Technology is now central to almost every business, but that does not necessarily mean business owners understand where the risks lie.

From believing your business is too small to be targeted to assuming Microsoft 365 has everything backed up, here are five IT assumptions that could leave your organisation more exposed than you realise…

1. “We’re too small to be targeted by cybercriminals.”

It is easy to assume that cybercriminals are primarily interested in large organisations with thousands of employees and valuable data. In reality, the size of your business does not necessarily determine whether you become a target.

Many cyberattacks are automated, with criminals using tools to scan large numbers of businesses for vulnerabilities, exposed systems and compromised credentials. Smaller organisations can sometimes be particularly attractive because they may have fewer security resources and less sophisticated protection in place.

Your business does not need to be famous to be targeted. It simply needs to have something an attacker can exploit.

2. “Microsoft 365 means our data is already backed up.”

Moving your email, documents and other data into Microsoft 365 provides significant benefits, but using a cloud service is not the same as having a dedicated backup strategy.

Microsoft provides mechanisms for recovering certain deleted or lost data, but these have limitations around retention periods, deletion and the type of incident involved. If files are deliberately deleted, compromised or encrypted during a cyberattack, relying solely on the platform may not provide the recovery options your business needs.

A separate, properly configured backup can provide an additional layer of protection and help your organisation recover when something goes wrong.

3. “Our antivirus will protect us from cyberattacks.”

Antivirus remains an important part of a business’s security, but modern cyber threats have moved far beyond traditional computer viruses.

Attackers increasingly rely on phishing, social engineering, stolen passwords and compromised accounts. If someone obtains a legitimate user’s credentials, for example, they may be able to access business systems without triggering the type of warning you would expect from traditional malware.

Effective cybersecurity therefore needs to be layered, combining endpoint protection with measures such as MFA, email security, patch management, access controls, security awareness and monitoring.

4. “We have cyber insurance, so we’re covered.”

Cyber insurance can provide valuable financial protection following a cyber incident, but it should not be viewed as a substitute for security.

Policies can include specific conditions relating to the controls a business has in place, such as MFA, backups, access management and security monitoring. If an organisation fails to meet those requirements, it could affect how a claim is handled.

Insurance is an important part of managing cyber risk, but preventing an incident in the first place should remain the priority.

5. “Our passwords are strong, so we don’t need MFA.”

A strong password is useful, but it cannot protect an account if the password itself is stolen.

Credentials can be captured through phishing attacks, leaked during data breaches or obtained through other forms of social engineering. Multi-factor authentication provides another layer of verification, meaning a stolen password alone is less likely to be enough for an attacker to access the account.

For businesses, MFA is one of the simplest ways to strengthen account security and reduce the impact of compromised credentials.

The biggest risk could be what you assume is already protected as cybersecurity is not about having one perfect security product. It is about understanding where your business is vulnerable and putting the right layers of protection in place.

If your security strategy is based on assumptions rather than a clear understanding of your risks, it may be time to take a closer look.