20 Common Security Holes Sitting Right in Front of You

Here's a secret from someone who walks into a lot of small offices for a living: the scariest security problems are almost never hidden. They're taped to the monitor. They're blinking in the supply closet. They're logged in as "frontdesk1" with the password "frontdesk1." They're the former office manager who still gets every email, two years and one job later.

Movies make breaches look like a hooded genius typing green text at 400 words per minute. Real life is more like this: an ordinary gap that everyone has walked past a thousand times, found by an automated attack that wasn't looking for you specifically, just for anybody with that gap. The Verizon 2026 Data Breach Investigations Report (DBIR) found that about 96% of ransomware victims (where size was known) were small and medium-sized businesses, and that in those small-business attacks the victims were commonly hit through compromised credentials (38%) or unpatched vulnerabilities in internet-facing devices (29%). Verizon's own description is that these attacks are "opportunistic in nature." Translation: you don't have to be interesting to get hit. You just have to be open.

So let's count down the 20 most common security holes we find in medical offices, dental practices, accounting firms and other small businesses. For each one you'll get why it matters (with a source where one exists), the all-too-familiar scenario, a 5-minute check you can do yourself, and the fix. At the end there's a printable self-audit table. Grab a coffee and a sticky note. (Not for your password. We'll get to that.)

Why do small businesses keep having the same security holes?

Because nobody owns security full-time in a 5–50 person office, and every one of these holes started as a reasonable shortcut. Shared logins were faster. Admin rights stopped the "can you install this?" calls. The old server still works. Each shortcut made sense on the day; together they make a very welcoming front door.

The good news is that the fundamentals still do most of the work. The 2026 DBIR's own conclusion is that organizations grounded in "strong cybersecurity basics," like clear visibility into assets and third parties, disciplined patching and practiced response plans, are better positioned. CISA's Secure Our World campaign boils it down even further to four habits: strong unique passwords with a password manager, multi-factor authentication, recognizing and reporting phishing, and keeping software updated. Most of this list is those four habits, wearing different hats.

Ready? Let's start at #20 and work our way up to the big one.

#20: The physical stuff (unlocked server closet, screens everyone can see)

The short answer: if a stranger can walk up to your server or read patient names off the front desk monitor, your digital security has a very physical hole.

The scenario: The server closet doubles as the mop closet and the holiday decoration storage. The door has a lock. The key is in the lock. It has been in the lock since the Obama administration. Meanwhile, at the front desk, the check-in monitor faces the waiting room, so anyone in chair three can read the schedule: names, appointment types, and the fact that Mr. Henderson is here for "the thing we discussed."

Why it matters: Physical access defeats most digital controls. Someone who can touch a server or network equipment can unplug it, plug something into it, or walk off with it. For healthcare, the HIPAA Security Rule includes facility access controls and workstation security as physical safeguards, meaning you're expected to limit physical access to systems with patient data and position workstations so unauthorized people can't view them.

The 5-minute check:

• Walk to your network/server closet. Is it locked? Who has keys?
• Sit in a waiting room chair. Can you read any screen?
• Look for unattended laptops in exam rooms, operatories or conference rooms.

The fix:

• Lock the closet. Keep the key somewhere that is not the lock. Keep a list of who has access.
• Turn front-desk monitors away from public view, or add privacy filters (inexpensive and effective).
• Get the mops their own closet. They'll be happier too.

#19: The mystery USB stick

The short answer: USB drives carry data out and malware in, and they're tiny enough to lose in a coat pocket.

The scenario: There's a drawer at reception containing nine USB sticks, one labeled "BACKUP DO NOT LOSE," one labeled "Xmas Party 2019," and seven unlabeled. One of them has a full export of the patient list from when you switched software. Also, someone found a USB stick in the parking lot last week and plugged it in "to see whose it was." Kind? Yes. Wise? Absolutely not.

Why it matters: Unencrypted removable media is a classic way data gets lost. The 2026 DBIR lists Loss among the top errors in healthcare breaches, "often involving unencrypted user devices and portable media."

