Last updated: 16 June 2026
Most people think of cybersecurity as something advanced — hackers in dark rooms, complicated attacks, code they will never understand. The reality is far more everyday, and that is precisely why it is dangerous. The vast majority of incidents are not down to brilliant attacks, but to simple holes that were never closed: a reused password, an email someone should not have clicked, an update that was postponed for a year.
The good news is that the same principle works the other way. You do not have to be an expert to become significantly safer. You have to close the holes attackers actually use.
The big picture
Cybersecurity is not a product you buy once. It is a state you maintain — the sum of small choices you make every day. An attack is rarely about someone "breaking in". Much more often it is about someone being tricked, or a door being left open.
The most common threats are surprisingly few and predictable:
- Phishing — fake emails or messages that trick you into giving up a password or clicking something you should not.
- Reused passwords — one leaked password gives access to everything it has been used on.
- Outdated software — known vulnerabilities in standard programs that were never updated.
- Ransomware — which locks your files and demands payment, often after a single wrong click.
The decisive point: most attacks are opportunistic, not targeted. The attacker is not looking for you specifically — they are looking for the easiest door. Your goal is not to be impregnable. It is to be harder than your neighbour.
Personal security
Here is what actually moves the needle for an individual, in order of priority:
Use unique passwords — and a password manager. The single most important thing you can do. When every service has its own password, a leak in one place means nothing for the rest. You do not have to remember them; a password manager does the job.
Turn on two-factor authentication (2FA). Even if someone gets your password, they cannot get in without the second factor. Use an authenticator app or passkeys where possible — that is safer than SMS.
Keep things updated. Operating system, browser and apps. Updates are not just new features — they close holes that are already known to attackers.
Learn to recognise phishing. Be sceptical of urgency and unexpected links. Check the sender, and log in manually rather than clicking through from an email.
Take backups. A copy of what matters, separated from the main device, turns a ransomware attack or a broken disk into an irritation instead of a catastrophe.
These five things cost little and cover the vast majority of the risk an ordinary person faces.
Business security
For a business the picture is broader, because you are not only protecting yourself — you are protecting customers, employees and data you are responsible for. It is as much about people and routines as about technology.
People are the front line. Most incidents start with an employee being tricked, not with a technical breakthrough. Awareness and simple routines are cheaper and more effective than most people think.
Manage access by least privilege. People should have access to what they need for the job — no more. When someone leaves or changes role, the access should follow. Most serious leaks involve access rights that were never cleaned up.
Backups that are actually tested. A backup you have never tried restoring from is not a backup — it is a hope. Test restores regularly, and keep at least one copy separated from the rest.
Keep systems updated. Patching servers, applications and dependencies is boring and absolutely decisive. Most exploited vulnerabilities are old and known.
Have a plan for when it goes wrong. Not if, but when. Who is notified, how are things shut down, how do you get back into operation? Half an hour of planning in advance is worth more than a day of panic in the moment.
Think about the supply chain. The services and suppliers you depend on are part of your own security. A hole at a subcontractor quickly becomes your problem.
And perhaps the most important principle: security should be built in from the start, not glued on afterwards. A system tested against common attack methods before launch is in a completely different class from one secured after the fact when something has already gone wrong. This is where methods like penetration testing come in — finding the holes before anyone else does, on systems you own yourself or are permitted to test.
How secure are you, really?
Ask yourself a few honest questions: Do you use the same password in several places? Is two-factor turned on in the most important places? When did you last update? Do you have a backup you actually know works? Does your business know what happens the day something goes wrong?
If you hesitated on any of them, you have already found the first hole to close. You do not have to fix everything in a day. You have to start with the simplest, and the attacker's easiest way in is usually your easiest to shut.
Cybersecurity is not a question of whether you become a target — it is a question of how easy you are to hit. And that is largely up to you.