The 5 Security Moves Every Founder Should Make Before Hiring IT

Your password will leak eventually. A vendor gets breached, someone reuses a password, a phishing email lands. MFA means a stolen password alone gets an attacker nothing.

Do this

• Turn on MFA for email first. Email is the master key to everything else.
• Then banking, payroll, cloud storage, and your website admin.
• Use an authenticator app, not text messages, wherever possible.
• No exceptions for the boss. Owner accounts are the #1 target.

Forget hackers in hoodies. The most expensive attack looks like a normal email: a vendor “updating” their bank details, your bookkeeper getting a rushed wire request that looks like it came from you. One reply, one wire, six figures gone.

Do this

• Add advanced email filtering on top of what comes built in. Built-in filters miss the good fakes.
• Make one rule and never break it: any change to payment details gets verified by phone, using a number you already have — not one from the email.
• Tell your people about that rule. Then remind them quarterly.

Here’s what surprises most founders: your cloud data isn’t backed up just because it’s in the cloud. Microsoft and Google keep your services running. Recovering your deleted or encrypted files is your job, not theirs.

Do this

• Back up cloud data (email, files, accounting) to a separate service.
• Automate it. Backups that depend on someone remembering will fail.
• Test a restore twice a year. A backup you’ve never restored is a hope, not a plan.

Traditional antivirus reacts after infection. Modern endpoint protection (EDR) watches how programs behave and stops attacks it has never seen before. The difference matters because new attacks are the ones that get through.

Do this

• Put EDR on every computer that touches company data — including that one personal laptop everyone forgot about.
• Keep devices updated. Unpatched software is now the #1 way attackers get in, per Verizon’s 2026 report.
• Turn on automatic updates and stop postponing restarts.

Incidents get expensive in the first hours, when nobody knows who decides, who calls the bank, or whether to shut systems down. A one-page plan beats a 40-page binder nobody reads.

Do this

• Write down: who to call first (your IT partner or security contact), your bank’s fraud line, and your cyber insurance carrier if you have one.
• If money moved, call the bank immediately. Recalls sometimes work in the first hours. Rarely after.
• Don’t wipe or reboot affected machines. You may destroy the evidence needed to recover.
• Report it at ic3.gov. It helps you and everyone after you.