The 5-minute check:

• Open the junk drawer. Count the USB sticks.
• Ask: does anyone back up or move patient/client files with USB drives?

The fix:

• Move file sharing to OneDrive or SharePoint, where access is logged and controlled.
• Use Intune or Defender policies to block or restrict USB storage on PCs that handle sensitive data.
• If you truly need removable media, use encrypted drives (BitLocker To Go on Windows) and track them.
• Shred, wipe or securely destroy the drawer collection. Parking-lot USBs go to IT, unplugged, in a sealed envelope like evidence on a crime show.

#18: The printer/scanner that emails your scans

The short answer: multifunction printers that "scan to email" often use a saved mailbox password, weak settings and firmware nobody has updated since installation.

The scenario: The copier scans to email. It works great. It was set up in 2018 by the copier company's tech using the office manager's personal email password (she's since left), or a special "scanner@" account with no MFA and a password everyone can read off a sticker. The printer's admin panel still has the factory default password, because who logs into a printer?

Why it matters: That saved account is a real Microsoft 365 mailbox that can send email as your business. And there's a deadline: Microsoft's Exchange team announced that basic authentication for SMTP AUTH (the older sign-in method many scanners use to send email) will be disabled by default for existing Microsoft 365 tenants at the end of December 2026, with OAuth as the supported method going forward. Admins can re-enable it temporarily, but Microsoft says a final removal date will be announced in the second half of 2027. Many offices will discover their scanner stopped emailing the morning after the holidays.

The 5-minute check:

• Scan something to email. Check the "from" address. Whose account is it?
• Ask your copier vendor how the device authenticates to Microsoft 365.
• Try logging in to the printer's web page with "admin/admin." (If that works, see hole #14.)

The fix:

• Move scan-to-email to a supported method (OAuth-capable devices, a relay connector, or scan-to-OneDrive/SharePoint).
• Change the printer's admin password and update its firmware.
• Remove the departed office manager's credentials from anything they ever touched.

#17: Personal Gmail for work

The short answer: if business is done from personal email accounts, you can't secure, retain, search or shut off any of it.

The scenario: The practice owner uses DrSmileTeeth1974@gmail.com for "quick stuff," which, over ten years, has become most stuff. The bookkeeper forwards invoices to her personal Yahoo so she can work from home. A staff member emailed herself a spreadsheet of patient balances "to finish on the weekend."

Why it matters: Personal accounts sit outside your Microsoft 365 protections: no conditional access, no data loss prevention, no audit trail, no way to remove access when someone leaves. For medical and dental practices, PHI in a personal email account is PHI outside every safeguard you've documented. And Gmail doesn't sign a business associate agreement for a consumer account.

The 5-minute check:

• Ask: has anyone emailed work files to a personal address in the last month? (Ask kindly. The answer is yes.)
• In Microsoft 365, check whether any mailboxes have automatic forwarding to outside addresses. This is also a classic sign of a hacked account.

The fix:

• Everyone uses their work account for work. Period.
• Block automatic forwarding to external domains (Microsoft 365 has an outbound spam policy setting for this).
• Give people a legitimate way to work from home, like OneDrive with app protection, so they don't need workarounds. Our BYOD and device management guide covers how.

#16: Shared folders and mailboxes that everyone can open

The short answer: when "Everyone" has access to everything, one compromised account exposes everything.

The scenario: The shared drive has a folder called "HR," which contains salaries, and a folder called "Old Stuff," which contains a 2021 patient export, and both are readable by every account in the office, including the student intern. The "info@" shared mailbox is open to all 14 staff, including three who no longer work there.

Why it matters: This is the principle of least privilege (least privilege explained): people should have access to what they need for their job, and nothing more. The 2026 DBIR notes that breaches often expose whatever data happens to be "lying around once an attacker strolls in," and calls out excessive privileges as a pervasive issue in cloud environments. Over-broad access turns one phished password into an all-you-can-eat buffet.

