Cybersecurity for Solopreneurs

Cybersecurity for a solopreneur is the process of protecting business accounts, devices, websites, money, customer information, intellectual property, and operating access from unauthorized use, disruption, fraud, theft, and manipulation.

A one-person business may have fewer systems than a large company, but it also has less redundancy. The same person commonly controls sales, payments, customer communication, software administration, domain ownership, and incident response.

One compromised account can therefore give an attacker control over several parts of the business at once.

Why Solopreneurs Need Cybersecurity

Cybersecurity is not limited to preventing sophisticated technical attacks. The most likely incidents often begin with an ordinary event:

• A convincing payment email
• A fake account warning
• A reused password
• An unpatched website plugin
• A malicious browser extension
• An exposed API key
• A stolen laptop
• An unauthorized SaaS integration
• A contractor retaining access
• A fraudulent domain-renewal message
• A support caller requesting a verification code
• Confidential information pasted into an AI tool

The 2026 Verizon report found that exploitation of software vulnerabilities initiated 31% of breaches, making it a more common entry point than stolen credentials for the first time in the report’s history. Ransomware was involved in 48% of breaches, while third parties were involved in 48%.

Cyber-enabled fraud creates a separate financial risk. The FBI’s 2025 IC3 report recorded 1,008,597 complaints and $20.877 billion in reported losses. Business email compromise accounted for 24,768 complaints and approximately $3.05 billion in reported losses.

These figures do not represent every incident or predict the risk of a particular solopreneur. They demonstrate that cybersecurity includes both technical compromise and deception-based financial fraud.

What Does Cybersecurity Protect?

A solopreneur cybersecurity program should protect five outcomes.

Confidentiality

Information is accessible only to authorized people and systems.

Examples include:

• Customer personal data
• Contracts
• Financial records
• Unpublished content
• Business plans
• Authentication credentials
• API keys
• Private communications
• Product source files

Integrity

Information and systems remain accurate, complete, and protected from unauthorized modification.

Examples include:

• Correct payment details
• Accurate customer records
• Unchanged website content
• Valid software releases
• Reliable analytics
• Authentic invoices
• Approved automation rules

Availability

Essential accounts, systems, and information remain usable when required.

Examples include:

• Website availability
• Access to business email
• Customer-support systems
• Ecommerce checkout
• Current project files
• Accounting records

Authenticity

The business can determine whether a person, message, request, document, or transaction is genuine.

This is critical for:

• Payment instructions
• Account-recovery requests
• Contractor communication
• Support calls
• Domain notices
• Customer refund requests
• Software downloads
• AI-generated audio or video

Accountability

Important actions can be traced to the person, account, or system that performed them.

Useful controls include:

• Individual user accounts
• Audit logs
• Version history
• Administrative alerts
• Transaction records
• Documented approvals
• Access reviews

Why Cybersecurity Is Different for a One-Person Business

A solopreneur commonly has several concentrations of risk.

One Primary Identity

One email address may control the password manager, hosting, banking, cloud documents, advertising, analytics, and social accounts.

One Administrator

The owner often uses administrator privileges for everyday work, increasing the consequences of phishing, malware, and mistakes.

One Decision Maker

There may be no second person to question an urgent payment, suspicious login, or unusual recovery request.

One Recovery Path

Recovery codes, passwords, documentation, and notifications may all be stored inside the account that has become inaccessible.

Blurred Personal and Business Systems

Personal email, devices, phone numbers, cloud storage, and payment methods may also serve the business.

Limited Monitoring

An attacker may remain unnoticed because nobody else reviews account activity, invoices, security alerts, or changes to the website.

The objective is not to recreate a corporate security department. It is to remove dangerous single points of failure and make abnormal activity visible.

The Most Important Cybersecurity Priorities

For most solopreneurs, the following order provides a practical starting point.

A backup strategy supports recovery but does not prevent an attacker from reading data, impersonating the business, changing payment details, or accessing customer accounts. Backups should therefore complement cybersecurity controls rather than replace them.

Use a Simple Cybersecurity Framework

The NIST guide adapts the Cybersecurity Framework 2.0 for smaller businesses. Its six functions provide a useful structure.

Cybersecurity is a cycle. New software, contractors, products, payment systems, and customer data continually change the business’s exposure.

Inventory Your Digital Assets

You cannot protect a system you have forgotten exists.

Create an inventory containing:

• Business email accounts
• Domain registrars
• DNS providers
• Hosting accounts
• Content-management systems
• Ecommerce platforms
• Payment processors
• Bank and investment accounts
• Cloud storage
• Password managers
• Accounting systems
• CRM platforms
• Email-marketing services
• Advertising accounts
• Analytics platforms
• Source-code repositories
• Automation services
• AI tools
• Mobile devices
• Computers
• Routers
• External contractors
• API keys
• Software licenses
• Browser extensions
• Recovery email addresses
• Recovery phone numbers

For each asset, record:

Do not include live passwords or secret keys in an ordinary asset register.

Identify Root Accounts

A root account can take over, reset, redirect, or materially disrupt other systems.

Typical root accounts include:

• Primary business email
• Password manager
• Domain registrar
• DNS provider
• Cloud identity administrator
• Apple, Google, or Microsoft device account
• Hosting administrator
• Source-code administrator
• Payment processor
• Business bank
• Mobile carrier
• Backup administrator

Rank accounts by their potential blast radius.

Account risk = likelihood of compromise × business impact × connected-system exposure

A social media account may be visible but replaceable. The email account capable of resetting the social account, registrar, payment service, and cloud storage has a much larger blast radius.

