Cybersecurity conversations tend to fixate on storage and firewalls — but according to veteran expert Neal O’Farrell, the real danger lies elsewhere. Most breaches still begin with email. One click on a fake invoice, one reply to a spoofed supplier, or one forwarded attachment to the wrong person can open the door to attackers.
And with AI now making phishing more convincing and impersonation easier than ever, the stakes for SMEs have never been higher.
The Problem With “Normal”
Most SMEs still share sensitive information in familiar ways — email, cloud links, messaging apps, and shared folders. It feels normal because it is normal. But normal is doing a lot of dangerous work here. Payroll files get emailed around. Legal drafts sit in inboxes. Commercial negotiations play out in WhatsApp threads. None of it feels dramatic — until it is.
Encryption Isn’t the Whole Answer
Many businesses hear “encrypted” and assume the problem is solved. It isn’t. The real question is who controls the keys. If the service provider controls the encryption keys, they still sit inside the trust model — meaning access could be compelled through legal or regulatory pressure. Encryption at rest is a baseline, not a finish line.
Consumer Apps Are Not Governance Tools
Consumer messaging apps were not designed to manage high-risk business collaboration or formal control over sensitive company information. When staff leave, can you cleanly revoke access? Can you prove what was shared and with whom? In most cases, not properly.
What SMEs Should Do Now
O’Farrell’s advice is simple: start with a plan, not a product. Identify your most sensitive information, map where it is actually being shared today, and decide which conversations need a more controlled method. Train people with real-world examples, review who holds access, and make sure that access can be removed quickly when roles change.
Most SMEs do not need a 200-page cyber manual — they need a sensible structure and a few clear decisions. The starting point is simply asking: where are our most sensitive conversations happening right now?
The Bottom Line
Encryption at rest is a good baseline, but it is not the finish line. The real question is who controls the keys. Consumer apps offer no audit trails. Email was never designed for high-risk collaboration.
The fix is not complicated. Map where your sensitive information is actually being shared, decide which conversations need better controls, and make sure access can be removed the moment roles change.
Convenience got you here. Control will keep you safe.
Read the original article here