The 5-minute check:

• Pick your most sensitive folder (HR, payroll, patient exports). Check who has access.
• Open your shared mailboxes' membership lists. Count the names you don't recognize.

The fix:

• Organize files by role: front desk, clinical, billing, management.
• Remove "Everyone" and "All staff" from sensitive folders.
• Review shared mailbox and folder membership quarterly. Set a recurring calendar reminder titled "Who can see what?"

#15: Guest Wi-Fi on the same network as your server

The short answer: if patients, clients and the HVAC guy's phone share a network with your server and front-desk PCs, anything on that network can see your systems.

The scenario: The Wi-Fi password is on a framed sign in the waiting room: "Welcome! WiFi: SmileBright / Password: smile123." That network is the same network as the server, the X-ray computer and the practice management system. The owner's nephew "set up the Wi-Fi" one Saturday in 2020 and it has worked ever since, which is precisely the problem.

Why it matters: Network segmentation means separating devices into different networks so a problem in one area can't spread to another. The FBI's IC3 report recommends segmenting networks to help prevent the spread of ransomware by controlling traffic flows. A guest's infected laptop should never be one hop away from your patient records.

The 5-minute check:

• Connect your phone to the guest Wi-Fi. Try opening the printer's web page or a shared folder. If it works, guests can reach your systems.
• Ask: who set up the Wi-Fi, and is the router still under support?

The fix:

• Put guest Wi-Fi on a separate, isolated network (a separate VLAN, or virtual network) that only reaches the internet (what's a VLAN?).
• Separate staff Wi-Fi from guest Wi-Fi, with different passwords.
• Thank the nephew sincerely, then have a professional set it up properly. Our small office network and Wi-Fi guide explains what "properly" looks like.

#14: Default passwords on the router, firewall and cameras

The short answer: many network devices ship with well-known default passwords, and attackers try them automatically.

The scenario: The router's admin password is "admin." The security cameras' password is "12345." The firewall login is printed on a label on the firewall, which is helpfully sitting in the unlocked closet from hole #20. Nobody has logged into any of them since installation.

Why it matters: CISA has warned that attackers "continue to exploit default passwords" such as "1234," "default" and "password" on internet-exposed systems to gain initial access and move around inside organizations, and has urged manufacturers to eliminate them. The 2026 DBIR also calls out default passwords on internet-exposed management interfaces of end-of-life devices as a real-world threat.

The 5-minute check:

• List every device with an admin login: router, firewall, Wi-Fi access points, cameras, door system, printers, phone system.
• For each one, ask: has the default password ever been changed? Is remote admin from the internet turned off?

The fix:

• Change every default password to a unique, long one stored in a password manager. (Our password generator can make them.)
• Turn off remote management from the internet unless you specifically need it.
• Update firmware and replace devices that no longer get updates.

#13: The ancient server in the closet

The short answer: an old server running an unsupported operating system is an unpatched, unmonitored front door, usually holding your most important data.

The scenario: It's called "SERVER" (or, if you're lucky, "DENTRIX-OLD"). It's a beige tower that hums loudly enough to qualify as office white noise. It runs Windows Server 2012, which hasn't received regular security updates in years. Nobody knows the admin password except a former IT guy named Gary. Gary moved to Montana. Everything depends on it.

Why it matters: Vulnerability exploitation is now the top way attackers get in: the 2026 DBIR found it was the initial access vector in 31% of breaches, overtaking credential abuse. An unsupported server can't be patched against new vulnerabilities at all. And because it's usually the place with the file shares, practice database and backups, it's the one machine you can least afford to lose.

The 5-minute check:

• Find the server. Check its operating system version (Settings or System Properties).
• Look up whether that version is still supported by Microsoft.
• Ask: when was it last restarted for updates? Who has the admin password?