For every root account:

• Use a unique password
• Enable the strongest available authentication
• Review active sessions
• Remove unused recovery methods
• Protect recovery codes
• Configure change alerts
• Use a dedicated administrative identity where available
• Record the official recovery procedure
• Test recovery without weakening security
• Avoid using public-facing contact addresses as administrator usernames

Use Phishing-Resistant Authentication

Multifactor authentication requires more than one type of proof before allowing access.

Common methods include:

CISA states that FIDO/WebAuthn authentication is the widely available phishing-resistant option in its current MFA guidance. This includes compatible passkeys and physical security keys.

Phishing-resistant authentication binds the sign-in to the legitimate website. A fake page cannot simply collect a reusable code and submit it to the real service.

Prioritize phishing-resistant authentication for:

1. Primary email
2. Password manager
3. Domain registrar
4. Financial services
5. Cloud administrator
6. Hosting
7. Code repositories
8. Ecommerce administration
9. Backup administration
10. Mobile-carrier account

Keep at least two approved authentication methods for critical accounts. For example, register a primary security key and a separately stored spare.

Do not treat recovery codes as ordinary notes. Anyone with a valid recovery code may be able to bypass the normal authentication process.

Use a Password Manager

Every important account should have a unique password. Reusing one password allows a breach at an unimportant service to compromise a critical one.

A password manager should:

• Generate long, unique passwords
• Identify reused passwords
• Warn about compromised credentials where supported
• Require strong authentication
• Lock automatically
• Protect exported vaults
• Support secure emergency recovery
• Show recently used or changed items
• Separate personal and business records where practical

The password manager’s master password should be unique and memorable enough to enter without storing it in an exposed note. Do not reuse it anywhere else.

Protect the manager with a passkey, security key, or the strongest available MFA. Store its emergency recovery information separately from the devices and accounts it protects.

A password manager improves security only when the surrounding recovery process is secure. An easily compromised recovery email can undermine a strong vault password.

Secure Account Recovery

Attackers may avoid the normal login and target account recovery instead.

Review:

• Recovery email addresses
• Recovery phone numbers
• Trusted devices
• Security questions
• App passwords
• Recovery contacts
• Backup codes
• Authorized support contacts
• Mobile-carrier PINs
• Active sessions
• Connected applications

Remove former phone numbers, obsolete devices, unused email addresses, and unknown sessions.

A recovery email should be:

• Actively maintained
• Independently secured
• Rarely used publicly
• Protected with MFA
• Monitored for security alerts
• Recoverable without relying exclusively on the primary account

Do not create a circular recovery dependency in which Account A recovers Account B and Account B is the only way to recover Account A.

Separate Administrative and Everyday Access

Administrator privileges allow account creation, access changes, software installation, data deletion, and security-control modification.

Using administrator access for ordinary browsing and email increases the potential effect of one mistake.

Where supported:

• Create a separate administrative account
• Use a standard account for normal work
• Do not publish the administrator email address
• Require stronger authentication for administration
• Disable unnecessary administrator accounts
• Use temporary privilege elevation
• Alert on administrator changes
• Review administrative activity

For WordPress and similar platforms, do not use an administrator account to publish everyday content if an editor role is sufficient.

Each contractor should have an individual account with the minimum required permissions. Shared administrator passwords remove accountability and make offboarding difficult.

Protect Business Email

Business email is both a communication system and a recovery system. Compromise can expose contracts, customer conversations, reset links, invoices, attachments, and payment instructions.

Secure email by:

• Enabling phishing-resistant MFA
• Reviewing forwarding rules
• Reviewing mailbox delegates
• Reviewing active sessions
• Disabling obsolete protocols
• Removing unused app passwords
• Restricting third-party applications
• Enabling suspicious-login alerts
• Separating public contact mailboxes from administration
• Reviewing automatic rules after any suspected compromise
• Using a reputable business email provider

Attackers may create a forwarding rule, hide messages, register a malicious application, or change reply-to settings while leaving the password unchanged.

After suspected email compromise, changing the password alone is insufficient. Revoke sessions, inspect rules, remove unauthorized applications, rotate recovery methods, and check other accounts that use the mailbox for recovery.

Configure SPF, DKIM, and DMARC

Email authentication reduces unauthorized use of a business domain.

SPF

Sender Policy Framework identifies which systems are authorized to send email for the domain.

DKIM

DomainKeys Identified Mail applies a cryptographic signature that recipients can use to verify the sending domain and message integrity.

DMARC

Domain-based Message Authentication, Reporting, and Conformance defines how receiving systems should handle messages that fail authentication and provides reports about domain use.

Current CISA goals recommend SPF, DKIM, and DMARC to reduce spoofing, phishing, and email interception risk.

A practical deployment sequence is:

1. Inventory every legitimate email sender.
2. Configure SPF.
3. Enable DKIM for each sender.
4. publish DMARC initially with reporting.
5. Review legitimate and unauthorized traffic.
6. Correct authentication failures.
7. Progress toward quarantine or rejection.
8. Continue monitoring reports after enforcement.

A strict DMARC policy applied before legitimate senders are identified can block valid newsletters, invoices, support messages, and automated notifications.

These controls reduce direct domain spoofing but do not stop lookalike domains, compromised mailboxes, or messages sent from legitimate third-party accounts.

Prevent Business Email Compromise

Business email compromise uses impersonation or account takeover to redirect money or obtain sensitive information.

Common scenarios include:

• A supplier allegedly changes bank details
• A client requests a refund to a new account
• A fake contractor sends an urgent invoice
• A payment processor requests emergency verification
• An attacker impersonates the owner from a lookalike domain
• A compromised customer account sends a malicious attachment
• A caller claims that an email request must be completed immediately

The FBI recorded approximately $3.05 billion in complaint-reported BEC losses during 2025 in its annual report.

Use a fixed financial-verification rule:

Any new payment recipient or change to payment details must be verified through a previously established channel that is independent of the request.

Verification should use a phone number, account portal, or contact record already known to be genuine. Do not use the number contained in the suspicious message.

Also require independent verification for:

• Refund destination changes
• Large or unusual purchases
• Domain transfers
• Recovery-method changes
• New financial administrators
• Requests for tax documents
• Requests for customer exports
• Urgent gift-card purchases
• Cryptocurrency payments
• Changes to payroll or contractor details

Urgency, confidentiality, authority, or polished language does not establish authenticity.

Recognize Modern Phishing

Phishing may arrive through:

• Email
• SMS
• Messaging applications
• Search advertisements
• QR codes
• Calendar invitations
• Shared documents
• Social media
• Fake support chats
• Voice calls
• Video meetings
• Browser notifications

The 2026 DBIR findings state that mobile-centered social engineering had a 40% higher success rate than traditional email phishing in the report’s dataset.

Check the request rather than relying on grammatical errors or visual quality. AI allows attackers to produce personalized, fluent, and context-aware messages.

Warning signs include:

• Unexpected urgency
• Requests to bypass normal procedure
• A new payment destination
• Authentication codes requested by another person
• Slightly altered domain names
• Unexpected shared files
• Password-protected attachments
• A login page opened from an unsolicited message
• Requests to install remote-access software
• Pressure to keep the request confidential
• An unusual communication channel
• A familiar person using unfamiliar wording
• A support representative asking for a password or recovery code

When uncertain, stop and open the service independently through a saved bookmark or manually entered address.

Secure Computers and Mobile Devices

A business device should have:

• A supported operating system
• Automatic security updates
• Full-disk encryption
• Screen locking
• Strong device authentication
• Firewall protection
• Current malware protection
• Find-and-erase capability where appropriate
• Restricted administrator privileges
• Approved software only
• Secure browser configuration
• Separate user accounts where shared
• A tested replacement procedure

Do not continue using a device or operating system after security support has ended. It may remain functional while no longer receiving fixes for newly discovered vulnerabilities.

Encrypt Devices

Full-disk encryption protects stored information when a locked device is lost or stolen.

Encryption is less useful when:

• The device is unlocked
• The attacker knows the login credential
• Malware operates while the user is signed in
• Recovery keys are exposed
• Sensitive files are copied elsewhere without protection

Store recovery keys outside the protected device.

Lock Devices Automatically

Set computers and phones to lock after a short period of inactivity. Require authentication after restart and after waking from sleep.

Do not leave a business device unattended and unlocked in:

• Shared accommodation
• Coworking spaces
• Cafés
• Airports
• Client offices
• Vehicles
• Repair shops

Control Installed Software

Install software from the official developer or approved marketplace. Before installation, verify:

• Developer identity
• Required permissions
• Update history
• Current support
• Privacy practices
• Business need
• Removal procedure

Avoid pirated software, unofficial activation tools, and unknown “free” utilities. They create both security and licensing risk.

Review Browser Extensions

Browser extensions can read webpages, alter content, capture form entries, and access logged-in sessions depending on their permissions.

Remove extensions that are:

• Unused
• Abandoned
• Duplicative
• Installed for one temporary task
• Requesting excessive permissions
• No longer available from an official source
• Recently transferred to an unknown developer

Use a separate browser profile for sensitive administration when practical. Keep casual browsing, experimental extensions, and personal accounts away from critical business sessions.

Do not store payment data, private keys, or critical recovery information in ordinary browser notes or extensions.

Update Software Promptly

Software updates frequently correct vulnerabilities that attackers can exploit.

The 2026 Verizon data makes patching especially important because vulnerability exploitation accounted for 31% of breaches. Current CISA advice recommends enabling automatic updates where possible.

Prioritize:

1. Internet-facing systems
2. Actively exploited vulnerabilities
3. Operating systems
4. Browsers
5. Email software
6. Remote-access tools
7. Website platforms and plugins
8. Routers and network devices
9. Password managers
10. Financial and customer-data applications

A practical patch policy can define:

These periods are examples. Exposure, exploit availability, system importance, and vendor guidance should determine the actual deadline.

Create a recovery point before high-risk upgrades, but do not delay a critical security fix indefinitely in pursuit of a perfect maintenance window.

Secure the Home or Office Network

A secure device can still be exposed through a poorly maintained network.

For the router:

• Change default administrator credentials
• Install current firmware
• Enable automatic updates where available
• Use WPA3 or WPA2 encryption
• Use a strong Wi-Fi password
• Disable remote administration unless required
• Disable unused services
• Review connected devices
• Remove obsolete port-forwarding rules
• Replace unsupported hardware
• Protect the router’s recovery account
• Keep administrative access unavailable from the public internet

Place untrusted or low-security devices such as smart TVs, cameras, speakers, and guest devices on a separate guest or IoT network when possible.

A hidden network name is not a meaningful security control. Strong encryption, supported hardware, secure administration, and controlled access matter more.

Public Wi-Fi

Do not assume public Wi-Fi is trusted merely because it requires a password.

When using it:

• Confirm the correct network name
• Prefer your mobile hotspot for sensitive work
• Ensure websites use HTTPS
• Disable automatic connection
• Disable file sharing
• Use an appropriate trusted VPN when required by the risk
• Avoid administrative and financial work on unknown networks
• Forget the network afterward

A VPN protects traffic between the device and VPN provider. It does not protect against phishing, compromised devices, malicious downloads, or unsafe accounts.

Secure Websites and Domains

For many solopreneurs, the domain is a core business asset. Losing it can disrupt the website, email, customer trust, and revenue simultaneously.

Domain Security

Protect the registrar account with:

• A unique password
• Phishing-resistant MFA
• Domain or transfer lock
• Change notifications
• Accurate ownership information
• Secure recovery details
• Reliable renewal payment
• Renewal alerts through more than one channel
• Restricted access to authorization codes

Record the registrar, registrant, renewal date, nameservers, and recovery procedure.

Do not share the registrar’s primary administrator account with a developer. Use delegated access where available.

DNS Security

DNS changes can redirect the website, intercept email, alter verification records, or send visitors to malicious services.

Limit who can edit DNS. Enable:

• MFA
• Change alerts
• Audit logs
• Restricted API tokens
• Registry lock where justified and available
• DNSSEC when properly supported and maintained

Keep an independent record of approved DNS entries so unauthorized changes can be identified and corrected.

Website Administration

For a content-management system:

• Use supported core software
• Remove unused plugins and themes
• Update maintained components
• Avoid abandoned extensions
• Use separate named accounts
• Restrict administrator roles
• Protect login with MFA
• Use a web application firewall where appropriate
• Limit login attempts
• Review file changes
• Monitor new administrator accounts
• Disable unused remote-access features
• Protect staging sites
• Remove installation files and test accounts
• Use secure hosting credentials

Deletion is often safer than deactivation. An inactive vulnerable plugin may still leave exploitable code on the server.

Ecommerce and Forms

Protect:

• Checkout settings
• Payment integrations
• Webhooks
• Customer exports
• Form submissions
• Refund permissions
• Discount creation
• Tax settings
• Order notifications
• Administrator roles

Avoid collecting sensitive information that is not required. A simple contact form should not ask customers to submit passwords, payment-card details, identification documents, or confidential health information.

Secure Cloud and SaaS Accounts

Cloud providers protect parts of the underlying infrastructure, but the customer still controls identities, permissions, connected applications, data handling, and many configuration decisions.

For every important SaaS platform:

• Enable strong MFA
• Review administrator accounts
• Review connected applications
• Restrict public sharing
• Remove unused integrations
• Monitor login activity
• Configure security notifications
• Check data-export options
• Review retention settings
• Understand account-closure consequences
• Confirm where data is processed
• Remove former contractors
• Review API tokens
• Check whether the provider supports audit logs

Do not approve an application merely because it offers “Sign in with Google” or another familiar identity service. Review the permissions being requested.

An application that asks to read, modify, and delete email or cloud files may receive continuing access after the initial login.

Apply Least Privilege

Least privilege means giving a person, account, or integration only the access required for its current task.

Examples include:

• An editor can publish content but cannot alter billing
• A bookkeeper can view transactions but cannot manage domains
• A developer can access staging without accessing customer exports
• An automation can add CRM records but cannot delete the entire database
• An analytics tool can read statistics without changing advertising campaigns

For each permission, ask:

1. Is this access required?
2. Does it need to be permanent?
3. Does it need administrator scope?
4. Can it be restricted to one project or dataset?
5. How will it be revoked?
6. Will a log show how it was used?

Review critical permissions quarterly and after every contractor, tool, or project change.

Control API Keys and Secrets

API keys, private keys, access tokens, database credentials, and webhook secrets may provide direct access without an interactive login.

Do not place secrets in:

• Public repositories
• Source code
• Shared spreadsheets
• Screenshots
• Support tickets
• Prompt libraries
• Client deliverables
• Browser bookmarks
• Analytics logs
• Public documentation
• Ordinary email

Use environment configuration, an approved secrets manager, or another access-controlled method.

Where supported:

• Limit permissions
• Restrict source IP addresses
• Restrict domains
• Set expiration dates
• Use separate development and production keys
• Rotate keys
• Monitor usage
• Set cost or volume limits
• Revoke unused credentials

If a secret is exposed, remove it from public content and revoke it. Deleting the visible text does not make the old credential safe because it may already exist in repository history, caches, logs, or copied data.

Minimize the Data You Hold

Data that the business does not collect cannot be stolen from it.

For each category of information, ask:

• Why is it collected?
• Is it necessary?
• Where is it stored?
• Who can access it?
• How long is it required?
• Can a less sensitive substitute be used?
• What happens when the purpose ends?

Avoid retaining:

• Unnecessary identity documents
• Complete payment-card information
• Obsolete customer exports
• Old applicant data
• Duplicate financial files
• Historic administrator lists
• Unused mailing lists
• Confidential client data after the engagement ends
• Production databases in development environments

Data minimization reduces security exposure, privacy obligations, storage cost, and incident scope.

Encrypt Sensitive Information

Encryption can protect data:

• On devices
• In storage
• During transfer
• In databases
• In archives
• In communications

Encryption does not solve every security problem. An authorized session, compromised administrator, malicious application, or exposed decryption key may still reveal the data.

Protect encryption keys separately from the information they unlock. Document how legitimate recovery will work if the owner is unavailable or the main device fails.

