Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The most damaging cybersecurity mistakes in 2026 are usually preventable: reused credentials, weak multifactor authentication, convincing messages, unpatched software, exposed network equipment, untested backups, and a lack of response planning. Fix them in that order—identity, trust, maintenance, exposure, recovery, and preparation—and you reduce the ways an attacker can enter, move through, or permanently damage your accounts and data.
This guide separates advice for personal accounts from controls that matter in a small organization. It relies on current guidance from the FBI, NIST, CISA, and the FTC, including NIST phishing guidance updated August 19, 2025.
1. Reusing passwords or leaving multifactor authentication disabled
A password stolen from one service can unlock every other account where it was reused. The FBI states that “Many breaches start with stolen passwords.” A unique credential for every account limits the damage to that one service.
Recommended Free Tools
What to change on personal accounts
- Use a different, long passphrase for every account. A reputable password manager can create and store unique credentials so you do not have to memorize them all. The FBI and NIST both recommend password managers; the FBI also notes that some services support passkeys, which it describes as safer than passwords. See the FBI’s online-safety guidance and NIST’s Cybersecurity Basics.
- Turn on MFA for email, banking, payment, cloud-storage, social-media, administrator, remote-access, and health-data accounts. Your email account deserves priority because it can reset many other passwords.
- Prefer a FIDO2-compatible hardware security key or a device-bound passkey when the service and your device support it. These options are designed to resist phishing better than codes that can be typed into a fake site.
- Never approve an unexpected sign-in prompt and never give a one-time code to someone who calls or messages you. If a prompt appears without an action you initiated, deny it and change the account password from the service’s real website.
What changes for a small business
Require MFA on administrator, email, financial, VPN, remote-desktop, cloud, and customer-data systems. Keep separate administrator accounts rather than using an administrator identity for routine work, and remove accounts when staff or contractors leave. A FIDO2 key or device-bound passkey is preferable for high-impact access when compatible. SMS may be the only option for some legacy services, but plan to replace it rather than treating it as the end state. CISA’s MFA guidance lists available methods; verify the current page’s wording and compatibility before standardizing a method.
#1 Best Overall
| Credential control | Best use | Important limitation |
|---|---|---|
| Unique password stored in a password manager | Accounts that do not offer passkeys or security keys | The manager account itself needs a strong unique credential and MFA. |
| Device-bound passkey | Supported personal and business services | Availability and recovery options vary by service and device. |
| FIDO2 hardware security key | High-value administrator, financial, and remote-access accounts | Check that the service, browser, and devices support the key and keep a recovery method. |
| SMS or email code | Fallback when stronger methods are unavailable | Codes can be intercepted or entered into a phishing page; replace this method where feasible. |
2. Trusting an urgent link, attachment, or request
Phishing is a social-engineering problem, not just an email problem. NIST defines it as messages that persuade people to open harmful links or download malicious software, and says it can arrive by text message, phone call, social media, or postal mail. AI can make a fraudulent message sound polished and familiar, so grammatical errors are no longer a reliable test. Read NIST’s phishing guidance (which asks, “Were you ‘phished’?”) for the current channel list.
A verification procedure that works
- Stop when a message requests a password, payment, gift card, wire transfer, confidential file, software installation, or immediate action.
- Do not click its link, open its attachment, scan its QR code, reply, or use its phone number. Inspecting a sender address is useful, but a familiar-looking address can still be forged or compromised.
- Find the organization’s address independently: type a known website into the browser, use a bookmarked portal, or call a number from a contract, statement, or previous verified record.
- Ask the known contact to confirm the request and the exact destination account or file. For a new payment instruction, require a second person to approve the change.
- Report the message through your mail or messaging service and your employer’s security channel, then delete it only after preserving information your organization needs for investigation.
The FBI summarizes the safe choice this way: “When in doubt, go to the official website or contact customer support instead of using links in unsolicited emails or messages.” — FBI, Staying Safe Online: Tips for Adults. Its full advice is at the FBI’s adult online-safety page.
Business-specific payment controls
In a small organization, email alone must never authorize a change to bank details, payroll information, a supplier account, or a wire transfer. Call a known contact using a number already on file, not one supplied in the request. Require documented approval and preserve the original request so a later investigation can establish what happened. The FTC includes independent verification and response planning in its small-business cybersecurity guidance.
3. Delaying updates or installing software from untrusted sources
Security updates close weaknesses that attackers already know how to exploit. The FBI warns that end-of-life technology no longer receives security updates and is routinely targeted. NIST and the FBI both urge patching and vulnerability management.
Personal-device maintenance
- Enable automatic updates for the operating system, browsers, phones, tablets, apps, and security software.
- Restart when an update requires it; a downloaded patch that has not been installed has not protected the device.
- Install apps only from the operating system’s official store or the software maker’s verified website. Avoid “cracked” programs, unsolicited browser extensions, and downloads offered by a pop-up.
- Replace devices and software that no longer receive security updates. If replacement must wait, stop using the device for sensitive accounts and isolate it from other systems.
Small-business vulnerability management
- Inventory internet-facing services, cloud applications, routers, endpoints, and software versions. You cannot patch what nobody knows exists.
- Assign an owner for each system and a risk-based deadline for remediation. Critical internet-facing flaws need faster action than low-impact defects on an isolated workstation.
- Remove unnecessary public exposure, close unused ports and services, and retire unsupported products. If retirement is impossible, isolate the system and restrict access while planning replacement.