The fix:

• If your practice software supports it, move to the cloud version or to SharePoint/OneDrive and retire the server.
• If the server must stay, upgrade it to a supported OS, put it behind proper network segmentation, and monitor it.
• Document Gary's password in a password manager, then change it, then send Gary a nice postcard.

#12: Unlocked, unattended screens

The short answer: a logged-in, unlocked computer is a computer anyone can use as you.

The scenario: The doctor steps out of the consult room to grab a model of a molar, leaving the patient alone with an unlocked PC open to the full schedule. At the front desk, the computer is logged in as "frontdesk1" all day, every day, and walking away from it is a team sport.

Why it matters: The HIPAA Security Rule lists automatic logoff as an access control specification: electronic sessions should end after a set period of inactivity. It's also just common sense. You wouldn't leave the cash drawer open and wander off to lunch.

The 5-minute check:

• Walk around the office. Count the unlocked, unattended screens.
• Check a PC: how long until the screen locks on its own?

The fix:

• Set screen lock after a short idle period (often 5–10 minutes; shorter in public-facing areas) through Intune or Group Policy.
• Teach the shortcut: Windows key + L locks the screen instantly. Make it muscle memory. Make it a game.
• Use Windows Hello (face or fingerprint) or badge tap-in so unlocking is fast. If locking is painless, people actually do it.

#11: "Just click Enable Macros"

The short answer: macros are little programs inside Office files, and attackers use them to install malware the moment someone clicks "Enable."

The scenario: An email arrives: "Updated insurance fee schedule – please review." The attached Excel file opens to a gray screen that says, in a very official font, "This document is protected. Click ENABLE CONTENT to view." Someone clicks. Nothing appears to happen. Something has very much happened.

Why it matters: Microsoft's own documentation says VBA macros "are a common way for malicious actors to gain access to deploy malware and ransomware." That's why Microsoft changed Office to block macros in files from the internet by default, showing a security risk banner instead. Microsoft also recommends organizations enforce the "Block macros from running in Office files from the Internet" policy as part of their security baseline.

The 5-minute check:

• Ask your team: does anyone's work actually require macros? (Usually it's one spreadsheet in billing.)
• Ask your IT provider: is the macro-blocking policy enforced centrally, or just left at defaults that a user can click past?

The fix:

• Enforce macro blocking for internet files through Intune or Group Policy.
• Allow macros only from trusted locations or signed by your own team, for the few files that need them.
• Train staff: a document that needs you to "enable content" to read it is a red flag, every time. Our free phishing quiz is a fun way to test the team.

#10: Email anyone can fake (no SPF, DKIM or DMARC)

The short answer: without email authentication records, criminals can send emails that look like they came from your domain, to your patients, clients, vendors and your own staff.

The scenario: Your billing manager gets an email "from" the practice owner: "Are you at your desk? Need you to handle a quick wire for a vendor, I'm in a meeting." It's not from the owner. It just says it is. Meanwhile, a patient gets an email "from" your practice asking them to "update payment details." Your domain's email security records? Never set up. The nephew didn't know about those.

Why it matters: This is business email compromise (BEC) territory (BEC explained). The FBI IC3 2025 Internet Crime Report recorded about $3.05 billion in reported BEC losses in 2025, more than any other category except investment fraud. Three DNS records help mail systems decide whether an email claiming to be from you is real:

• SPF lists which servers may send email for your domain (SPF).
• DKIM adds a digital signature to your outgoing mail (DKIM).
• DMARC tells receiving servers what to do with mail that fails those checks, and sends you reports (DMARC).

Big mailbox providers are pushing this hard: Microsoft's Outlook.com began requiring SPF, DKIM and DMARC from high-volume senders (over 5,000 emails a day) in May 2025. You probably don't send that much, but the direction is clear.

The 5-minute check:

• Run your domain through our free email security checker. It shows whether SPF, DKIM and DMARC are set up.

