"Who Would Ever Attack Me?" Cybersecurity Lessons for SMEs

"There are two kinds of companies: those that have been hit by a cyberattack, and those that will be."

Don't think you can't be a target.

In a single week I attended two cybersecurity events, and both left me with lessons every SME leader should know.

"Who would ever attack me?"

That was the title of a cybersecurity meeting organised by VOSZ (the National Association of Entrepreneurs and Employers) in Veszprém, with talks by Zoltán Szeker and Sándor Fehér.

Zoltán Szeker: trust is gone, recovery is key

Zoltán talked about how trust has been lost in the digital space, and why business continuity matters most when an attack hits. Having backups is pointless if you can't get back up and running. Key points:

Passwords. You wouldn't believe it, but some places use the email address as the password. Permissions. Who can access what, and why. Two-factor authentication (2FA). A bare minimum. Updates. Don't skip them, and that includes your website.

Sándor Fehér: what to do once it's happened

Sándor focused on incident response, with some astonishing case studies. The takeaways:

Never pay the attacker. You're only funding them, and there's no guarantee you'll get anything back. Preparedness. Have a defined process for when things go wrong. Transparency. Always inform your partners if you've been attacked. Authorities. Report the incident and file a police report.

Gabriella Joó: people are the biggest risk

The next day, at the event "The EU's New Challenges: NIS2 Compliance, Cybersecurity, Information Security", organised by the Veszprém County Chamber of Commerce and Industry and the ISO 9000 Forum Association, Gabriella drew on her experience as an information security officer to share real, tangible cases and practical advice. Her key message: people are the biggest risk, because they leave the gaps.

The three pillars: confidentiality, integrity, availability. Awareness. Without properly informing your colleagues, nothing else is enough. Data. Not all data needs the same level of protection. Know what's critical. Testing. A recovery plan is good, but it's only worth something if it's been tested, for real.

What I hadn't considered: the era of file-based data is over

The three talks came from different angles, but together they painted a complete picture. And they highlighted something I hadn't thought through from this perspective in relation to operational improvement.

Picture a central spreadsheet that everyone can access, holding the company's entire pricing strategy. That's a huge risk. Especially when everyone saves a copy to their desktop "for quick access".

A file like that doesn't even need an attack. If it gets corrupted or freezes, the business freezes with it.

The solution: a system, backed by a process

You need a system, whether a CRM, an ERP or a database, where data is protected centrally with proper access management. Who sees what, who can change what, and everything is traceable.

But a system needs a process, otherwise it's worthless. So operational improvement has a less talked-about benefit: it makes your company more secure.

What to do today

If you have no security processes at all right now, don't put it off. You can even start with an AI assistant. Try typing something like:

"NIS2, ISO 27001, information security officer: I currently have no security processes at all. Where should I start? What should the first step be?"

Start today!

And if you'd like to move from scattered spreadsheets to a central system with proper access control, we can help: digitalizaltmukodes.hu

Many thanks to the speakers for their excellent talks.