Account Security for Small Teams: Password Managers, 2FA and the Basics That Matter

Five controls remove most of the realistic risk to a small business: a password manager, two-factor authentication on your critical accounts, no shared logins, removing access when people leave, and keeping software updated. None of them requires an IT department, and together they address the overwhelming majority of how small businesses actually get compromised — which is rarely anything sophisticated.

The mental model worth correcting first: small businesses are not usually targeted by someone who chose them. They are caught by automated attacks that try credentials leaked from unrelated breaches against every service on the internet. If your email password was reused on a forum that was breached in 2019, that is the attack, and it costs the attacker nothing. This changes what defence looks like — it is about not being in the pool of easy wins.

How do small businesses actually get compromised?

Notice that nothing on that list involves anyone breaking encryption or writing custom malware. These are all failures of administration, which is encouraging: administration is something a small business can fix in a week without buying anything expensive.

Why a password manager, specifically?

Because the advice that preceded it was impossible to follow. “Use a long, unique, random password for every service” is correct and completely unachievable by memory, which is why everyone reused passwords and wrote them in a notebook. A password manager removes the conflict: you remember one strong passphrase, it generates and fills everything else.

The business case is uniqueness rather than complexity. A long random password is nice; the thing that actually protects you is that the password leaked from one service is useless everywhere else. That containment is what stops a single breach becoming a company-wide incident.

For a small team, the features that matter are shared vaults, so the three people who need the payment gateway login can have it without emailing it around; per-person accounts, so you can revoke one without changing everything; and recovery provisions, so losing one person’s device does not lock the business out. Most reputable business-tier managers offer all three.

Which second factor should you use?

Two-factor authentication means a password alone is not enough. Not all second factors are equally strong, and the differences matter because the weakest common option is also the most popular.

SIM swap deserves a specific mention for Indian businesses, because it is a real and locally common attack: someone persuades a mobile operator to issue a replacement SIM for your number, and then receives your OTPs. Any account where SMS is the only second factor is exposed to that. Where an authenticator app or passkey is offered, prefer it — particularly for your email, which is the account that can reset all the others.

Which accounts need it? Start with the ones that control other things rather than the ones holding the most data.

1. Business email. It can reset the password on nearly everything else, which makes it the single most important account you own.
2. Your domain registrar. Losing the domain means losing your website and your email at once, and recovery is slow.
3. Banking and payment gateways. The obvious one, and usually already protected.
4. Website and hosting admin. Both the control panel and the site’s own admin login.
5. Accounting software and your cloud storage. Where the records live.

The registrar at number two is the one almost everyone forgets, and it is often protected by an old password on a personal email address of whoever registered the domain years ago. Worth checking today.

Why are shared logins so damaging?

Because they destroy three things at once: you cannot tell who did what, you cannot revoke one person’s access without disrupting everyone, and in practice the password never changes because changing it inconveniences the whole team. A shared admin account used by five people is effectively a permanent credential held by everyone who has ever worked there.

The fix is individual accounts with appropriate permissions wherever the software allows it, which most business software now does. Where a service genuinely only supports one login — some older Indian vendor portals still do — put that credential in a shared password-manager vault rather than in a WhatsApp group, and record who has access.

Permissions are the other half. Not everyone needs admin. The accountant does not need to manage users, and the intern does not need to delete records. Most compromises do less damage when the compromised account could not do much in the first place.

What happens when someone leaves?

This is where small businesses are most consistently exposed, and it is pure administration. Write a one-page offboarding checklist once and run it every time.

The ordering note is a real trap. In both major suites, deleting a user can leave their documents in an awkward state or remove them outright depending on configuration. Transfer ownership of shared files to a colleague first, then suspend, then clean up. Doing it the other way round creates work and sometimes loses things outright — which is a good reason to have the backup plan already in place.

What does a one-week plan look like?

1. Monday. Choose a password manager and set it up for yourself only. Live with it for a day.
2. Tuesday. Turn on two-factor authentication for your business email and your domain registrar, using an authenticator app rather than SMS where offered. Save the recovery codes in the password manager.
3. Wednesday. Roll the password manager out to the team. Demonstrate it rather than emailing instructions; adoption is the whole battle.
4. Thursday. List every shared login. Convert what you can to individual accounts; move the rest into a shared vault and change the passwords.
5. Friday. Write the offboarding checklist, enable automatic updates everywhere, and review who has admin on what. Remove admin from anyone who does not need it.

Wednesday is the step that decides whether any of this holds. Security measures that annoy people get worked around — passwords on sticky notes, two-factor disabled “temporarily” — and a password manager is one of the rare controls that makes daily life easier rather than harder. Lead with that, show someone logging in faster than they used to, and adoption follows.

What this will not do is make you immune, and no article should promise that. What it does is move you out of the category of businesses compromised by automated attempts using old leaked credentials, which is where the great majority of incidents at this scale come from. That is a worthwhile week’s work.

Security and resilience are two halves of the same problem, so pair this with a backup plan your team can follow. Where your accounts and permissions live is decided by your suite, covered in Google Workspace vs Microsoft 365, and if you handle customer messaging, WhatsApp Business app vs API explains why account ownership matters there too. For customer data specifically, choosing a CRM gets records out of individual phones. More in the technology section.