The fix:

• Publish SPF and enable DKIM in Microsoft 365.
• Start DMARC at "p=none" to monitor, then move to "quarantine" and eventually "reject" once you know all your legitimate senders (billing systems, newsletters, the scanner from hole #18).
• Adopt a payment rule: any request to change bank details or send a wire gets verified by phone, using a number you already have. Our phishing and BEC guide covers the rest.

#9: Vendor remote access tools left wide open

The short answer: remote access software from past vendors, left installed and unmonitored, gives attackers a ready-made, trusted way into your computers.

The scenario: The imaging vendor installed a remote tool in 2019 to "help with updates." The old IT company installed a different one. The phone system vendor installed a third. A staff member installed a fourth so her cousin could "fix the printer." One of them uses a shared password that's identical across the vendor's entire customer base. Nobody knows which ones are still active.

Why it matters: Remote monitoring and management (RMM) and remote access tools are legitimate and useful (RMM explained), which is exactly why criminals love them. CISA, the NSA and MS-ISAC issued a joint advisory warning about malicious use of legitimate RMM software, including portable versions that don't even need admin rights. The 2026 DBIR found a 240% relative increase in attackers leveraging legitimate RMM software in system intrusion breaches. The same report found third-party involvement in 48% of breaches, up from 30% the year before.

The 5-minute check:

• On a couple of PCs, open the installed programs list. Look for TeamViewer, AnyDesk, ScreenConnect, LogMeIn, Splashtop and similar.
• For each one: who installed it, who uses it, and is it still needed?

The fix:

• Standardize on one remote tool, managed by your IT provider, with MFA and logging.
• Remove the rest. Block unapproved remote tools from being installed.
• Require vendors to request access through you, with access enabled only when needed.
• Ask every vendor with access whether they use MFA. If the answer is "huh?", that's an answer.

#8: Unencrypted laptops

The short answer: if a laptop without encryption is lost or stolen, everything on it is readable by whoever has it.

The scenario: The practice manager takes the laptop home to finish payroll. The laptop rides in the back seat. The back seat window gets smashed at the grocery store. The laptop is never seen again. Was it encrypted? Long, sad pause.

Why it matters: For healthcare, encryption is the difference between a lost device and a reportable breach of unsecured PHI. HHS guidance treats properly encrypted data as "secured." In 2020, HHS's Office for Civil Rights announced that Lifespan, a Rhode Island health system, paid $1,040,000 to settle potential HIPAA violations after an unencrypted laptop was stolen from an employee's car, citing a failure to encrypt and a lack of device and media controls.

The 5-minute check:

• On each Windows laptop, search for "Manage BitLocker" and check whether it's on.
• Better: ask your IT provider for an Intune encryption report covering every device.

The fix:

• Turn on BitLocker for all Windows PCs (BitLocker explained) and FileVault for Macs, enforced and reported through Intune.
• Store recovery keys in Entra ID/Intune, not on a Post-it in the laptop bag.
• Encrypt phones and tablets too (a passcode turns on encryption on modern iPhones and Androids, and MDM can enforce it).

#7: Backups nobody has ever tested

The short answer: a backup you've never restored from is a hope, not a plan.

The scenario: "Oh, we have backups." Great! When did you last restore something? "...The backup emails say 'Success.'" The backup emails have said "Success" every night since 2022. The backup drive filled up in 2023. The "Success" email is technically accurate: it successfully backed up nothing.

Why it matters: Good backups are your best defense against ransomware extortion. The 2026 DBIR found that 69% of ransomware victims didn't pay the ransom, and ransomware appeared in 48% of all breaches. Reliable backups are what make "we won't pay" a realistic option. The HIPAA Security Rule also requires a data backup plan and a disaster recovery plan, and includes testing and revising contingency plans as an implementation specification.

The 5-minute check:

• Ask: what was the last test restore, and how long did it take?
• Is a copy of the backup offline or immutable (can't be changed or deleted, even by an attacker with admin access)? (Immutable backup explained.)
• Are Microsoft 365 email and files backed up separately, or are you relying on Microsoft's built-in retention alone?

