7 Technology Risks Hidden Inside a 20-Person Business

Smaller companies rarely need enterprise complexity, but they do need clear ownership and a few dependable controls. These are the gaps I find most often.

1. No tested recovery: a backup exists, but nobody has restored from it.
2. Shared administrator accounts: nobody can prove who changed what.
3. Incomplete offboarding: former staff retain access to email, files or cloud tools.
4. Unmanaged Microsoft 365: security defaults, MFA and recovery methods are inconsistent.
5. One-person knowledge: critical credentials and configurations exist only in someone’s memory.
6. Consumer-grade network design: business, guest and device traffic share the same trust boundary.
7. No incident plan: staff do not know who to call or what to disconnect during an attack.

A practical first step

Create a one-page inventory: systems, owners, administrators, backups and recovery contacts. Then test one important restore and one employee offboarding. These two exercises reveal more than a long policy document.

Remote assessment

Most of this review can be completed securely and remotely. The objective is a prioritized plan in plain language—not a catalogue of products.