30 minute fix. Pick a reputable password manager and move the five accounts that could hurt you most: bank, email admin, payroll, accounting software, domain registrar. Give each a long unique password while you are at it. Migrating the rest can wait; the top five cannot.
When to call someone. When you want shared team access set up properly, with the right people seeing the right vaults, and the spreadsheet verifiably destroyed everywhere it was ever sent.
9. The domain name one person controls
The symptom. The company website and email ride on a domain registered years ago by a web designer, a former partner, or an employee’s personal account. Nobody currently at the company can log into the registrar.
Why it happens. Whoever built the first website registered the domain under their own account, and it renewed quietly on their card ever since.
The 30 minute fix. Look up your domain’s registrar and expiry date with a public whois search. Confirm the account it lives in belongs to the business, with a company email as the contact, auto-renew on, and a second trusted person listed. If it lives in someone else’s account, start the transfer this week, while everyone is still on good terms.
When to call someone. If the domain is in the hands of someone unreachable or uncooperative, or expiry is close. A lapsed domain takes your email down with it, and email is how you would have fixed everything else.
10. The server in the closet nobody watches
The symptom. A machine in a closet that everyone depends on and no one looks at. It has been making a new noise lately.
Why it happens. Servers are reliable right up until they are not, and without monitoring, the first symptom anyone notices is the outage. Heat, dust, full disks and aging drives all give months of warning to anyone who is listening. Nobody is listening.
The 30 minute fix. Log in and look: how full are the disks, what do the drive health indicators say, when did it last reboot, is anything screaming in the event logs. Clear space if a disk is past 90 percent, and set up the built-in email alerts so the machine can ask for help before it fails.
When to call someone. A drive reporting errors, a RAID array running degraded, or a server past its warranty carrying data that exists nowhere else. That machine deserves monitoring every day, which is a large part of what managed IT is.
11. The whole IT department is one person
The symptom. One employee, or the owner’s nephew, or a semi-retired friend, holds every password and every piece of knowledge about how the systems fit together. None of it is written down.
Why it happens. It grew that way, and it keeps working, so the risk stays invisible. The test is one question: if that person were unreachable for a month, starting now, what breaks?
The 30 minute fix. Have that person write the one-page runbook: where the domain is registered, who the internet provider is, where backups go, what the critical machines are, and where the passwords live. Print it, seal it, and put it where the owner can find it. Thirty minutes of writing converts a company-ending risk into an inconvenience.
When to call someone. When the page cannot be written because nobody, including that person, actually knows the answers. Documenting an undocumented setup is exactly the kind of work to schedule calmly, before the month it becomes archaeology.
The pattern behind all 11
Every problem on this list is an ownership problem wearing a technology costume. The backup, the accounts, the updates, the router, the domain: each one failed because it belonged to nobody. The fixes take 30 minutes each; the discipline of keeping them fixed is the actual product. Whether that discipline lives with a person inside your business or with a provider matters much less than whether it exists. Give each item an owner and a date, and this list stops being scary.
Want a second set of eyes on your list?
We have been finding and fixing exactly these problems for Central New York businesses since 2005, on-site across Upstate New York and remotely everywhere else. A short call is enough to tell you which of the 11 deserve your next two weeks, and you get the findings straight, in plain English, whether or not you ever hire us.
Book a quick scoping call or call (315) 682-6372.
Questions owners ask about this list
Which of the 11 should we fix first?
MFA on email, today. It is the highest return half hour in small business security because email is where password resets, invoices and wire instructions all live. Second is restoring one file from backup, because it tells you whether your safety net exists. Everything else can follow one item a day.
We already have an IT person. Does this list still apply?
Yes, as a checklist to hand them. A good IT person will come back with evidence: here is the restore test, here is the MFA report, here is the user list after cleanup. If the response is trust me, it is all handled, with nothing to show, that is problem 11 on the list, and it is worth a second opinion.
How do we know if our backup actually works?
There is only one test: restore something real and open it. Reports and green checkmarks describe whether the job ran, not whether the data is usable. A monthly restore of one meaningful file, done by calendar reminder, is more protection than any dashboard.
What would it cost to have someone check all 11 for us?
Our hourly rates are published on the booking page, $199 an hour for remote business support and $219 on-site, and a review like this is a scoping conversation first: what you run, what already hurts, what to check. You get a price in writing before any work starts, and most of the fixes on this list are settings and discipline, not purchases.