The fix:

• Follow the 3-2-1 rule: three copies, on two types of media, one offsite (3-2-1 backup), with at least one copy immutable or offline.
• Test-restore a file monthly and a full system at least annually. Write down how long it took.
• Use our downtime cost calculator to decide how fast recovery needs to be, and our backup and disaster recovery guide to plan it.

#6: Unpatched PCs (and the Windows 10 machines nobody replaced)

The short answer: every missed update is a known, published weakness that attackers have instructions for.

The scenario: The front desk PC has been "postponing updates" since spring because restarting "takes forever." The X-ray computer runs Windows 10 because "it's attached to the sensor." The billing PC shows a little notification that has been politely asking to update for 214 days, and has been politely ignored for 214 days.

Why it matters: The 2026 DBIR found vulnerability exploitation is now the leading initial access vector at 31% of breaches, and the median time for organizations to fully patch known-exploited vulnerabilities rose to 43 days. Windows 10 reached end of support on October 14, 2025, so unless a business pays for Extended Security Updates, those PCs no longer receive security fixes. (Our Windows 10 end of support guide covers your options.)

The 5-minute check:

• On each PC, open Settings > Windows Update. Note pending updates and the Windows version.
• Count Windows 10 machines. Check whether any are enrolled in ESU.

The fix:

• Automate patch management (patch management explained) through Intune or your IT provider's tools, with forced restarts scheduled after hours.
• Patch third-party apps (browsers, PDF readers, Java, Zoom) too, not just Windows.
• Upgrade eligible Windows 10 PCs and replace the rest. Our computer replacement planner builds the budget.
• Isolate anything that truly can't be upgraded, like that X-ray PC, on its own network segment.

#5: Everyone is an administrator

The short answer: when every user has admin rights, any malware they accidentally run gets admin rights too.

The scenario: Years ago someone needed to install a printer driver, so the IT person made them a local admin. Then everyone wanted to be able to install things, so everyone became an admin. Now the receptionist can install anything, change any setting and disable the antivirus, and so can any malware that tricks her into clicking a link.

Why it matters: Least privilege again, at the device level. Admin rights let malicious software dig in deeper, disable protections and spread. The 2026 DBIR notes that many cloud and third-party breaches "boil down to insecure authentication" or "lack of least privilege enforcement for users or service accounts." Cyber insurance applications commonly ask about admin rights, too.

The 5-minute check:

• On a PC, open Settings > Accounts > Your info. Does it say "Administrator"?
• In Microsoft 365, count how many people are Global Administrators. (The ideal number for a small business is small: typically two, using separate admin accounts.)

The fix:

• Remove local admin rights from everyday user accounts.
• Use separate admin accounts for IT tasks, protected by strong MFA.
• Give people a fast way to request installs, or use Intune's Company Portal so approved apps install without admin rights.
• Use our cyber insurance readiness tool to see how this and other answers stack up.

#4: Former employees who still have access (and no offboarding checklist)

The short answer: accounts belonging to people who've left are unwatched keys to your business, and without a checklist they never get fully revoked.

The scenario: The hygienist left in January. Her Microsoft 365 account is still active ("we might need her email"). The practice management login she shared with two coworkers still works. The office alarm code she knew hasn't changed. She's lovely and would never misuse it. Unfortunately, her reused password just showed up in someone else's data breach, and the criminals who bought it are less lovely.

Why it matters: HHS's Office for Civil Rights described a case in which Memorial Healthcare System paid $5.5 million to settle potential HIPAA violations after the login credentials of a former employee of an affiliated physician's office were used to access patient information on a daily basis for about a year without detection. OCR's finding: the organization failed to implement procedures for reviewing, modifying and terminating users' right of access. The 2026 DBIR also found small organizations experienced a median of seven credential leak events in a year, and ransomware gangs buy leaked credentials.

The 5-minute check:

• Export your list of active Microsoft 365 users. Compare it to your current staff list.
• Do the same for practice management, billing, payroll, banking and vendor portals.

