A hálózat csapdájában

A kiberbiztonságról, mikro- és kisvállalkozásoknak

5 cybersecurity myths Hungarian small business owners still believe

You don’t need to be a hacker, an IT specialist, or even particularly “techy” to run a small business safely online. But a handful of persistent myths keep Hungarian small business owners exposed — not because they’re careless, but because these beliefs sound reasonable on the surface. Here are five of the most common ones, and what’s actually true.

Myth 1: “My business is too small to be a target”

This is probably the most common misconception among small business owners in Hungary, and it’s an easy one to fall into — why would a criminal bother with a small shop, workshop, or local service business when there are billion-forint companies out there?

In reality, it’s often the opposite. Criminals run automated, large-scale campaigns that don’t care how big you are — they care how easy you are to get into. Small businesses are frequently attractive precisely because they tend to have fewer defenses, no dedicated security staff, and less time spent thinking about the problem than a large company would. Being small doesn’t make you invisible; it can make you an easier target.

Myth 2: “If our computers and network are protected, our data is protected too”

Hungarian survey data suggests this belief is widespread: a Magyar Telekom/BellResearch survey of Hungarian micro, small, and medium-sized businesses found that roughly two-thirds of respondents think about security mainly in terms of protecting IT equipment and infrastructure. The same survey found that around 90% of respondents assumed protecting their IT equipment would automatically protect their data — while only about 42% actually had a solution in place specifically aimed at protecting corporate and customer data.

Equipment protection (antivirus, firewalls, updated devices) and data protection (backups, access controls, encryption, careful handling of customer information) are related, but they are not the same thing. A locked front door doesn’t protect the safe inside if the safe itself has no lock.

Myth 3: “We’re already doing enough”

That same survey found that around three-quarters of Hungarian micro and small businesses believe their existing protection is sufficient — including many businesses that were, by the survey’s own findings, more aware of the risks than average. Confidence and actual preparedness don’t always move together. Only around 10% of micro and small enterprises in the survey had reported experiencing a data loss incident, which is a much lower reported rate than at medium and large companies — a gap that may reflect genuinely fewer incidents, but could also reflect incidents that go unnoticed or unreported, since small businesses often lack the tools to detect them in the first place.

“Sufficient” protection isn’t a one-time achievement. It’s worth periodically asking: when did we last check what we actually have in place, versus what we assume we have?

Myth 4: “Proper cybersecurity is complicated and expensive — you need your own IT security expert”

A regional (Central & Eastern European, including Hungary) survey commissioned by Microsoft found that more than a third of surveyed company representatives believed that setting up proper security is a complicated project, and a similar share believed it requires in-house security expertise that a small business wouldn’t have.

Neither has to be true for a small business today. Many cloud-based tools and services used by small businesses (email providers, accounting software, point-of-sale systems, cloud storage) come with built-in security features — encryption, access controls, automatic updates — that used to require a specialist to set up. You don’t need to build a security department. You do need someone in the business (often the owner) to actually turn on and use the protections that are already available, and to know which basic habits matter: strong, unique passwords, multi-factor authentication where offered, regular backups, and caution around emails and links.

Myth 5: “We’re aware enough of the risks”

This one is less about businesses specifically and more about the broader environment small business owners operate in. A Mastercard-backed report on cybercrime in Hungary found that Hungarians report being less informed about cybercrime risks than the EU average — with a notably higher share saying they are “not at all” or “not very well” informed compared to the EU-wide figures. A separate, more recent Mastercard-linked survey found that cybersecurity knowledge among Hungary’s most digitally active age group scored low on a simple awareness scale, even though a majority of respondents correctly knew that banks will never ask for card details or login credentials by phone or email.

That last point matters: knowing the “textbook” rule and actually catching a well-crafted scam in the moment are two different skills. Most successful attacks on small businesses don’t rely on sophisticated hacking — they rely on a convincingly written email, a fake invoice, or a phone call that creates urgency. Awareness has to be practiced, not just known.

What this means for your business

None of this requires turning your small business into a fortress overnight. A few starting points that address the myths above directly:

  • Assume you’re a target, even a small or “boring” one, and treat basic protections as part of running the business — not an optional extra.
  • Separate the question of equipment security from data security. Ask specifically: where is our customer and financial data, who can access it, and is it backed up?
  • Periodically re-check what’s actually in place, rather than assuming last year’s setup still covers you.
  • Use the built-in security features of the tools you already pay for before assuming you need to hire outside expertise.
  • Practice recognizing scams, especially phishing emails and fake invoices, with your staff — not just knowing the rules in theory.

Cybersecurity for a small business isn’t about eliminating risk entirely. It’s about not being the easiest target in the room.

Sources

Vélemény, hozzászólás?