At our recent Riverland Lunch & Learn, one of the presentations that generated plenty of discussion came from Ben, one of eManaged’s Virtual Chief Information Officers. While cybersecurity is often presented as a highly technical subject, Ben approached it from a very different perspective. Rather than focusing on software, firewalls and complicated IT terminology, he spoke about something every business owner could relate to—the decisions that need to be made when something goes wrong.
It’s a topic that many businesses avoid thinking about. Most of us assume a cyber attack is something that happens to large corporations or government departments. The reality is that small and medium-sized businesses are increasingly being targeted, and often they’re targeted because attackers know they may not have the same resources or preparation as larger organisations.
When people imagine a cyber attack, they often picture computer screens going black or systems suddenly locking up. While that can certainly happen, the reality is often much less dramatic, at least in the beginning. An employee clicks on what appears to be a legitimate email. Someone unknowingly provides information over the phone to a convincing scammer. A password is compromised without anyone realising it. Sometimes weeks or even months pass before the business becomes aware that something is wrong.
That’s one of the reasons preparation is so important.
Ben made the point that no business ever has perfect information during the early stages of a cyber incident. Decisions need to be made quickly, often while facts are still emerging. Waiting until every detail is known usually isn’t an option because valuable time can be lost while an attacker continues to access systems or sensitive information.
This raises an important question that every business owner should ask themselves: if your business discovered a cyber incident this afternoon, what would happen during the first hour?
Would everyone know who to contact?
Would your staff know whether they should disconnect their computer or leave it running?
Who would notify your IT provider?
Would someone contact your cyber insurer?
If customer information may have been compromised, who would be responsible for understanding your legal obligations?
These aren’t questions that should be answered in the middle of a crisis. Like any emergency procedure, they should already be documented, understood and regularly reviewed.
Think about how businesses prepare for other emergencies. Most workplaces have evacuation plans, fire extinguishers and first aid kits. Staff know where the exits are and who the designated first aid officers are. Nobody expects these emergencies to occur, but everyone recognises the value of being prepared.
Cybersecurity deserves exactly the same level of planning.
One of the most valuable insights from Ben’s presentation was that preparation isn’t just about protecting technology. It’s about reducing confusion. When people understand the process, they’re far more likely to respond calmly and make good decisions under pressure.
That process might include immediately reporting suspicious activity, contacting key external partners, isolating affected systems and beginning an initial assessment of what may have occurred. Every business will have different requirements, but every business benefits from having those first steps clearly defined before they’re ever needed.
Another important point Ben discussed was the role of communication. One of the biggest mistakes businesses can make is assuming someone else has already reported the issue or delaying action because they’re worried about having made a mistake.
Cyber incidents are increasingly caused by ordinary human behaviour rather than technical failures. Someone clicks on a link that looked genuine. An email appears to come from a trusted supplier. A phone call sounds convincing enough to lower someone’s guard. These situations don’t happen because people are careless. They happen because people are busy, distracted and trying to do their jobs.
Creating a workplace where staff feel comfortable reporting something immediately, even if they’re unsure whether it’s serious, can dramatically reduce the impact of an incident. In many cases, the speed of the response determines how much damage can be prevented.
Technology certainly has an important role to play. Good security systems, backups, monitoring tools and multi-factor authentication all reduce risk. However, technology works best when it’s supported by clear processes and well-informed people. One without the other is rarely enough.
At eManaged, this is why our conversations with clients extend well beyond installing software or maintaining computers. We work with businesses to develop practical strategies that help them respond confidently if an incident ever occurs. That includes planning, education, recovery processes and ongoing guidance that fits the way each organisation operates.
Our Riverland Lunch & Learn events are designed to encourage exactly these kinds of conversations. Cybersecurity doesn’t need to be intimidating, but it does need to be taken seriously. By helping business owners understand not only the technology but also the decisions that surround a cyber incident, we hope businesses leave better prepared than when they arrived.
Because when it comes to cybersecurity, the first hour matters. The best time to decide what you’ll do during that hour is long before you ever need to.