Top 10 myths that prevent your company from engaging in Information Security

Information security (IS) today is not an option, not "optional" and certainly not luxury. It is an indispensable element of business survival in the digital environment.

But, as practice shows, it is not budgets or lack of specialists that hinders the implementation of IS in companies, but myths. False beliefs that are firmly lodged in heads of managers, IT directors and even employees.

Today we're looking at 10 of the most common myths that prevent companies from protecting themselves. And you might be surprised how many of them you've heard or said yourself.

"We're too small — who needs us?"

This is perhaps the most dangerous and also the most widely held myth among small and medium-sized businesses.

Why it's a myth. Attacks don't choose size — they choose vulnerability.

Cybercriminals have long used automated scanners that look for vulnerabilities on the internet without company name. They don't care how many employees you have or what your turnover is. Their goal is to find "hole" through which they can quickly pull data, money or access other organisations through you.

The numbers speak for themselves:

• 43% of all cyberattacks globally are on small businesses;

• only 14 per cent of such companies are actually prepared for cyber incidents;

• more than 60 per cent of small and medium-sized business sites experiencing a major spill are closed within 6 months of incident.

Why are small businesses often attacked?

• They more often have weak defences — no IS specialist, no DLP systems, passwords are stored in an Excel file, no fixed access control.

• Less bureaucracy means you can get access faster.

• Small businesses can be jumping-off point for attacks on large customers or partners (e.g., via an infected attachment).

Real-life example:

The company with 25 employees was hacked via a phishing email sent on behalf of a "bank". One of the managers opened the attachment, after which the attackers gained access to corporate email and CRM. Within a week, customer data was in the public domain, complaints and churn began.

Total losses: ≈$3 million and reputation.

All because "no one will touch us".

"We don't have important information"

This myth goes something like this: "We are not a bank, we are not an IT giant, we do not keep military secrets. What could be stolen from us?"

At first glance, it makes sense. But only at first glance. Now think about it:

• Do you have a customer base? With contacts, e-mail, phone number, delivery addresses?

• Do you keep financial records that show invoices, transactions, payment details?

• Keep contracts with contractors or price lists with customised terms and conditions?

• Any work correspondence discussing projects, budgets, plans, sensitive information?

• Use logins and passwords from email, CRM, online banking?

If you answered "yes" to at least one question — congratulations, you have information of value.

Why is this information important?

🔒 Personal data is protected by law. Their leakage leads to fines and proceedings.
💰 Trade secrets — competitors don't have to "hack" you, just "sneak a peek" at prices, plans or terms and conditions.
🎯 Proprietary information — can be used for further attacks: for example, an email from a "director" asking to transfer money.

How it's being monetised:

• customer base is sold on forums on the darknet (even at $1-2 per contact);

• attachments with documents and contracts are forged and used for social engineering scams. What it is — see our article;

• correspondence with logins, codes, internal links used to select access to systems;

• commercial terms — leaked to competitors or used for blackmail.

"Antivirus — that's enough"

Antivirus is like a first aid kit in a car. Useful, but it won't save you from serious accident. It's the same with antivirus.

Today's threats have gone far beyond viruses. They have become smarter, more subtle, more sophisticated. Pay attention to the topics we cover all the time in our channel. Fraudsters are quite sophisticated, using different approaches, which fundamentally changes the approach to security.

"We store everything in the cloud — let the provider be responsible"

The cloud is not a magic shield. Yes, the provider protects the infrastructure, but content, access and internal processes are your responsibility.

It's mistake to think that moving to the cloud solves all security issues. On the contrary, new vulnerabilities are opening up.

"DLP systems are only for corporations"

And here's where we pay attention. DLP is the system that protects against data leaks: via messengers, email, thumb drives, screen photos and even simple "copy-paste".

Myth: DLP is expensive, complicated and only "Apple" needs it.

Fact: today there are DLP solutions of different types, relevant for small businesses, for remote teams, and for individual departments.

It is the DLP system that helps companies prevent leaks, not "sort it out later". It's like the alarm system: better in advance than after breach.

"We don't have money for Information Security"

This argument often sounds sincere. Especially from small businesses, where every rouble counts. But let's put everything in order.

The truth is that IS today is not "luxury for the rich" but "survival minimum" even for small teams.

Why is basic defence not as costly?

Setting access rights — you can limit who can see and edit what in documents, mail, CRM.

Employee training — elementary rules of digital hygiene can be learnt in 1 hour and will keep most phishing attacks at bay.

Two-factor authentication (2FA) — almost everywhere is free: Google Authenticator, SMS codes, push notifications.

Backup — connect cloud storage or external drives with automation.

A cloud-based DLP system that costs comparable to mobile phone tariff.

In sum: even a microbusiness with 3-5 employees can organise the basic IS for an amount approximately equal to one or two coffee deliveries to office per month.

"It's up to employees to think about how to protect themselves"

No, you don't. Information Security is not matter of intuition or personal responsibility. It's matter of culture, training and a systematic approach. If an employee doesn't know what a phishing email looks like, there's a good chance he or she will open it. If no one has explained that it is unacceptable to send tables with customers' Personal Data to Telegram, they will do so.

Expecting everyone to be an expert in cyber threats is illusion. People come to do their jobs: selling, consulting, developing, customer service. They don't have to be security experts.

But the company must provide them with clear instructions, regular training, examples of real threats and the consequences of mistakes. Without this, any security policy will remain on paper, and the weakest link remains the human being.

Conclusion: safety is a team game and the role of an employer is key. Failure to train means failure to protect.

"We've got it all set up — don't touch it"

Security is not a "set it and forget it" proposition. Threats change, attack patterns evolve and new vulnerabilities emerge.

What worked in 2020 may be useless in 2025.

Without regular audits and updates — your defence becomes an illusion.

"We're too inconspicuous to be found"

Cyberattacks today are automatic. Bots scan websites and IP addresses 24/7, identifying open ports, weak passwords and vulnerabilities.

The hacker doesn't need you personally — he just "catches everyone else".

"Information security is the task of IT"

This is myth that can destroy the entire defence.

Security is team area of responsibility:

• management makes strategic decisions;

• HR trains the staff;

• accounting department keeps confidential documents;

• and IT is just setting up the tools.

If you think "let IT decide for themselves" — you're already vulnerable.

What to do?

The first one is to stop believing myths.

The second is to start simple:
✅ train your employees;
✅ implement two-factor authentication to risky transactions;
✅ install the DLP system;
✅ conduct an IS audit every six months.

Information Security is not about fear. It's about maturity.

And the earlier you start — the more chance that one day you'll just say: