A cybersecurity checklist for mid-size companies in 2026: the twelve controls that stop most incidents
Mid-size companies are now the preferred target: valuable enough to pay, small enough to lack a security team. The good news is that most incidents still exploit the same gaps. Closing them does not need a large budget. It needs a list, an owner and a quarter.
01Identity and access
- Multi-factor authentication on every email, cloud and VPN account, with no exceptions for executives.
- Single sign-on with a central directory so leavers lose access the same day.
- Admin rights only for people who administer, and only when they do.
- Password manager for the company, and no shared passwords in chat or spreadsheets.
02Devices and updates
- Automatic updates on laptops, phones and servers, with a monthly check that they happened.
- Disk encryption and remote wipe on every laptop and phone that holds company data.
- Endpoint detection and response (EDR) on every device, monitored by someone who reacts.
03Backups and recovery
- Backups that are versioned, stored off-site or in a separate cloud account, and tested by restoring them every quarter.
- A written recovery plan: who calls whom, what is restored first, how customers are informed.
Ransomware succeeds when the backups are reachable from the same account that was compromised.
04Email and people
- Phishing-resistant settings: SPF, DKIM and DMARC on your domain, and attachment sandboxing.
- Short, regular training with simulated phishing, and a no-blame way to report a click.
- A payment-change procedure that requires a phone call to a known number before any bank detail is updated.
05Suppliers and software
- A list of every supplier with access to your data or systems, and what they may access.
- Security questions in every software purchase and every development contract: where is data stored, who can see it, how is the code reviewed.
- For custom software: dependency scanning, secrets kept out of the code, and a pipeline that blocks known vulnerabilities.
06Where AI changes the picture
Attackers use AI to write convincing phishing in any language and to clone voices for payment fraud. The defences are the same controls with more rigour: MFA, call-back procedures and training that shows real examples. On the defence side, AI-assisted monitoring makes EDR and log review affordable for companies without a security operations centre.
07A quarter plan
- Month one: MFA, SSO, password manager, backup separation. These stop the majority of incidents.
- Month two: EDR, updates, email authentication, phishing training.
- Month three: supplier list, recovery plan, a restore test, and a review with management.
08How Synova helps
Our IT Advisory team runs a security audit against this list, prioritises by risk, and our teams implement the controls or harden the software we build for you. Compliance with GDPR, Singapore’s PDPA and Vietnam’s PDPL is reviewed in the same engagement.
Frequently asked questions
Where should a mid-size company start with cybersecurity?
Multi-factor authentication on every account and backups that are stored separately and tested. These two controls defeat the majority of ransomware and account takeover attempts.
Do we need a security team?
Not necessarily. Managed detection services and an advisor who runs an annual audit cover most mid-size companies. What you need is an owner who follows the checklist.
How does AI affect cybersecurity for SMEs?
Attackers use AI for convincing phishing and voice fraud, so call-back procedures and training matter more. Defenders use AI-assisted monitoring to make detection affordable.