The fix: write an offboarding checklist and use it every time.

• Disable the Microsoft 365 account and revoke sessions on the last day (convert mailbox to shared if you need to keep it).
• Remove access to practice management, billing, banking, payroll and vendor portals.
• Selectively wipe company data from personal phones.
• Collect laptops, badges, keys and tokens.
• Change any shared passwords, alarm codes and Wi-Fi passwords they knew.
• Remove them from shared mailboxes and groups.
• Record the date and who did what.

#3: Passwords on Post-its (and in "passwords.xlsx")

The short answer: a written-down password is only as secure as the place it's written, and "under the keyboard" is the first place anyone looks.

The scenario: Lift the keyboard at the front desk. There it is: a yellow Post-it with the practice management password, the Wi-Fi password and, for some reason, the alarm code. The billing PC has a monitor bezel decorated with passwords like a scrapbook. And on the shared drive, there's a file called "passwords.xlsx." It is not password-protected. Of course it isn't.

Why it matters: Anyone who can see the note (patients, delivery drivers, cleaning crews, the guy who services the copier) can log in as you. And a spreadsheet of passwords is the single most valuable file an attacker could find after breaking in.

The 5-minute check:

• Lift every keyboard. Check monitors, desk drawers and the inside of the supply cabinet door.
• Search the shared drive and OneDrive for files named "password," "logins" or "pw."

The fix:

• Give every staff member a business password manager (password manager explained), with shared vaults for the logins that genuinely must be shared.
• Delete "passwords.xlsx" (after moving its contents into the password manager, and then changing every password that was in it).
• Use Windows Hello and passkeys where available (passkeys explained) so there are fewer passwords to remember at all.
• Ceremonially shred the Post-its. Confetti optional.

#2: Reused and shared passwords ("frontdesk1")

The short answer: one password reused across sites means one breach anywhere unlocks you everywhere, and shared logins mean you can never tell who did what.

The scenario: The front desk logs into everything as "frontdesk1," password "Frontdesk1!" (the exclamation point is for security). The practice owner uses the same password for the bank, Microsoft 365, the dental supply site and the fantasy football league. The fantasy football league got breached last year.

Why it matters: For SMB breaches, the 2026 DBIR found that victims had compromised credentials in 38% of the cases it describes. Shared accounts also break accountability, and for healthcare the HIPAA Security Rule requires unique user identification: each person needs their own login so activity can be traced. NIST's current password guidance (SP 800-63B-4) is refreshingly practical:

• Passwords used on their own should be at least 15 characters.
• Don't force arbitrary complexity rules ("must include a symbol") or periodic changes; change passwords when there's evidence of compromise.
• Check new passwords against lists of common and breached passwords.
• Allow password managers and pasting.

The 5-minute check:

• List every shared login in the office (front desk, "billing," "scanner," "admin").
• Ask yourself honestly: do I reuse my email password anywhere?

The fix:

• One person, one account. Retire every shared login you can.
• Long, unique passwords for everything, generated by a password manager (or our password generator).
• Turn on Microsoft Entra password protection to block common and weak passwords.
• And then, crucially, do #1.

#1: No multi-factor authentication (MFA)

The short answer: MFA is the single most effective fix on this list. Without it, a stolen password is all an attacker needs.

The scenario: The office manager gets an email that looks exactly like a Microsoft 365 sign-in page. She types her password. Thirty seconds later, someone in another country is reading her inbox, setting up a rule to hide replies from the bank, and emailing your patients a "new payment portal." With MFA turned on, that stolen password alone would have hit a wall.

Why it matters: Multi-factor authentication (MFA) means signing in with something you know (password) plus something you have (an app on your phone, a security key) or something you are (fingerprint, face) (MFA explained). Microsoft research on real accounts found MFA reduced the risk of account compromise by more than 99.2%, and still by about 98.6% even when the password had already leaked. CISA lists turning on MFA as one of its four basic steps for everyone.

