Most writing about small business cybersecurity in Ireland follows a formula: frightening statistic, list of twenty things you must do, invitation to buy something. This article is shorter and more useful. The honest truth is that a handful of controls stop the overwhelming majority of attacks against small businesses, and they are boring, cheap and well understood. Here is what actually matters, in the order it matters.

Why small businesses are the target now

Attackers automate. A script does not care whether it is testing a bank or a butcher's booking page; it scans for known weaknesses and reports back whatever answers. Industry breach reports have been consistent for years: small organisations now account for the majority of confirmed breaches, precisely because they run unpatched software and reused passwords. The typical Irish SME incident is not a mastermind targeting you. It is an automated WordPress exploit, a phished Office 365 password, or an invoice-scam email that looked exactly like your supplier.

The Garda National Cyber Crime Bureau and the NCSC both report the same pattern: business email compromise and ransomware delivered through phishing cause the largest financial losses to Irish small firms — not exotic zero-days.

The five controls that do the work

1. Phishing-resistant logins

Turn on multi-factor authentication for email, banking and anything holding customer data — and prefer app or hardware-key MFA over SMS. Email is the master key to your business: whoever controls your inbox controls your password resets. This single control stops the most common attack on Irish SMEs dead.

2. Updates within a week, not a year

The majority of website compromises exploit vulnerabilities that were patched months before the attack. If your site runs WordPress, the plugins are the risk: each one is code you did not write, updated on someone else's schedule. Either commit to weekly updates, or remove the need by running a site with no plugin stack at all.

3. Backups you have actually tested

Ransomware is unremarkable if you can restore yesterday's data in an afternoon. The rule is 3-2-1: three copies, two media, one off-site. The detail that matters is the test — an untested backup is a rumour, not a backup. Restore one file this week. If you cannot, you do not have backups.

4. Payment and bank-verification procedures

Invoice fraud — a fake "we changed our bank details" email — costs Irish businesses more than most technical attacks. The fix is procedural, not technical: any change of payment details is confirmed by a phone call to a number you already had. Write it down, tell your accounts person, done.

5. Know what your website exposes

If your website takes bookings, payments or personal data, it is an application, and applications have attack surface. The OWASP Top 10 — injection, broken access control, misconfiguration — reads abstract until a tester demonstrates it on your own site in an afternoon. That demonstration is what a Web Application Security Test is: an authorised professional attacking your site the way a criminal would, then handing you the list of what to fix, scored so you know what matters.

The GDPR dimension

If your website collects names, emails or payment details — and almost every business site does — you are a data controller under GDPR, and the Data Protection Commission is not a theoretical presence. Irish SMEs have been investigated and fined. The practical consequence of a breach is not just the ransom or the fraud loss: it is the mandatory 72-hour breach notification, the possibility of DPC scrutiny, and the email you have to send to every affected customer. Good hygiene is also cheap legal defence: documented MFA, patching and tested backups are exactly the "appropriate technical and organisational measures" the regulation asks for. A business that can show those measures after an incident is in a different universe from one that cannot.

What a WAST actually buys you

A WAST engagement for a small business site is measured in days, not weeks, and the output is plain: findings ranked by severity under CVSS scoring, reproduction steps, and a remediation plan. It answers the only question that matters — if someone attacks this, how far do they get? — with evidence instead of hope. Increasingly, Irish enterprise procurement and cyber-insurance underwriters ask for exactly this document before signing. Our fixed-price security audit is built to produce it, and the Vanguard WAST engagement shows what the process looks like end to end.

What you can safely ignore

You almost certainly do not need a SOC, a threat-intelligence subscription, or anything with "AI-powered" in the name. The gap between Irish SMEs and attackers is not sophistication; it is the five controls above, done consistently. Spend on those before anything with a dashboard. The same logic applies to compliance theatre: a framed certificate on the wall stops no attacks, but a tested backup and an enforced MFA policy stop most of them. Buy outcomes, not artefacts.

The honest conclusion

Cybersecurity for a small Irish business is not an arms race; it is hygiene. MFA on email, prompt updates, tested backups, a phone-call rule for bank details, and a periodic security test of whatever faces the internet. That is a weekend of work and a modest annual cost — against an average SME breach that runs into five figures before the downtime is counted.