Hey there.
Alright folks, I’m going to tell you something your dev team already knows but is too polite to say to your face: the biggest security hole in your company isn’t in your codebase. It’s sitting in the founder’s chair.
I’ve spent 25+ years in business warfare — buying troubled companies, turning them around, doing private security consulting, and researching cybersecurity from the operator’s side, not the engineer’s. And I can tell you this with total confidence: when small businesses get hacked, it’s almost never some hoodie-wearing genius cracking encryption. It’s a founder reusing a password. It’s an admin clicking a link. It’s someone handing over the keys because the “IT guy” on the phone sounded convincing.
Hackers don’t break in. They log in.
The math nobody wants to do.
Here’s the part that should scare you straight. The average cost of a data breach for a small business runs into six figures — and a huge percentage of small businesses that suffer a major breach shut down within months. Not because the hack was sophisticated. Because the recovery was impossible.
Think about it like a military campaign. You’ve built this beautiful fortress — your product, your customer list, your payment systems. And then you leave the back gate open with a sign that says “come on in.” That’s what a reused password is. That’s what an unpatched laptop is. That’s what your executive assistant’s inbox is when nobody’s trained her what a spear-phishing email looks like.
The attackers know this. They’re not wasting zero-days on your seed-stage SaaS. They’re running the cheapest playbook in the book: find the human, fool the human, own the human.
The five breaches I see on repeat.
After decades of watching businesses get hit, the pattern is always the same. Different companies, different industries, same five failures:
1. Password reuse across everything. Your founder uses the same password for the company AWS account and some forum he joined in 2019. That forum gets breached, the credentials get sold, and now someone’s logging into your infrastructure at 3 AM. One password, total compromise. This is the single most common way in, and it takes ten minutes to fix with a password manager.
2. No multi-factor authentication on the crown jewels. Email, banking, cloud infrastructure, domain registrar — if these don’t have MFA, you’re one phished password away from losing the company. Your domain registrar alone: if an attacker takes your domain, they own your email, your password resets, everything.
3. Nobody trained the team. Your people are your perimeter. One well-crafted email pretending to be you, asking your bookkeeper to “wire this quickly before the call,” and the money’s gone. I’ve seen it happen to companies with real revenue and real investors. The fix isn’t a $50,000 security audit — it’s a 30-minute training and a culture where nobody wires money on an email request. Ever.
4. The founder’s personal accounts are the backdoor. Here’s the espionage angle: attackers don’t target your company directly. They target you. Your personal email, your social media, your kid’s school portal — anything that can be used for leverage, impersonation, or password-reset chains. If your personal Gmail is the recovery email for your business accounts, your personal security IS your business security.
5. No incident plan. When — not if — something happens, the first hour decides everything. Most founders have no plan: no idea who to call, no backups verified, no idea which accounts to lock down first. Panic is not a strategy. A one-page incident plan written on a calm Tuesday beats a brilliant response improvised during a breach.
Think like the attacker (this is the fun part)
Here’s where my background kicks in. In military doctrine, you don’t defend everywhere equally — you defend what matters, and you think like the enemy.
Ask yourself: if I were trying to rob my own company, how would I do it? You’d go after the email first (it’s the master key to every password reset). Then the money (banking, payment processors). Then the customers (their data is your liability). Work backward from there and harden in that order.
This is threat modeling, and you don’t need to be technical to do it. You need to be honest. Most founders aren’t.
What to do this week (the 80/20 of not getting hacked)
You don’t need a security team. You need discipline on the basics — the boring stuff that stops 90% of attacks:
- Password manager for everyone. Not optional. Not “when we have time.” This week.
- MFA on everything that touches money, email, or infrastructure. Start with email, banking, cloud, and domain registrar.
- One-page wire-transfer rule. No money moves on an email or text request alone. Voice confirmation, every time, no exceptions — including requests that look like they’re from you.
- Update everything. That laptop you’ve been hitting “remind me later” on for three months? The patch it needs is the one blocking an attack that’s already circulating.
- Backups you actually test. A backup you’ve never restored is a hope, not a backup.
None of this requires an engineer. All of it requires a founder who takes security personally — because the attacker already does.
The Bottom Line
Cybersecurity isn’t an IT problem for founders. It’s a leadership problem. Your company will never be more secure than your own habits, because you hold the keys to everything.
The good news? The basics work. The attackers are lazy — they’re going after the companies that left the gate open. Close the gate, lock it properly, and they’ll move on to someone easier. That’s not paranoia. That’s just good business warfare.
Want the full field manual? I put together a free 20-Point Cyber Hygiene Checklist — the exact basics above, expanded into a one-page audit you can run on your company this afternoon: https://therealmdwhite.gumroad.com/l/iokmxh
And if you want the complete playbook — threat modeling, incident response plans, vendor security, the works — my Cybersecurity for Non-Technical Founders guide covers it: https://therealmdwhite.gumroad.com/l/ccalsf
Stay dangerous out there. 🔒
