I want to tell you about a call I got last year from a textile exporter in Bhiwandi. His email account had been compromised. Someone had been sitting inside it for three weeks — reading his quotes, watching his supplier negotiations, probably sharing that data with a competitor. By the time he noticed, he'd lost a contract worth about ₹40 lakhs. Not because he got unlucky. Because his email password was the name of his business followed by "123".

I'm not writing this to make him look bad. I'm writing this because I've had almost exactly the same conversation — different names, different industries, similar outcome — probably 80 times in the past decade. A manufacturer in Thane. A logistics company in Andheri. A clinic in Pune. A CA firm in Borivali. The details change. The root cause is always something embarrassingly avoidable.

The Real Problem Isn't Technical

Here's what I've figured out: Indian SMBs don't get hacked because they lack sophisticated security tools. They get hacked because cybersecurity has never been framed as a business problem. It's always been framed as an IT problem — something you hand off to the "computer guy" who set up your router.

That framing is catastrophically wrong, and no one's been honest enough to say it loudly.

When a business owner asks me "what security software should I buy?", I tell them that's the wrong question. The right question is: "which employee clicked a phishing link last month, and what would have happened if it worked?" That's a people and process question. The software comes after you've answered it.

What I Actually See in Audits

When we do security assessments for Indian businesses — even ones that consider themselves careful — we find the same things almost every time:

Shared passwords across the whole team. One account, five people using it, nobody knows when it was last changed. When that password leaks (and eventually it leaks), there's no way to know who had access to what or when.

WhatsApp as a document transfer system. Business proposals, client contracts, financial data — all bouncing through WhatsApp because it's convenient. WhatsApp is fine for many things. It is not a document management system for sensitive business information.

No one knows who has access to what. I ask: "Who has admin access to your accounting software?" Silence. "Who can access your customer database?" More silence. In a properly run business, this should take about 30 seconds to answer. The fact that nobody knows is itself the vulnerability.

The website nobody's touched in three years. An e-commerce site running WordPress with plugins last updated in 2021. Every one of those outdated plugins is a potential entry point. Hackers scan for this automatically — they don't need to target you specifically.

Why "We're a Small Business, Nobody Will Target Us" Is Wrong

This is the one I hear most often, and it's the most dangerous misconception in Indian business cybersecurity today.

Modern cyberattacks are not targeted the way people imagine. Most of them are automated. A script somewhere is continuously scanning millions of IP addresses looking for outdated software, weak passwords, and misconfigured systems. It doesn't know or care that you're a small textile exporter in Bhiwandi. It found an open door, it walked in.

The businesses I see get hurt are almost never the ones that were deliberately targeted. They're the ones that were simply the easiest target in a sweep of thousands.

What Actually Helps

I'm not going to give you a 50-point checklist. In my experience, three things make more difference than everything else combined:

Turn on multi-factor authentication on every email account. Every. Single. One. This one change would have saved the Bhiwandi exporter his ₹40 lakhs. It takes about 10 minutes to set up and it's free.

Know who has access to what, and remove access when someone leaves. Former employees with active credentials is one of the most common causes of data breaches in small businesses. Not malicious — just forgotten.

Keep your website software updated. If you're on WordPress, update your plugins every month. If you don't know how, pay someone ₹2,000 a month to do it. That's cheaper than recovering from a breach by a factor of a hundred.

None of these are technically sophisticated. That's the point. The gap in Indian SMB security isn't at the sophisticated end. It's at the basics that nobody ever told you mattered.

— Shreyas
I've been building software and doing security work out of Mumbai since 2008. If anything here resonated, reach out — happy to have a direct conversation about your specific situation.