5 Vulnerabilities That Show Up on Every Small Business Audit

I've done dozens of audits. These five show up almost every single time — different industries, different sizes, different budgets, same five holes. If you run a small business and haven't had a real audit, odds are good you have at least three of these right now.

None of these are exotic. There's no zero-day involved, no nation-state tooling, no advanced persistent threat. These are basic hygiene failures that persist because nobody owns the responsibility of checking for them on a recurring basis. That's the actual root cause behind all five — not a lack of security products, but a lack of a defined process for reviewing what's already deployed.

Vuln 1: Default Credentials

Routers, NAS devices, printers, and IP cameras all ship from the factory with a default admin login — admin/admin, admin/password, or a credential printed on a sticker that nobody ever removes. Roughly half of the small businesses I audit never change them, sometimes years after deployment.

Finding these devices takes minutes. A Shodan search for a specific device model instantly surfaces every internet-exposed unit running that firmware, often with the default login still active. An internal Nmap service scan does the same job on your own network:

Change every default credential the day a device is installed. Not next week — the day it's installed.

Vuln 2: Unpatched Software and EOL Systems

Windows 7 and unpatched Windows 10 machines are still running in production at small businesses that "haven't gotten around to" the upgrade. WordPress plugins two years out of date sit on client-facing websites. PHP 7.x, long past end-of-life, still powers checkout pages. And Log4Shell — a vulnerability disclosed in 2021 — is still present on legacy systems in 2025 because nobody inventoried where the library was actually used.

None of this requires a sophisticated attacker to find. Automated scanners run against the entire internet 24/7, fingerprinting software versions and flagging known CVEs. Unpatched systems aren't found through targeted effort — they're found by bots that never stop looking.

Vuln 3: Exposed Admin Panels

WordPress's /wp-admin, cPanel, Webmin, and phpMyAdmin are frequently reachable directly from the open internet with nothing but a login form standing between an attacker and full administrative control. These panels should never be publicly reachable at all — at minimum, they belong behind a VPN or restricted to an IP allowlist of known, trusted addresses.

A brute-force or credential-stuffing attack against an exposed admin panel is trivial to automate and runs continuously, silently, until it succeeds or the account locks out.

Vuln 4: Weak or No Email Security

Missing SPF, DKIM, and DMARC records make a company's domain trivially easy to spoof — anyone can send an email that appears to come from your company's own domain, with no technical barrier stopping them. Business email compromise (BEC) built on exactly this weakness is the single largest financial cyber crime category by dollar losses.

A missing DMARC record is easy to spot — a DNS lookup for _dmarc.yourdomain.com simply returns nothing. No record means no policy telling receiving mail servers what to do with spoofed messages impersonating your domain, so they get delivered right to the inbox.

Vuln 5: No Employee Security Training

Phishing simulation success rates still sit above 30% at most small and mid-sized businesses I've tested — meaning roughly a third of employees will click a malicious link or hand over credentials in a simulated attack. Every firewall, every patch, every access control in the world does nothing once an employee is socially engineered into handing over their password directly. Social engineering bypasses every technical control you've paid for, because it targets the one system that can't be patched: human trust.

The businesses with the lowest phishing click rates I've tested all share one thing in common: recurring, low-pressure training that treats mistakes as a learning moment rather than a disciplinary one. Employees who are afraid to report a suspicious email they already clicked will hide it instead of flagging it — and that delay is often the difference between a contained incident and a full breach.

How to Fix All Five This Week

• Default credentials: Inventory every network device this week and change any default login immediately. Document the new credentials in a password manager, not a sticky note.
• Unpatched software: Turn on automatic updates wherever possible, and schedule a monthly patch review for anything that can't auto-update.
• Exposed admin panels: Put every admin interface behind a VPN or IP allowlist by end of week. If that's not immediately possible, enforce MFA on the login as a stopgap.
• Email security: Publish SPF, DKIM, and DMARC records. This is a DNS change that takes under an hour and closes one of the most exploited gaps in business email.
• Employee training: Run a phishing simulation this month to get a real baseline, then schedule recurring, short training sessions — not a single annual slideshow nobody remembers.

None of these fixes require a massive budget. They require someone to actually check, and most businesses simply haven't.

What separates the businesses that stay secure from the ones that end up in a breach headline usually isn't budget size — it's whether someone treats security review as a recurring calendar item instead of a one-time project. A quarterly walkthrough of these five categories, even a lightweight one, catches drift before it becomes an incident. Set the recurring reminder today, not after the next audit finds the same five problems again.