It doesn’t take a sophisticated hack to hurt a business. One reused password, one convincing fake invoice, or one rushed wire transfer is usually enough.
Workplace cybersecurity is the set of people, processes, and technology a business uses to protect its systems, data, and money from cyber threats. For most companies, the biggest risks aren’t exotic malware. They’re everyday habits and missing controls.
Windes has spent 100 years protecting the financial trust of Southern California businesses. Today, that trust is tested online. Below is the practical checklist our Technology & Risk team uses with business owners and leadership teams.
Key Takeaways for Business Leaders
- Treat cyber risk as a business risk, not just an IT task.
- Require multi-factor authentication (MFA) on email, finance, and remote access.
- Verify every payment change by calling a number you already have and require dual approval.
- Train employees on a recurring basis, especially finance and HR.
- Write an incident response plan before you need one.
- Assess your posture at least annually, not once.
Why Cyber Safety in the Workplace Is a Leadership Issue
Mid-market companies are prime targets. They hold valuable data but rarely have enterprise-level security. In 2025, the FBI logged about $3 billion in business email compromise losses across 24,768 complaints. California led the nation in business victims.
“Reasonable” security is a duty of care. Regulators, courts, and insurers ask whether you did what a prudent business your size would do. A small company doesn’t need a Fortune 500 budget, but it does need controls that fit its risk.
Compliance is not the same as security. Passing an audit checklist doesn’t mean you can stop an attack. Boards ask about cyber risk, insurers price around it, and clients send vendor questionnaires before they sign. Leaders have the answer.
1. Set Priorities with a Cyber Risk Assessment
You can’t protect what you can’t see. Start with an inventory of your systems, data, and user accounts. Then identify your crown jewels: client data, payroll, and every process that moves money. Measure yourself against a recognized framework such as the NIST Cybersecurity Framework 2.0 or the CIS Controls, so priorities come from evidence rather than guesswork.
2. Lock Down Logins: Passwords, Passphrases, and Password Managers
Use long, unique passphrases of 16 or more characters. Swapping an “S” for a “$” doesn’t help, because cracking tools try those substitutions first.
Use a company-managed password manager instead of passwords saved in the browser. Never share credentials and reset a password immediately if you suspect it’s exposed.
3. Require Multi-Factor Authentication Everywhere It Matters
We consider MFA the single most important control for protecting identities. Authenticator apps and hardware keys are stronger than text-message codes. Teach employees never to share a code and never to approve a login prompt they didn’t start. Attackers count on “MFA fatigue.”
Protect account recovery too. Keep recovery emails and phone numbers current and add a carrier PIN to company phone lines to block SIM-swap attacks.
4. Stop Phishing in All Its Forms
Know the red flags: urgency, authority, and a link that doesn’t match its text. Hover before you click.
Phishing isn’t just email anymore. Watch for texts, unexpected calendar invites, QR codes (“quishing”), and fake CAPTCHAs that tell you to paste or run a command. A real CAPTCHA never asks you to change anything on your computer.
Familiar senders can be compromised. An internal or vendor account that’s been hacked sends the most convincing phishing of all. Don’t click “unsubscribe” in a suspicious email or open attachments you weren’t expecting.
5. Protect Money Movement from Business Email Compromise and Wire Fraud
As CPAs, this is where we see the most direct financial damage. Business email compromise (BEC) impersonates a CEO, a vendor, or an attorney to redirect a payment. These emails often contain no link or attachment, so filters miss them. Two controls stop most attempts:
- Callback verification: confirm any new or changed bank details by phone, using a number already on file. Never use the one in the email.
- Dual approval: no single person can release a large payment.
Never share banking details or credentials until the request is verified. In one widely reported case, an Atlanta pediatric hospital lost $3.6 million after attackers posing as a construction partner altered payment instructions.
