Introduction
Cybersecurity discussions at the enterprise level involve zero-trust architecture, SOC teams, and SIEM platforms. For a 50-person SaaS company, none of that is the relevant conversation. The relevant conversation is whether basic controls are in place — because in most cases, they are not.
This guide covers the most common cybersecurity gaps I encounter when auditing SMB IT environments, with practical examples from real situations.
The Most Common Gaps
1. MFA is incomplete
Most SMBs have MFA enabled on Microsoft 365 or Google Workspace. What they miss is that MFA on email is not the same as MFA everywhere. Slack, Notion, LastPass, your CRM, your cloud infrastructure — each of these is a separate entry point.
In one environment I audited, MFA was enforced on M365 but 14 out of 23 SaaS tools had no MFA requirement. An attacker with a single compromised password could access project management, customer data, and financial tools without any additional verification.
2. No Conditional Access policies
Conditional Access in Entra ID (formerly Azure AD) lets you define rules around when and how users can log in. Without it, a valid username and password from any device in any country grants full access.
Basic Conditional Access policies — blocking legacy authentication, requiring compliant devices, restricting access from high-risk locations — take a few hours to configure and significantly reduce attack surface.
3. SharePoint sharing is uncontrolled
The default SharePoint sharing settings allow users to share files with anyone via a link — no Microsoft account required. In most SMBs I have worked with, nobody has changed this default.
The practical result: sensitive documents shared internally get forwarded externally without any visibility. A single ‘forward this link’ exposes the file to anyone.
4. Offboarding leaves active accounts
When someone leaves and their M365 account is disabled but their Slack, Notion, LastPass, and third-party SaaS accounts remain active, you have an open door. Former employees — even those who left on good terms — retain access they no longer need.
I found an active admin account in a company’s Notion workspace belonging to someone who had left 14 months earlier. That account had edit access to the entire company wiki including HR documents.
Cyber Essentials: The Right Starting Point
The UK Government’s Cyber Essentials certification covers five core controls: firewalls, secure configuration, user access control, malware protection, and patch management. For most SMBs, achieving Cyber Essentials means fixing the exact gaps listed above.
The certification also provides a clear external signal to clients and partners that basic security hygiene is in place — increasingly relevant for fintech and SaaS companies handling client data.
A Practical Approach
Start with an honest audit of your current state. For each tool your company uses, ask: who has access, is MFA enforced, and what happens to that access when someone leaves. The answers will tell you where to start.
The goal is not perfection — it is removing the most accessible entry points. Most SMB breaches exploit basic gaps, not sophisticated vulnerabilities. Closing the basics removes you from the easy target category.
Conclusion
Cybersecurity for a 50-person company is not a complex project. It is a checklist of controls that most companies have never formally implemented. Getting those controls in place — ideally verified through Cyber Essentials — is one of the highest-value IT investments a scaling SMB can make.