This article’s text was created with the help of AI systems and reviewed by the WIT ICT team, in accordance with Article 50 of the EU AI Act (Regulation (EU) 2024/1689) on the transparency of AI-generated content. The featured image was also generated using AI.
October is European Cybersecurity Awareness Month, and in 2026 the occasion has been anything but symbolic. The past few weeks brought a run of attacks touching managed service providers, widely used website plugins, and business credentials stolen at scale. For a small or mid-sized company the headline isn’t simply that attacks are increasing; it’s that they have changed target. Criminals no longer go only after large corporations with deep defenses, but after smaller firms that hold valuable data behind thin walls. It is worth pausing to understand what has actually shifted, before an incident ends up explaining it the hard way.
Why October puts security in the spotlight
Cybersecurity Awareness Month exists to turn a technical subject into a conversation anyone can join. It is no accident that researchers and authorities publish their summaries and advisories in these weeks: the timing captures the state of the threat landscape while attention is high. For a small business the takeaway is practical. Security is never solved by a single purchase; it grows from habits that hold up over time. Someone has to own access management, someone has to apply updates, someone has to confirm the backups work. October is a good moment to assign those responsibilities explicitly, even in a five-person company, where security is often everyone’s job and therefore no one’s.
Session theft: when a password is no longer enough
For years the advice was straightforward: turn on two-factor authentication. It still holds, but attackers have adapted. The latest phishing campaigns don’t stop at stealing the password. They sit between the user and the genuine site as a relay, capturing the second-factor code and, more importantly, the already-authenticated session token. Armed with that token, an attacker walks in without logging in again.
- The target is no longer the password, but the live session inside the browser.
- The defense moves toward phishing-resistant methods such as security keys and passkeys.
- The warning sign is a sign-in from an unusual location or device, which deserves monitoring.
For Microsoft 365 users, enabling conditional access policies and passkeys sharply reduces how well these attacks work.
Infostealers: the quiet prelude to ransomware
Many serious attacks don’t begin with a broken-down door; they start with a quiet theft. An infostealer is a program that, once on a device, harvests browser-saved passwords, session cookies, and configuration data, then sells them on. Weeks often pass between that theft and the real attack: whoever buys the credentials uses them to log in calmly, move across the network, and only then trigger the ransomware. In practical terms, an employee who installs pirated software or opens the wrong attachment can open a breach that stays invisible for a long time. Limiting local administrator rights and discouraging password storage in the browser are two measures that break this chain at its very first link.
Suppliers and management tools: the risk that enters through the side door
A company can tend to its own defenses in fine detail and still be exposed because of the people it works with. Remote monitoring and management tools, used by many IT providers, are convenient precisely because they reach dozens of clients from a single console; that same trait makes them a prize for attackers. In recent incidents, anyone who compromised one of these tools could spread the damage to every connected business. The answer isn’t to abandon suppliers, but to choose carefully and ask pointed questions.
- Does your provider use multi-factor authentication on its own administrative accounts?
- Is there a record of who accesses your systems, and when?
- Are external collaborators’ accounts revoked the moment the engagement ends?
Your website as an entry point: WordPress and update discipline
WordPress powers an enormous share of business websites, and that reach makes it a constant target. The weak point is rarely the platform’s core, which is maintained and patched quickly; far more often it’s plugins and themes, especially those abandoned by their authors or installed once and then forgotten. In recent months several popular plugins asked users to check for unauthorized changes, a sign the pressure remains high. The encouraging part is that the defense is within anyone’s reach: keep core, plugins, and themes updated, remove what you don’t use, back up regularly, and actually test those backups. A well-tended site isn’t only safer; it’s faster and ranks better in search.
NIS2 and compliance: what is changing for smaller firms
The European regulatory picture has tightened. The NIS2 directive, now transposed in Italy, extends security and incident-reporting obligations to a far wider set of companies than before, including mid-sized firms in sectors deemed important. Through 2026, several of these obligations become fully operational, from risk management to the prompt reporting of significant incidents. Even businesses that fall outside the directive’s direct scope feel the pull, because larger clients start demanding guarantees across the whole supply chain. It pays to check early whether your company is in scope, map the data you handle, and prepare a written procedure for handling an incident, rather than letting urgency dictate your first moves.
A practical plan a small business can actually sustain
Good security doesn’t require an enterprise budget; it requires order and consistency. Here is a sequence a smaller company can work through over a few weeks without disrupting daily operations:
- Turn on MFA everywhere, favoring passkeys and security keys for critical accounts.
- Apply updates to systems, applications, firewalls, and network devices without delay.
- Test your backups: a backup you have never restored is a hope, not a guarantee.
- Trim privileges to the minimum needed and revoke accounts no longer in use.
- Train your people with short, recurring exercises on spotting phishing.
- Write a response plan: who to call, what to isolate, how to communicate if something goes wrong.
Taken methodically, these steps tilt the balance back toward the defender. The difference between a contained incident and weeks of downtime almost always comes down to these fundamentals, not to exotic technology.
Want to know more? Contact us for a free consultation.