In 2019, a contractor installed a security camera system at a small office. He plugged it in, set the password to "admin," and left. Seven years later, that system is still running, still on the default login, and still reachable from the open internet. Nobody on staff knows it's there.
That is how most small businesses get breached. Not through a movie-style hack, but through something nobody remembers owning.
October is Cybersecurity Awareness Month, so this is Week 1 of a series on cutting security risk without a big budget. Step one is Reduce: before you buy a single new tool, shrink what's exposed. You can't protect what you don't know you have.
What "exposed" actually means
Exposed means anything an outsider can reach, plus anything a former employee, vendor, or guest can still touch. Security people call this your attack surface. In plain terms, it's every door into your business, including the ones you forgot you installed.
Small businesses carry more of these forgotten doors than they should, for three reasons: nobody keeps an inventory, there's no IT department to notice drift, and "it just works" is treated as a reason to leave things alone.
The numbers back this up. Verizon's 2026 Data Breach Investigations Report found that exploiting vulnerabilities overtook stolen credentials as the top way attackers get in, at 31% versus 13%. The same coverage reports that small and midsize businesses made up roughly 96% of ransomware victims where company size was known. Attackers aren't picking small businesses for who they are. They're picking whoever has something unlocked.
The good news: you can't fix what you can't see, but you can see more than you think in one afternoon.
Eight things hiding in plain sight
1. Forgotten devices
IP cameras, DVRs, printers, NAS drives, VoIP phones, and smart TVs often ship with default logins and rarely get firmware updates. They're risky because they sit on your network and many can be reached from outside. They got there because someone plugged them in years ago and nobody wrote it down.
2. The router and firewall
Most small business routers are still running the ISP's default setup. Look for old port forwards, UPnP switched on (it lets devices open holes in your firewall without asking), and remote administration enabled. Each one is a door that was opened for a reason nobody remembers.
3. Remote access left open
Remote Desktop exposed to the internet, a VPN from a vendor you stopped using, and TeamViewer or AnyDesk installed on a handful of machines. Remote tools are what attackers want most, because they hand over a working session. They pile up one "quick fix" at a time.
4. One flat Wi-Fi network
Guests, printers, the point-of-sale system, and the owner's laptop all share one network and one password that hasn't changed since 2018. If any one device is compromised, everything else is within reach.
5. Zombie accounts
Former employees, shared admin logins, vendor accounts, and anything without multi-factor authentication (MFA). These are the accounts that survive layoffs, contractor handoffs, and reorganizations because offboarding was never a checklist.
6. Shadow software and file sharing
Free trials that never got cancelled, personal Dropbox or Google Drive accounts holding company files, and "anyone with the link" folders. Your data lives in places your business doesn't control and can't audit.
7. Domain, DNS, and email
A forgotten subdomain pointing at a retired service, a domain registered under the web developer's personal account, and missing email authentication records (SPF, DKIM, DMARC) that let criminals send mail that looks like yours. If you lose control of your domain, you lose your website and your email together.
8. End-of-life software
Unpatched servers and operating systems that no longer get security fixes. Windows 10 support ended in October 2025, so any machine still on it is now running without regular security updates unless you've paid for extended coverage.
Why nobody knows it's there
It's rarely negligence. It's the way small businesses grow.
- No inventory. Nobody has ever written down what's on the network, so nothing can go missing.
- The person who set it up is gone. An employee, a contractor, or the owner's nephew built it, and the knowledge left with them.
- Vendors added access and never removed it. The copier tech, the software reseller, and the old IT shop all kept their way in.
- Nobody owns the question. "What do we actually have?" belongs to no one, so it never gets asked.
That last one is the real problem, and it's the cheapest to fix.
How to find it in one afternoon
You don't need a consultant or a budget. You need a couple of hours and a willingness to be surprised.
- Walk the building. Write down every device with a plug or a network cable, including the ones behind the TV and above the ceiling tiles.
- Read your router's device list. Log in to the router and compare the connected devices against your walk-through. Anything on the list that you can't explain goes on a follow-up list.
- See what the internet sees. Search your business's public IP address on Shodan or Censys, free tools that show what's reachable from outside. Seeing your own camera or remote desktop listed there tends to focus the mind.
- Scan the network. A free scanner such as Fing will list everything it finds on your local network.
- Check your domain. Confirm who the registrar account belongs to, who the admin contact is, and what DNS records exist. If it's under a developer's name, that's your first fix.
- Audit your accounts. Review the user list in Google Workspace or Microsoft 365 and note who's missing MFA, who's left the company, and which logins are shared.
Only run scans on networks you own or are authorized to test.
The Reduce checklist
Once you have your list, work through it in this order. Each step removes risk without adding a tool to maintain.
- Remove what you don't use. Unplug the old camera, cancel the dormant trial, uninstall the remote tool nobody needs.
- Change default and shared credentials, and turn on MFA. Start with the router, cameras, and admin accounts, then email and file sharing.
- Close what doesn't need to be open. Turn off UPnP and remote administration, and delete port forwards you can't justify.
- Separate your networks. Put guests, smart devices, and business systems on their own networks so one compromised device can't reach the rest.
- Offboard and take ownership. Disable dead accounts, end vendor access you no longer need, and move your domain registration under a company-controlled account.
The goal is a smaller target
Perfect security isn't on offer, and you don't need it. Every device you unplug, account you disable, and port you close is one less way in. Reduce is the cheapest security work you'll ever do, and it makes everything that follows, from monitoring to backups, cheaper and easier.