Guide
SME Cybersecurity: The Practical Jargon-Free Guide
Protect Your Business Without a Dedicated Team or Excessive Budget
Chapter 1: Why SMEs Are Now Prime Targets
The Myth of "Too Small to Be Attacked"
For a long time, SME leaders believed they were safe: "Why would a hacker be interested in my small business?" That era is over.
Numbers That Make You Think:
- 43% of cyberattacks target SMEs
- 60% of attacked SMEs close within 6 months
- $200,000: average cost of a cyberattack for an SME (Verizon DBIR)
- 82% of ransomware targets businesses with fewer than 1,000 employees
Why SMEs Are Attractive to Hackers
1. Optimal Effort-to-Gain Ratio
Attacking a large company requires months of preparation against seasoned security teams. An SME? A few hours often suffice.
2. The "Gateway" Effect
Your SME might work with a large corporation. You then become the weak link through which attackers can reach their real target.
3. Payment Capacity
Ransom demands adapt to company size. $10,000 to $50,000: painful enough to be taken seriously, but "payable" to avoid catastrophe.
4. Lack of Resources
No CISO, no SOC team, no dedicated cybersecurity budget. Attackers know this.
With Domyno: The platform is designed specifically for SMEs without dedicated security teams. The AI assistant guides non-experts through implementing essential protections.
Chapter 2: The 5 Threats That Specifically Target SMEs
Threat #1: Phishing
How It Works: An email imitating your bank, a supplier, or even a colleague asks you to click a link or open an attachment. The trap is set.
Warning Signs:
- Artificial urgency ("Your account will be suspended in 24h")
- Subtle spelling mistakes
- Slightly different email address (contact@domyno.io vs contact@domyn0.io)
- Unusual request (urgent wire transfer, bank details change)
How to Protect Yourself:
- Train all employees (regular exercises)
- Implement an anti-phishing filter
- Establish a double validation procedure for any wire transfer
Threat #2: Ransomware
How It Works: Malicious software encrypts all your files. To regain access, you must pay a ransom in cryptocurrency. Otherwise, everything is lost.
Infection Vectors:
- Infected attachment
- Pirated software download
- Exploitation of an unpatched vulnerability
How to Protect Yourself:
- Regular AND disconnected backups (3-2-1 rule)
- Automatic updates on all systems
- Antivirus/EDR on all workstations
Threat #3: Business Email Compromise (BEC)
How It Works: An email appearing to come from the CEO asks the accounting department to make an urgent and confidential wire transfer. By the time the fraud is discovered, the money is long gone.
Amounts at Stake:
- $50,000 to $500,000 per successful attack
- $26 billion lost globally between 2016 and 2023
How to Protect Yourself:
- Double signature procedure for any transfer above threshold
- Systematic callback to known number
- Specific training for accounting teams
Threat #4: Data Breach
How It Works: Your customer, supplier, or employee data ends up "in the wild": sold on the dark web, used for fraud, or exploited by competitors.
Main Causes:
- Malicious or negligent employee
- Hacking of poorly configured cloud account
- Theft of unencrypted laptop
How to Protect Yourself:
- Disk and communication encryption
- Access management (who has access to what?)
- Clear data exit policy
Threat #5: Supply Chain Attack
How It Works: One of your software or service suppliers is compromised. Attackers use this trust to reach you.
Recent Examples:
- SolarWinds (2020): 18,000 businesses affected
- Kaseya (2021): 1,500 businesses victims
- MOVEit (2023): thousands of organizations impacted
How to Protect Yourself:
- Evaluate critical suppliers' security
- Limit access granted to third parties
- Monitor third-party connections
With Domyno: The supplier management module allows you to evaluate and track your critical partners' security level, with automated questionnaires and risk scoring.
Chapter 3: Essential Basics - The Cyber Survival Kit
The 10 Measures That Block 90% of Attacks
These measures don't require advanced technical skills. They constitute the minimum foundation every SME must implement.
1. Strong Passwords + Password Manager
- Minimum 12 characters, complex
- Different password for each service
- Team password manager (Bitwarden, 1Password)
2. Multi-Factor Authentication (MFA)
- Mandatory on: email, cloud, banking, VPN
- Authentication app (not SMS if possible)
- Progressive deployment, service by service
3. Automatic Updates
- Operating systems: enable automatic updates
- Software: alerts and 48h update policy
- Firmware: routers, printers, IoT often forgotten
4. 3-2-1 Backups
- 3 copies of important data
- 2 different media (NAS + cloud for example)
- 1 copy off-site (cloud or vault)
- Quarterly restoration test
5. Antivirus / EDR on All Workstations
- Professional solutions (not free consumer versions)
- Centralized management
- Real-time alerts
6. Firewall and Segmentation
- Firewall enabled on all workstations
- Network firewall if more than 10 workstations
- Segmentation: separate guest WiFi from internal network
7. Sensitive Data Encryption
- Laptop disks: BitLocker (Windows), FileVault (Mac)
- USB drives: prohibited or encrypted
- Sensitive emails: encryption enabled
8. Access Management
- Each employee = one named account
- Principle of least privilege
- Immediate revocation when employee leaves
9. Continuous Awareness
- Initial training upon arrival
- Regular reminders (phishing, best practices)
- Simulated phishing tests (without punishment!)
10. Incident Response Plan
- Who to contact in case of problem?
- Emergency numbers (CISA, IT provider, insurance)
- Emergency shutdown procedure
With Domyno: The dashboard displays the deployment level of these 10 measures in real-time and guides their progressive implementation.
How Domyno helps
One source of truth, agents that prepare the work, and a dedicated expert who reviews it.
Chapter 4: Minimum Viable Compliance
GDPR: The Essential
Since 2018, GDPR applies to all companies processing data of European residents. Penalties can reach €20M or 4% of global revenue.
The 5 Key Obligations for an SME:
Processing Register (Article 30)
- List all your personal data processing activities
- Who? What? Why? How long?
Information to Individuals (Articles 13-14)
- Legal notices on website
- Privacy policy
- Employee and customer information
Individual Rights (Articles 15-22)
- Access, rectification, erasure
- Response procedure within 30 days
Data Security (Article 32)
- Technical and organizational measures
- Proportionate to risks
Breach Notification (Articles 33-34)
- 72h to notify the authority in case of breach
- Individual notification if high risk
For US Companies: Additional Considerations
- CCPA/CPRA (California): Similar to GDPR for California residents
- SEC Cybersecurity Rules: Public companies must report material incidents within 4 days
- State-level privacy laws: Growing patchwork requiring attention
Voluntary but Differentiating Certifications
- SOC 2: Essential for working with US enterprise clients
- ISO 27001: International reference, commercially differentiating
- Cyber Essentials (UK): Basic certification, good start
With Domyno: The AI assistant automatically generates the GDPR register from collected information and guides compliance step by step.
Chapter 5: The Real Cost of a Cyberattack vs Protection
The Real Cost of a Cyberattack on an SME
Direct Costs:
| Item | Average Amount |
|---|---|
| Ransom (if paid) | $15,000 - $50,000 |
| Expert intervention | $5,000 - $20,000 |
| System restoration | $10,000 - $50,000 |
| GDPR notification | $2,000 - $10,000 |
| Total direct | $32,000 - $130,000 |
Indirect Costs:
| Item | Average Amount |
|---|---|
| Business disruption (5 days) | $25,000 - $100,000 |
| Customer loss | $20,000 - $200,000 |
| Reputation damage | Difficult to quantify |
| Insurance increase | +50% to +200% |
| Total indirect | $45,000 - $300,000 |
Average Total Cost: $77,000 to $430,000
The Realistic Budget to Protect an SME
For an SME with 20 to 50 employees:
| Item | Annual Cost |
|---|---|
| Managed Antivirus/EDR | $2,000 - $4,000 |
| Cloud backup | $1,200 - $3,000 |
| Training/awareness | $1,500 - $3,000 |
| Annual audit | $2,000 - $5,000 |
| Cyber insurance | $3,000 - $8,000 |
| Compliance tools (Domyno) | $3,600 - $7,200 |
| Annual total | $13,300 - $30,200 |
Protection ROI:
- Average attack cost: $150,000
- Attack probability/year: 20-30%
- Annual financial risk: $30,000 - $45,000
- Protection budget: $13,000 - $30,000
Conclusion: Protection costs 2 to 3 times less than the risk.
Chapter 6: 90-Day Action Plan
Weeks 1-2: Taking Stock
Day 1-5: Inventory
- List all equipment (PCs, servers, mobiles)
- Identify software used
- Survey cloud access (O365, Google, CRM...)
- Map sensitive data
Day 6-10: Assessment
- Test existing backups
- Check pending updates
- Verify passwords (shared accounts?)
- Identify obsolete access
Weeks 3-4: Foundations
Priority Actions:
- Activate MFA on all email accounts
- Deploy a password manager
- Set up 3-2-1 backups
- Install professional antivirus/EDR
Documentation:
- Write security policy (1 page max)
- Create incident procedure (who to call?)
- Document administrator access
Weeks 5-8: Reinforcement
Technical Security:
- Enable disk encryption
- Segment network (separate guest WiFi)
- Configure firewalls
- Update all systems
GDPR Compliance:
- Create processing register
- Update legal notices
- Document rights procedures
Weeks 9-12: Security Culture
Training:
- General awareness session (2h)
- Specific accounting training (CEO fraud)
- First simulated phishing test
Continuous Improvement:
- Schedule annual audit
- Subscribe to cyber insurance
- Define tracking indicators
Dashboard to Monitor
| Indicator | Day 30 Goal | Day 90 Goal |
|---|---|---|
| MFA activated | 100% | 100% |
| Up-to-date workstations | 80% | 100% |
| Tested backups | 1 test | 2 tests |
| Trained employees | 50% | 100% |
| GDPR register | Draft | Complete |
Conclusion: Cybersecurity Is an Investment, Not an Expense
You don't need to be a cybersecurity expert to protect your SME. You need a simple method and tools adapted to your reality.
The 3 Key Messages:
- You are a target - Accept it and act accordingly
- 90% of risks are addressed with simple measures - The survival kit is enough to start
- The investment is profitable - Protection costs less than an attack
Take Action with Domyno
Domyno was designed for SMEs like yours: no dedicated security team, no unlimited budget, but a real willingness to protect yourself.
Our platform guides you step by step through:
- Implementing the 10 essential measures
- GDPR compliance without legal jargon
- Tracking your protection level
Request a personalized demo →