Do not invent custom encryption methods. Use established, maintained tools and protocols.

Protect Financial Accounts

Financial accounts deserve separate treatment because a successful compromise can create immediate and irreversible loss.

Use:

• Dedicated credentials
• Strong MFA
• Transaction alerts
• Withdrawal notifications
• Beneficiary-change alerts
• Appropriate transaction limits
• Separate operating and reserve accounts
• Limited account permissions
• Bank-approved fraud controls
• Regular reconciliation
• Known contact details for urgent fraud reporting

Do not access a bank or payment processor through links in unsolicited messages. Open the official application or enter the known address directly.

Review merchant accounts for:

• New users
• New API keys
• Changed payout destinations
• Changed refund permissions
• Unexpected test transactions
• New webhooks
• Unrecognized connected stores
• Altered notification addresses

If money was fraudulently transferred, contact the relevant financial institution immediately. Recovery opportunities can decrease rapidly with time.

Secure Contractors and External Collaborators

A contractor may need legitimate access to content, code, customer information, analytics, or financial records. That access should be designed rather than improvised.

Before granting access:

• Confirm identity
• Define the task
• Select the minimum role
• Set an end date
• Require MFA
• Define permitted devices
• Define permitted data use
• Prohibit credential sharing
• Record confidentiality obligations
• Explain incident-reporting expectations

During the engagement:

• Use individual accounts
• Monitor administrator changes
• Restrict exports
• Review unusual access
• Avoid sharing recovery codes
• Separate production from development
• Reassess permissions when the task changes

At the end:

• Disable the account
• Revoke sessions
• Revoke tokens
• Rotate shared secrets
• Transfer ownership
• Remove mailbox and file access
• Confirm return or deletion of business data
• Review changes made during the engagement

Do not postpone offboarding because the contractor may work with the business again later. Access can be granted again when required.

Assess Vendor Cybersecurity

A solopreneur cannot directly secure every provider, but vendor choices determine much of the business’s exposure.

The 2026 Verizon findings reported third-party involvement in 48% of breaches, a 60% increase from the previous dataset.

Before adopting an important service, examine:

• MFA and passkey support
• Role-based access
• Audit logs
• Security notifications
• Encryption
• Data location
• Export capability
• Deletion controls
• Incident-notification terms
• Subprocessors
• Support lifecycle
• Vulnerability disclosure
• Independent security assessments
• Service history
• Account-recovery process
• Contract termination
• Data portability

Match the assessment to the service’s importance. A simple image-compression tool does not require the same review as a provider holding customer identities, accounting data, passwords, or production code.

Prefer products that are secure by default. The customer should not need an enterprise subscription or extensive technical work to obtain essential protections such as MFA, logging, secure recovery, and automatic updates.

Manage AI Cybersecurity Risks

AI creates both security benefits and new exposure.

Information Entered Into AI Tools

Before submitting content, determine whether it contains:

• Personal data
• Client information
• Contracts
• Authentication secrets
• Unpublished financial information
• Proprietary research
• Licensed material
• Confidential strategy
• Source code
• Security configurations

Review the provider’s retention, training, access, sharing, deletion, and enterprise-control settings.

Remove unnecessary identifying information before submission. Never paste passwords, recovery codes, private keys, or live API credentials into a prompt.

AI-Generated Code

AI-generated code may contain:

• Vulnerabilities
• Invented packages
• Unsafe defaults
• Exposed secrets
• Missing access controls
• Insecure data handling
• Outdated dependencies
• Inadequate error handling

Review, test, and scan generated code before deployment. Verify every dependency through its official source.

AI-Enabled Impersonation

Voice, video, and text can no longer be treated as sufficient proof of identity.

The FBI’s 2025 crime data recorded 22,364 complaints containing AI-related information and $893.3 million in associated reported losses. More than $30 million involved BEC complaints with a reported AI connection.

Verify high-risk requests using process, not appearance:

• Use a known contact channel
• Confirm the transaction details
• Require a second form of evidence
• Do not rely solely on voice recognition
• Pause when the request bypasses normal procedure
• Use an agreed verification phrase where appropriate

AI Agents and Connected Tools

An AI system connected to email, files, calendars, code, payments, or publishing tools may perform actions beyond ordinary text generation.

Limit:

• Data sources
• Tool permissions
• Transaction amounts
• External recipients
• Publication rights
• Deletion rights
• Administrative access
• Autonomous execution

Require human approval for irreversible, financial, public, legal, or customer-facing actions.

Treat instructions inside external webpages, documents, emails, and retrieved content as untrusted data. They may attempt to manipulate an AI system into disclosing information or performing unintended actions.

Monitor for Suspicious Activity

Prevention will never be perfect. Detection limits the time an attacker can operate.

Enable alerts for:

• New logins
• Failed login bursts
• Password changes
• MFA changes
• New recovery methods
• New administrators
• New API keys
• New connected applications
• Email-forwarding rules
• Domain changes
• DNS changes
• Payout changes
• Large transactions
• Mass downloads
• Mass deletion
• Unusual website-file changes
• New scheduled tasks
• Security-control changes
• Data exports
• Subscription or billing failures

Send the most critical alerts through an independent channel.

Review alerts at a frequency matched to the risk. A payout-destination change requires immediate attention; an unused-software review can be monthly or quarterly.

