TikTok Head of Global Security on how SMBs can boost their cybersecurity for free Kim Albarella | usagoldmines.com

Nearly two-thirds of businesses use social media, and for many smaller firms it’s where customers discover, get to know, and buy from them. This means that for a small or medium-sized business, a social media account is often its shopfront, sales channel, and customer service desk all at once.

It pays off. TikTok helped UK small and medium-sized businesses generate an estimated £3.4bn in additional output in 2025.

And while a digital-first world can be great for business, scammers and cybercriminals are evolving their tactics to match. In the UK alone, nearly half of small businesses have reported being targeted by a cyber breach or attack.

At TikTok, more than 99% of the frauds and scams content we remove is taken down before anyone reports it. But there are plenty of steps businesses should take, and the good news is that it doesn’t require a dedicated tech team or a big budget.

1. Treat unexpected offers as unverified

The most effective scams don’t look like scams. They look like opportunities: an investor who gets in touch out of the blue, a brand that slides into your DMs with a collaboration but needs an upfront fee to “secure the deal”, a service promising to double your followers by Friday. They work because they speak to what every founder wants most: funding and growth.

So treat every unexpected offer as unverified until you’ve checked it yourself, through the organisation’s official website or a contact you already trust, never the link or number in the message. And ignore anyone selling likes, followers or verification. At best, you’ll get hollow numbers. At worst, you’ll hand over the keys to your account.

2. Lock down your logins

Your login is the front door to the business you’ve built. Use a unique password of at least 12 characters for every account your business uses, so one leaked password can’t unlock the rest. Turn on 2-Step Verification, so anyone who steals your password still can’t get in without a second check.

Where your devices support them, set up passkeys. They replace passwords with something tied to your device, like a fingerprint or face scan, which makes them far harder to steal. Finally, never send a password by email or direct message, however urgent the request or familiar the sender.

3. Know who has access

In small teams, it’s tempting to share one login across everyone: the founder, the part-time social media manager, the freelancer who helped with the launch. It’s convenient, but you can’t tell who did what, and you can’t remove one person without disrupting everyone else.

Instead, give each team member their own access, and use a password manager to keep credentials organised. Keep your recovery email and phone number up to date, and check security alerts and active devices regularly.

Most importantly, remove employees, freelancers and agencies as soon as their role ends. Offboarding is one of the most overlooked moments in business security, and one of the easiest to get right.

4. Watch what’s in shot

Behind-the-scenes content, whether that’s packing orders or showing how a product is made, is one of the best ways to build a following. It can also give away more than you intend. Before you post, check the background. A delivery label, an order slip or a customer’s details left on a packing table can tell a scammer exactly what they need to target you, or the people who buy from you.

5. Report anything suspicious

If something feels off, whether it’s an email or something you see on social media, report it. Every report helps platforms spot patterns and act faster, protecting not just your business but others being targeted in a similar way.

Small habits, serious protection

None of these steps requires technical expertise or a dedicated tech team. A cyber incident can be costly, but basic protections cost nothing. Whether you’re a one-person operation or a growing team, these habits will help keep the revenue coming in, and the cybercriminals out.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit