Book a Demo
Platform Phishing Simulation Pricing Blog About CyberWatch AI Scan Sign in
Blog/Security basics

A One-Hour Cyber Risk Review for Small Businesses

You do not need a consultant to understand your biggest cyber risks. Five questions a small business owner can answer in an hour, and how to act on the answers.

CyberWatch AI4 October 2026 · 2 min read
A business owner working on a laptop at a standing desk

Most small businesses know they should "do something about cyber security" but do not know where to start. This one-hour review turns a vague worry into a short, prioritised list.

The five questions

  1. What would stop us trading? Email, the till, the booking system, the accounts software? List the systems you cannot work without.
  2. Where is our money most exposed? Who can make payments, and how are new payees and bank changes checked? See payment verification.
  3. Who has the keys? Who has admin access to email, banking, the website and social media, and is two-step verification on? See admin accounts.
  4. Could we recover? If a laptop died or ransomware struck tonight, what would we lose? When did we last test a backup? See backup strategy.
  5. What data do we hold about customers and staff, and where? See data protection basics.

Turning answers into action

  • Mark each answer green, amber or red.
  • Pick the reds that could stop trading or lose money, and fix those first.
  • Write down who will do what, and by when.
  • Book the next review in the calendar.

Most fixes are free. Two-step verification, a payment rule and a tested backup protect against many of the incidents small businesses face. See security on a small budget.

Next: the first 30 days of a security programme. For more, see our complete guide to small business cybersecurity.

Frequently asked questions

Who should do the review?

The owner or manager, ideally with whoever handles IT and finance. It works best as a conversation, not a form.

How often should we repeat it?

Once a year, and after big changes such as new systems, new premises or a security incident.

What if we find lots of problems?

Pick the two or three that would hurt most and fix those first. Progress beats perfection.

Sources

  1. Small organisations guide to cyber security, UK National Cyber Security Centre
  2. Cyber Essentials, US Cybersecurity and Infrastructure Security Agency
  3. Cybersecurity for Small Business, US Federal Trade Commission
Share this article
LinkedIn WhatsApp X
For organizations

Your people get these messages at work too.

CyberWatch AI sends your staff realistic practice attacks, trains the gaps it finds, and shows management exactly where the organization stands.

Book a demo Check a message free

Keep reading

All articles →
A wall of labelled keys on hooks
Security basics

Administrator Accounts: Keeping the Keys Safe

Admin accounts can change everything: users, email rules, security settings and billing. How small businesses should protect them with separate accounts, strong sign-in and few admins.

4 October 2026 · 2 min read
A person with an umbrella on a rainy city street
Security basics

Cyber Insurance for Small Businesses

Cyber insurance can help pay for incident response, recovery and some losses. What policies typically cover, common exclusions, and the security basics insurers usually expect.

4 October 2026 · 2 min read
A hand writing in a planner beside a laptop
Security basics

Cybersecurity Frameworks for Small Businesses, Explained

Customers and insurers mention frameworks like Cyber Essentials, NIST CSF and ISO 27001. What each is, who it suits, and which a small business should look at first.

4 October 2026 · 2 min read