6. Prepare for AI-Powered Scams and Deepfakes
AI has erased the old warning signs. Phishing emails now arrive with perfect grammar, and voice clones can mimic your CFO from a few seconds of audio. Our rule is simple: trust the person, verify the request. Agree on a code word for urgent executive requests, and confirm through a second channel you already know.
The same applies to fake “tech support” calls and pop-ups. Never give remote access to someone who contacted you first.
7. Keep Software, Devices, and Configurations Current
Attackers study security patches to target anyone who hasn’t installed them. Turn on automatic updates for operating systems, browsers, and apps. Change default passwords on routers, printers, and smart-office devices. Allow software only from approved sources, and give apps the minimum permissions they need.
8. Control Access to Data, Apps, and Third Parties
- Store files in approved shared drives or secure cloud storage, with tested backups.
- Review connected apps and “Sign in with…” permissions on company accounts.
- Vet the vendors who can reach your systems or data.
- Remove access the day an employee leaves.
- Keep work and personal email and devices separate.
9. Secure the Physical Workplace
Cybersecurity starts at the front door. Don’t let anyone tailgate through a badge-controlled door. Check visitor IDs and escort guests. Lock your screen every time you step away, keep desks clear of sensitive documents, and use privacy screens in shared spaces. Shred paper records, and wipe devices before you dispose of them.
10. Work Safely Remotely and on the Road
Avoid reaching company systems over public Wi-Fi without the company VPN or a personal hotspot. Skip public USB charging stations, a risk known as “juice jacking”. Carry your own charger or a data blocker instead. And think twice before posting real-time travel plans that tell criminals an executive is away.
11. Build a Security-Aware Culture Through Training
Technology can’t fix a culture that clicks first. Run recurring, role-specific training and phishing simulations, with extra focus on finance, HR, and executive assistants. Watch for security fatigue: constant alerts train people to click through. Above all, make reporting blame-free. An employee who reports a mistake in five minutes saves far more than one who hides it for five days. Also coach teams on oversharing, since social media posts often answer security questions.
12. Have an Incident Response Plan Before You Need It
Decide now who gets called and in what order. If a fraudulent wire goes out, speed matters. Call your bank immediately, file with the FBI’s Internet Crime Complaint Center (IC3), notify your cyber insurer, and reset any compromised accounts. Know your breach-notification duties under California law, including the CCPA. Many insurers now expect a documented plan before they’ll write a policy.
Workplace Cybersecurity Checklist
Control | Owner | How often |
Cyber risk assessment | Leadership | Annually |
MFA on all key systems | IT | Ongoing |
Callback verification and dual approval | Finance | Every payment change |
Security patches | IT | Automatic |
Employee training and phishing tests | HR / IT | Quarterly |
Access review and offboarding | IT / HR | Quarterly, and on exit |
Incident response plan test | Leadership | Annually |
How Windes Helps
We provide cyber risk assessments, virtual CISO services, security awareness training, penetration testing, and incident response planning. We also stay involved after the report to track remediation and keep your board informed.
Frequently Asked Questions About Workplace Cybersecurity
How often should a business assess its cybersecurity?
Run a full assessment at least once a year and vulnerability scans quarterly. Reassess after any major system change.
What are the most important controls for a small or mid-sized business?
MFA, callback verification with dual approval for payments, automatic updates, recurring training, and an incident response plan.
Is cybersecurity compliance the same as being secure?
No. Compliance proves you met a standard; security means you can actually stop and recover from an attack.
What should an employee do after clicking a phishing link?
Report it to IT immediately, disconnect if instructed, and change any password entered. Fast reporting limits the damage.
Do small businesses really get targeted?
Yes. Attackers favor companies with valuable data and lighter defenses, which describes much of the mid-market.
Protect the Next 100 Years
For a century, Windes clients have trusted us with their most sensitive financial information. Cybersecurity is how we protect that trust today, and how you protect yours.
Find out where your gaps are before an attacker does.
Schedule your complimentary Cyber Health Check with the Windes Technology & Risk team. We’ll respond within one business day.