Measure Cybersecurity Without Creating Busywork

Useful measurements include:

• Percentage of root accounts using phishing-resistant MFA
• Percentage of systems receiving automatic security updates
• Number of unsupported applications
• Number of active administrator accounts
• Number of former collaborators with access
• Number of unresolved critical vulnerabilities
• Age of the last access review
• Number of unreviewed third-party integrations
• Time required to disable a compromised account
• Time from suspicious activity to detection
• Percentage of important services with security alerts enabled
• Percentage of domain senders passing SPF, DKIM, and DMARC
• Number of secrets without an owner or expiration date

Example calculations:

Strong MFA coverage = protected root accounts ÷ total root accounts × 100

Patch compliance = systems updated within policy ÷ systems requiring updates × 100

Access-review completion = accounts reviewed ÷ total privileged accounts × 100

Do not measure security by the number of tools purchased. Measure whether important risks are controlled and whether failures become visible.

Prepare a Cybersecurity Incident Response Plan

An incident response plan explains what to do when security may have failed.

It should identify:

• Incident contact
• Technical support contact
• Hosting contact
• Registrar contact
• Financial fraud contact
• Insurance contact
• Legal or privacy contact
• Critical account-recovery methods
• Evidence-preservation procedure
• Communication channel
• Decision authority
• Notification obligations
• Recovery priorities

Store an independent copy outside the systems most likely to be affected.

Recognize a Cybersecurity Incident

Possible signs include:

• An unexpected login alert
• A password-reset message you did not request
• A changed payout account
• Missing or altered files
• Unknown mailbox rules
• Messages sent without your knowledge
• New administrator accounts
• Unexplained advertisements or purchases
• Disabled security controls
• Website redirects
• Unusual processor charges
• Unknown API usage
• Unexpected mobile-service loss
• Customers reporting strange messages
• Antivirus or browser warnings
• Large downloads
• Locked or encrypted files

One sign does not always confirm compromise, but it should trigger verification.

Respond to an Incident

Step 1: Stop and Assess

Identify what happened, when it began, which accounts are affected, and whether the attacker may still have access.

Do not use a suspected compromised device to change every credential if a clean device is available.

Step 2: Contain the Incident

Depending on the situation:

• Disconnect an infected device
• Disable a compromised account
• Revoke active sessions
• Revoke API tokens
• Suspend integrations
• Block malicious forwarding
• Disable affected website functionality
• Contact the financial institution
• Isolate affected systems
• Preserve relevant logs

Containment should prevent additional damage without destroying evidence unnecessarily.

Step 3: Preserve Evidence

Record:

• Discovery time
• Screenshots
• Alerts
• Login locations
• Message headers
• Account changes
• File changes
• Transaction identifiers
• Relevant logs
• Contact with providers
• Actions taken
• Exact times

Do not publicly accuse a person or provider without reliable evidence.

Step 4: Remove Unauthorized Access

• Reset compromised credentials
• Revoke sessions
• Remove unknown recovery methods
• Remove malicious applications
• Delete unauthorized users
• Rotate exposed secrets
• Correct altered configurations
• Patch the exploited vulnerability
• Inspect related accounts

Resetting one password does not remove stolen sessions, malicious tokens, forwarding rules, or added administrators.

Step 5: Determine the Scope

Identify:

• Information accessed
• Information altered
• Information deleted
• People affected
• Systems connected
• Money transferred
• Customer commitments affected
• Duration of access
• Evidence of persistence
• Legal or contractual obligations

Step 6: Restore Trustworthy Operations

Restore only from a known clean state. Validate security before reconnecting systems or resuming customer activity.

The detailed backup and restoration process belongs in the separate data-backup plan, but incident response must define who approves recovery and how the clean recovery point is selected.

Step 7: Notify Relevant Parties

Possible parties include:

• Customers
• Clients
• Financial institutions
• Payment processors
• Insurers
• Service providers
• Law enforcement
• Data-protection authorities
• Contractual partners

Notification depends on the data, jurisdiction, contract, risk, and incident type. Obtain qualified legal advice when necessary.

Step 8: Review the Cause

After stabilization, document:

• Initial entry point
• Controls that failed
• Detection delay
• Response delay
• Information affected
• Financial impact
• Corrective actions
• Responsible owner
• Completion deadline
• Retest date

The objective is to prevent recurrence, not merely return systems to their previous vulnerable state.

Handle Personal Data Breaches

A security incident becomes a personal data breach when it causes accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

Not every cybersecurity incident is a personal data breach, and not every personal data breach involves an external attacker. Sending customer data to the wrong recipient may qualify even without hacking.

Where the GDPR applies, the organization must document the incident. If notification to the competent supervisory authority is required, it must generally occur without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The EDPB guide explains that notification depends on the risk to affected individuals.

A breach record should include:

• What happened
• Discovery time
• Awareness time
• Data affected
• People affected
• Likely consequences
• Containment
• Risk assessment
• Notification decision
• Communication
• Corrective measures

Do not wait for every technical fact before beginning the legal assessment.

Consider Cyber Insurance

Cyber insurance may provide access to:

• Incident-response specialists
• Forensic investigation
• Legal advice
• Notification services
• Credit monitoring
• Business interruption coverage
• Cyber extortion support
• Data-restoration assistance
• Liability defense
• Fraud coverage

Policy terms vary significantly. Review:

• Covered incidents
• Social-engineering coverage
• Funds-transfer fraud
• Ransomware restrictions
• Business interruption waiting periods
• Retroactive dates
• Sub-limits
• Exclusions
• Required security controls
• Notification deadlines
• Approved service providers
• Territorial scope
• Third-party incidents

Insurance does not replace security controls. Incorrect statements about MFA, backups, access, or patching can also create coverage disputes.

