Cybersecurity for small businesses, in short: for an SME, protection starts with a few measures done properly (two-factor authentication, tested backups, updates, training) and with suppliers that handle data according to rules you can verify. This guide explains the most common risks, the actions to take now and what changes with NIS2.
Many owners of small companies think cyber attacks are a problem for large corporations. They are not: criminals use automated tools that hit anyone with an email inbox, an exposed server or a reused password. An SME often has fewer defences and fewer dedicated people, which makes it an easy target. The consequences are practical: days of downtime, customer data exposed, notification duties under the GDPR, invoices to rebuild by hand.
The most common cybersecurity risks for SMEs
Phishing
This is the most frequent way in. An email arrives that looks like it comes from the courier, the bank or a regular supplier, with a link or an attachment. Whoever clicks may hand over their email password, install malware or authorise a payment to a fake IBAN. A very common variant in companies is a fake notice from a supplier announcing new bank details: the only real defence is an internal rule that every change of IBAN must be verified by phone, on a number you already know.
Ransomware
This is malware that encrypts files and demands a ransom to release them. Often, before encrypting, the criminals copy the data and threaten to publish it. A company without backups kept separate from its network is left choosing between paying and rebuilding everything from scratch.
Weak or reused passwords
Credentials stolen from any website are tried automatically on email, ERPs and VPNs. If an employee uses the same password everywhere, a breach on a forum can open the door to your company.
Forgotten accounts
Accounts of former staff still active, credentials shared between several people, the external technician who has had remote access for years. These are trivial problems that nobody checks until they turn into an incident.
SME cybersecurity: six actions to take now
You do not need a large company's budget to raise your level of protection considerably. You need a few rules, applied to everyone, the owner included.
1. Turn on two-factor authentication
On top of the password, access requires a code generated by an app on the phone or a physical key. Even if the password is stolen, it is not enough on its own. Start with email, then online banking, the ERP, cloud tools and remote access.
2. Make backups you know how to restore
Regular copies of important data, with at least one kept outside the company network or in a service that cannot be deleted from an infected PC. And a restore test every few months: a backup that nobody has ever tried to restore may fail on the very day you need it.
3. Update systems and software
Many attacks exploit vulnerabilities that vendors have already fixed. Turn on automatic updates wherever possible and keep a list of what does not update itself: firewalls, NAS devices, servers, website plugins.
4. Manage access and privileges
Each person has their own account, with only the permissions they need. When someone leaves, their access is closed the same day. Admin accounts are used only for admin work.
5. Train people with real examples
Short, repeated training with examples of phishing emails similar to those that actually reach the company works better than an annual course. Anyone who has clicked on something suspicious must be able to say so straight away, without fear of being told off: ten minutes' head start changes the outcome of an incident.
6. Write down what to do in an incident
One page is enough: who to call, which systems to disconnect, where the backups are, who decides whether to notify the data protection authority (in Italy, the Garante privacy). A written plan avoids improvised decisions in the first hours after an incident.
NIS2: does it apply to your company?
The European NIS2 directive was transposed in Italy by Legislative Decree no. 138 of 4 September 2024, in force since 16 October 2024. The competent authority is the National Cybersecurity Agency (ACN). The details below refer to the Italian rules; other EU countries have their own national laws. According to the ACN, the Italian decree covers 18 sectors, 11 highly critical and 7 critical, and applies to all medium and large companies operating in them and, in some cases, to small and micro enterprises as well.
Entities within scope must register, or update their registration, on the ACN portal between 1 January and 28 February each year. Failing to register can cost a penalty of up to 0.1% of annual worldwide turnover. The obligations are phased in: for entities added to the list in 2025, the ACN timetable sets the incident notification duty from January 2026 and full implementation of the basic security measures in autumn 2026.
Two practical pointers. If you think your Italian business may be in scope, check your case on the ACN NIS pages and with a consultant: do not rely on your ATECO activity code alone. If you are not in scope but supply a company that is, expect questions about your security: questionnaires, requests for minimum measures, contract clauses. Having the six actions above already in place makes these requests much lighter.
How to choose software suppliers that protect your data
Your company's security also depends on who develops and runs your software. Before you hand over a project, ask how access, backups and updates are managed, where the data is hosted, who can see it and what happens in an incident.
An ISO/IEC 27001 certification is a good sign, because it means an independent body checks the supplier's information security management system every year. It needs to be read carefully, though: it certifies how the company manages information, not the specific software it will deliver to you. Selli has a management system certified by Kiwa Cermet Italia to ISO/IEC 27001:2022, with ACCREDIA accreditation, for software production and development and IT consulting services. The certificate, its scope and its validity are published on the certifications page.
In custom business software projects, security comes in at the analysis stage: what data the system handles, who needs to see it, which roles are needed. Every release goes through a staging environment, where the client tests new features before they reach production, and the code remains the client's property, so it can be put through independent audits whenever they want. Old software that is never updated is a risk in itself: we cover this in the article on technical debt. To assess a supplier as a whole, use the checklist for choosing a technical partner.
A final note on costs, relevant if your company is based in Italy. The 2026 voucher from the Florence Chamber of Commerce, for example, accepted cybersecurity and business continuity projects, provided they started from a risk analysis and were not limited to buying devices. The status of these Italian measures is covered in our guide to digitalisation grants 2026.
Let's talk
If you are about to hand over a software project and want to understand how your data will be handled, or you need to answer a client's security questionnaire, write to us and we will set up a call. We can share the ISO 27001 certificate, its scope and the measures we apply on our projects.