MFA isn't magic: attackers now use fake sign-in pages that relay codes in real time, and "MFA fatigue" attacks that spam approval prompts. That's why stronger methods like number matching in the Microsoft Authenticator app and phishing-resistant options such as passkeys and security keys are worth it, especially for admins.

The 5-minute check:

• In the Microsoft 365 admin center or Entra ID, check how many users are registered for MFA. Is it 100%?
• Check your other critical logins: bank, payroll, practice management, domain registrar, backup console, remote access tool. Is MFA on for each?

The fix:

• Turn on MFA for every Microsoft 365 user, ideally enforced through conditional access (conditional access explained).
• Use the Microsoft Authenticator app with number matching, and passkeys or security keys for admins.
• Turn on MFA for banking, payroll, the domain registrar and every vendor portal that supports it.
• Our multi-factor authentication guide walks through rollout without the front desk mutiny.

Which holes should you fix first?

Fix the account holes first (MFA, shared and reused passwords, ex-employee access, admin rights), then backups and patching, then everything else. Account takeover and unpatched systems are the two biggest ways in, and those fixes are cheap.

Here's a rough priority guide by effort and impact:

One timing note: hole #18 has a hard date. If your scanners use basic authentication to send email through Microsoft 365, plan the fix before the end of December 2026.

Mistakes we see when offices try to fix these

• Turning on MFA with no warning. Staff get locked out on Monday morning and the project dies. Announce it, help people enroll, then enforce.
• Buying tools instead of turning on what you have. Many offices already pay for Microsoft 365 Business Premium, which includes Intune, Defender for Business and conditional access, and use almost none of it.
• Fixing it once, never checking again. Ex-employee accounts, admin rights and shared folder permissions drift back. Put a quarterly review on the calendar.
• Treating the self-audit as a pass/fail test. It's a to-do list. Nobody gets all 20 on the first try.
• Forgetting the vendors. With third parties involved in nearly half of breaches in the 2026 DBIR, ask your vendors the same questions you're asking yourself.

How this looks in a real office

A dental practice: The most common pattern we see is shared front-desk logins, an old server running imaging, guest Wi-Fi on the main network and a remote tool from a long-gone vendor. Fixing those four, plus MFA, closes most of the realistic attack paths. Our dental practice case study shows what a well-designed setup looks like: encrypted cloud storage, managed devices, multi-factor sign-in and conditional access, plus internet failover so the front desk keeps working.

A medical office: Unlocked exam-room PCs, unencrypted laptops that go home with providers, and scanners emailing referrals through an old shared mailbox. Screen lock, BitLocker and fixing scanner authentication handle most of it. Pair this list with our HIPAA security checklist tool and the HIPAA Security Rule checklist article.

A CPA firm: Personal email for client documents, "passwords.xlsx" on the shared drive, and everyone as admin. A password manager, least privilege and no external forwarding go a long way, and they map directly to the documented controls that client security reviews ask for, as in our accounting firm case study.

The printable self-audit

Print this, walk the office, and mark each line. Each check takes about five minutes.

Scoring, roughly: 17–20 passes, you're in good shape, keep reviewing quarterly. 11–16, you have a solid base and a clear to-do list. 10 or fewer, you're in the same boat as a lot of small offices, and the "this week" row in the priority table above is your starting line.

The bottom line

The most dangerous security holes in a small office aren't exotic. They're the shared login at the front desk, the account nobody turned off, the backup nobody tested and the password under the keyboard. Attackers find them with automated tools, at scale, without ever caring what your business does.

The upside is that almost every fix on this list is cheap, and many are free with Microsoft 365. Turn on MFA. Give everyone their own account and a password manager. Shut off people who've left. Patch, encrypt and test your backups. Then work down the list a few holes at a time.

If you'd like a second pair of eyes, we're happy to walk through this audit with you. A beefed-up security setup is mostly the basics, done properly and checked regularly. Book a free 20-minute call and we'll help you figure out which holes to plug first.