Create a Solopreneur Cybersecurity Policy

A concise policy can include the following sections.

Business Details

• Business name:
• Policy owner:
• Effective date:
• Last review:
• Next review:

Critical Assets

• Primary email:
• Password manager:
• Domain registrar:
• Hosting:
• Financial accounts:
• Cloud administrator:
• Customer-data systems:

Authentication Standard

• Password-manager requirement:
• Minimum MFA method:
• Root-account authentication:
• Recovery-code location:
• Spare security-key location:
• Access-review frequency:

Device Standard

• Supported operating systems:
• Automatic updates:
• Disk encryption:
• Screen-lock period:
• Malware protection:
• Administrator restrictions:
• Lost-device procedure:

Software Standard

• Approved sources:
• Patch deadlines:
• Unsupported-software procedure:
• Extension review:
• Plugin review:
• Secret-management method:

Financial Verification

• New-recipient verification:
• Payment-change verification:
• Refund verification:
• Transaction-alert threshold:
• Fraud contact:

Contractor Access

• Approval:
• Minimum role:
• MFA:
• End date:
• Offboarding:
• Data-deletion confirmation:

Monitoring

• Login alerts:
• Administrator alerts:
• Domain alerts:
• Financial alerts:
• Website monitoring:
• Review frequency:

Incident Response

• Incident contact:
• Clean recovery device:
• Technical support:
• Financial institution:
• Insurance:
• Legal or privacy contact:
• Evidence location:
• Communication method:

A Practical Cybersecurity Baseline

A solopreneur with limited time should complete this baseline first.

First Hour

1. Protect the primary email with phishing-resistant MFA.
2. Protect the password manager.
3. Protect the domain registrar.
4. Protect banking and payment accounts.
5. Save recovery codes securely.
6. Review logged-in sessions.
7. Remove unknown recovery methods.
8. Enable transaction and account-change alerts.

First Day

1. Update computers and mobile devices.
2. Enable disk encryption.
3. Review website administrators.
4. Update the website platform and maintained extensions.
5. Remove unused plugins and browser extensions.
6. Review email forwarding and connected applications.
7. Change router administrator credentials.
8. Review financial payout destinations.
9. Remove former contractor access.
10. Record critical provider contacts.

First Week

1. Complete the digital-asset inventory.
2. Separate everyday and administrator access.
3. Configure SPF, DKIM, and DMARC.
4. Review every critical SaaS administrator.
5. Restrict API keys.
6. document financial-verification rules.
7. Create the incident-response contact sheet.
8. Review vendor security for critical providers.
9. Test account recovery.
10. Schedule quarterly access reviews.

Cybersecurity Checklist for Solopreneurs

1. Inventory all business accounts.
2. Inventory all business devices.
3. Identify root accounts.
4. Identify systems holding customer data.
5. Identify financial accounts and payment processors.
6. Identify all administrators.
7. Identify connected applications.
8. Identify active API keys.
9. Identify unsupported software.
10. Remove unused accounts.
11. Remove unused applications.
12. Remove unused browser extensions.
13. Remove unused website plugins.
14. Use unique passwords.
15. Use a password manager.
16. Protect the password manager with strong MFA.
17. Enable phishing-resistant MFA on root accounts.
18. Register a spare authentication method.
19. Protect recovery codes.
20. Review recovery email addresses.
21. Review recovery phone numbers.
22. Review active sessions.
23. Remove unknown trusted devices.
24. Review mailbox forwarding rules.
25. Review mailbox delegates.
26. Review third-party email access.
27. Configure SPF.
28. Configure DKIM.
29. Configure DMARC.
30. Define independent payment verification.
31. Enable transaction alerts.
32. Enable payout-change alerts.
33. Set appropriate financial limits.
34. Keep operating and reserve funds appropriately separated.
35. Enable automatic operating-system updates.
36. Enable automatic browser updates.
37. Update network devices.
38. Replace unsupported hardware.
39. Enable full-disk encryption.
40. Configure automatic screen locking.
41. Restrict everyday administrator use.
42. Install software only from approved sources.
43. Secure the router administrator account.
44. Use WPA3 or WPA2.
45. Separate untrusted devices where possible.
46. Protect the domain registrar.
47. Enable domain transfer lock.
48. Enable domain-change alerts.
49. Restrict DNS access.
50. Protect hosting administration.
51. Use individual website accounts.
52. Restrict website administrator roles.
53. Monitor new website administrators.
54. Protect staging environments.
55. Remove abandoned software.
56. Review SaaS administrators.
57. Review public file sharing.
58. Review application integrations.
59. Restrict data exports.
60. Limit contractor access.
61. Set contractor access end dates.
62. Revoke access after every engagement.
63. Rotate shared secrets after offboarding.
64. Store API secrets securely.
65. Remove secrets from source code.
66. Limit API permissions.
67. Rotate exposed credentials.
68. Minimize collected personal data.
69. Define data-retention periods.
70. Encrypt sensitive information.
71. Review AI-tool data settings.
72. Prohibit secrets in AI prompts.
73. Review AI-generated code.
74. Restrict AI-agent permissions.
75. Require approval for irreversible AI actions.
76. Enable suspicious-login alerts.
77. Enable administrator-change alerts.
78. Enable security-control alerts.
79. Monitor unusual exports and downloads.
80. Document the incident-response process.
81. Record provider emergency contacts.
82. Record financial fraud contacts.
83. Preserve an independent response copy.
84. Define evidence-preservation steps.
85. Define personal-data breach assessment.
86. Review contractual notification duties.
87. Conduct an account-compromise exercise.
88. Conduct a payment-fraud exercise.
89. Record weaknesses found.
90. Correct and retest failed controls.
91. Review access quarterly.
92. Review root accounts after every system change.
93. Review cybersecurity after every incident.
94. Set the next policy-review date.