- Verify that updates completed and record exceptions, including who accepted the risk and when it will be revisited.
The FBI’s Improve Cyber Resiliency actions explain why unsupported technology is a liability; NIST’s basics guide provides a small-business starting point.
4. Leaving a home or small-business router at its default settings
A router is the gate between local devices and the internet. Default administrator credentials, enabled remote management, outdated firmware, or a weak Wi-Fi password can expose every connected device.
Rank #3
- Sign in through the router maker’s documented local address or app and change the administrator username and password. Do not reuse either credential elsewhere.
- Install the latest supported router firmware and enable automatic updates if the model offers them.
- Turn off internet-side remote administration unless you have a specific, controlled need for it. If remote management is required for work, restrict source addresses and protect it with MFA where available.
- Use WPA2 or WPA3 security, choose a long unique Wi-Fi password, and rename the network if its default name reveals the model or address.
- Create a guest network for visitors and place smart-home or unmanaged devices there when the router supports network separation. Do not assume a guest network isolates devices unless its settings say so.
- Replace a router that no longer receives security updates. A faster plan does not compensate for unsupported network equipment.
These controls follow the FTC’s small-business recommendations at Cybersecurity for Small Business; the same principles apply to a home router.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall5. Assuming a backup works without restoring it
A backup is not a recovery plan until you have successfully restored data from it. Ransomware, accidental deletion, theft, hardware failure, and a compromised synchronization account can all defeat a backup that is online, reachable with the same administrator credentials, or corrupted.
Build the three-copy design
For critical files, the FBI’s Operation Winter SHIELD guidance calls for at least three copies on two media types, including one offline and immutable copy. An external hard drive can provide an offline copy, and a vetted cloud service can provide another destination, but neither is automatically safe: an external drive left connected may be encrypted by ransomware, and a cloud account can be compromised. CISA explains this risk in How to Protect the Data that is Stored on Your Devices.
- Keep the working copy on the computer or service where the data is used.
- Keep a second copy on a different medium or service.
- Keep at least one copy offline and immutable so ordinary account compromise cannot alter or delete it.
- Protect backup systems with strong authentication and separate administrative accounts.
Test restoration, not just backup completion
- Choose representative files and one complete system or application that would matter during an outage.
- Restore them to a separate location without overwriting the production copy.
- Open the files, check permissions and timestamps, and confirm that the application can use its restored data.
- Record how long restoration took, what failed, and who can perform it without relying on a compromised administrator account.
- Repeat on a schedule and after major changes to software, storage, or backup policy.
The FBI’s resilience guidance at Improve Cyber Resiliency treats restoration testing as part of the control, not an optional exercise.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Skipping preparation in a small organization
Small teams often discover their response process during the incident. A short written plan is more useful than an elaborate document nobody can find. It should identify who can declare an incident, preserve evidence, contact vendors, maintain essential operations, notify customers or regulators when required, and communicate with staff.
Minimum response-plan contents
- Names and after-hours contact methods for the owner, IT support, legal or privacy adviser, insurer, bank, and key vendors.
- Steps for isolating an infected device without destroying evidence.
- Backup locations and restoration priorities, with credentials stored separately from the affected environment.
- Rules for customer, employee, regulator, and law-enforcement notification.
- A decision log recording what happened, when, who approved actions, and which systems were affected.
Train people and review access
Give employees a simple reporting route for suspicious messages and make reporting early safer than hiding a mistake. Review third-party access, remove unused accounts, limit privileges to what each role needs, and require appropriate authentication for vendors who can reach business systems. Rehearse a payment-fraud scenario and a ransomware scenario so the team knows which phone numbers and backups are genuine.
Best Value
The FTC describes the NIST Cybersecurity Framework 2.0 as free, voluntary, and flexible. Its six functions—Govern, Identify, Protect, Detect, Respond, and Recover—make a practical structure for a small-business checklist; it is not a mandatory certification. Start with the FTC’s framework overview at Cybersecurity for Small Business.
A 30-day correction plan
If you need an order of operations, complete the highest-impact changes first:
- Days 1–3: Secure email, banking, administrator, and remote-access accounts with unique credentials and the strongest supported MFA. Revoke unknown sessions and recovery methods.
- Days 4–7: Update operating systems, browsers, phones, routers, and critical applications. Remove unsupported devices from sensitive work.
- Week 2: Review router settings, disable unnecessary remote administration, separate guest or unmanaged devices, and inventory internet-facing services.
- Week 3: Establish the three-copy backup design, separate backup administration, and complete a supervised restoration test.
- Week 4: Write the incident plan, verify payment-change procedures, review third-party accounts, and run a short phishing-reporting exercise.
If you already made one of these mistakes
Act according to the failure rather than waiting for proof of compromise. For a reused or exposed password, change it first on the affected service, then on every account where it was reused; revoke active sessions and inspect recovery email addresses, phone numbers, and MFA devices. For an unexpected MFA approval, deny it, change the password from a known device, remove unfamiliar sessions, and contact the service through its official support channel. For a clicked phishing link or opened attachment, disconnect the device from networks if instructed by your IT team, report the event immediately, and preserve the message and relevant timestamps. If payment details changed or money was sent, call the bank using a known number at once and follow its fraud-recovery process.
Do not destroy logs, wipe a device, or restore over evidence before the person handling your incident tells you to do so. Early, accurate reporting gives your bank, provider, and incident-response personnel the best chance to contain the damage.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