Frequently Asked Questions

What is cybersecurity for a solopreneur?

Cybersecurity for a solopreneur is the protection of business accounts, devices, websites, money, customer data, communications, intellectual property, and operating access from unauthorized use, fraud, theft, manipulation, and disruption.

What is the biggest cybersecurity risk for a solopreneur?

The largest structural risk is usually account concentration. One primary email or administrator account may control many other systems, allowing a single compromise to spread across the business.

Which accounts should be secured first?

Start with the primary email, password manager, domain registrar, financial accounts, cloud administrator, hosting account, device accounts, payment processor, and mobile-carrier account.

What is the most effective cybersecurity control?

There is no single control, but phishing-resistant authentication on root accounts has unusually high value because it reduces account takeover across multiple connected systems. Prompt updates, unique passwords, and independent transaction verification should accompany it.

Is a strong password enough?

No. A strong password can still be phished, exposed by malware, stolen from a service, or bypassed through account recovery. Use a unique password together with strong MFA and secure recovery.

What is phishing-resistant MFA?

Phishing-resistant MFA uses cryptographic authentication tied to the legitimate service. Compatible passkeys and FIDO security keys prevent a fake login page from collecting a reusable authentication code.

Are SMS codes safe?

SMS verification is generally better than using only a password, but it is vulnerable to phishing, SIM swapping, interception, and mobile-account compromise. Use passkeys or security keys for critical accounts when available.

Should a solopreneur use a password manager?

Yes. A password manager makes it practical to use a different strong password for every account. The manager itself should use a unique master password, strong MFA, and a secure recovery process.

Should business and personal accounts be separate?

Separate accounts are advisable when practical, especially for email, cloud storage, financial services, software administration, and customer data. Separation reduces accidental sharing and limits the effect of a personal-account compromise.

How often should security access be reviewed?

Review root and administrator access at least quarterly and after every contractor departure, system migration, security incident, or material operating change.

How quickly should security updates be installed?

Internet-facing and actively exploited vulnerabilities should receive the highest priority, potentially on the same day. Other updates should follow a defined schedule based on severity, exposure, and business impact.

Does antivirus provide enough protection?

No. Antivirus can detect some malicious activity, but it does not prevent phishing, account recovery abuse, payment fraud, insecure permissions, vulnerable websites, or exposed API keys.

Does a VPN make public Wi-Fi safe?

A VPN protects traffic between the device and the VPN provider. It does not protect against phishing, malicious files, compromised devices, unsafe browser extensions, or fraudulent websites.

How can a solopreneur prevent payment fraud?

Verify every new payment recipient and every change to payment details through a previously established, independent channel. Enable transaction alerts and contact the financial institution immediately when fraud is suspected.

What is business email compromise?

Business email compromise is fraud that uses a compromised or impersonated communication account to redirect payments, steal information, or persuade someone to perform an unauthorized action.

What should SPF, DKIM, and DMARC do?

SPF identifies authorized senders, DKIM adds a verifiable domain signature, and DMARC defines how failed messages should be handled while providing reports. Together they reduce direct domain spoofing.

Can AI-generated messages be trusted?

A polished message, realistic voice, or convincing video does not prove identity. Verify sensitive requests through a known channel and follow established approval procedures.

Is it safe to paste client information into an AI tool?

Only when the information is necessary, permitted, appropriately minimized, and handled under acceptable provider terms and settings. Do not submit passwords, API keys, private financial data, or confidential client material without explicit authorization and suitable controls.

How should API keys be protected?

Keep API keys outside public code and ordinary documents. Limit their permissions, separate development and production credentials, monitor use, rotate them, and revoke any credential that may have been exposed.

Are website hosting security tools enough?

No. Hosting security cannot compensate for weak administrator access, abandoned plugins, vulnerable custom code, exposed credentials, unsafe DNS access, or compromised third-party integrations.

Does a solopreneur need cybersecurity insurance?

It depends on the business’s data, revenue dependence, contractual exposure, and ability to absorb an incident. Insurance can support response and recovery, but coverage varies and does not replace basic security controls.

What should happen first after account compromise?

Use a clean device, contain the affected account, revoke sessions, remove unauthorized recovery methods and applications, rotate exposed credentials, preserve evidence, and inspect connected accounts.

Is changing the password enough after compromise?

No. An attacker may retain active sessions, API tokens, forwarding rules, trusted devices, recovery methods, or additional administrator accounts. All persistence methods must be reviewed.

When must a personal data breach be reported?

The requirement depends on the applicable law and the risk to affected people. Under the GDPR, a reportable breach generally must be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness.

How much should a solopreneur spend on cybersecurity?

There is no universal amount. Prioritize controls by the likely financial and operational impact of compromise. Strong authentication, supported software, secure devices, access reviews, transaction verification, and incident preparation often provide more value than numerous overlapping security products.

How often should a cybersecurity plan be reviewed?

Review it at least annually and after new software, new contractors, major website changes, new payment systems, security incidents, or changes in the type of data the business holds. Root-account and administrator access should be reviewed more frequently.