10 Cybersecurity Mistakes Ugandan Businesses Make

Many business owners assume cybercriminals only go after banks and large corporations. In practice, attackers often prefer smaller organisations, because they tend to have fewer protections, less staff training and no dedicated IT person watching for problems.

The good news is that most successful attacks rely on a short list of avoidable mistakes. Here are the ten we see most often when we survey offices, schools, hotels, shops and NGOs across Uganda, and the practical fix for each.

1. Sharing passwords and logins

One account used by the whole team, or a password written on a sticky note near the screen, means you cannot tell who did what, and you cannot easily revoke access when someone leaves.

Fix: give every person their own account. Use a password manager so staff do not need to remember or reuse passwords.

2. No multi-factor authentication (MFA)

A stolen or guessed password is enough to get into email, cloud storage or accounting software if nothing else is checking who you are.

Fix: turn on MFA for email, cloud services, banking portals and remote access first. An authenticator app is stronger than SMS codes where possible.

3. Weak or reused passwords

Reusing the same password across personal and work accounts means one breach elsewhere can open the door to your business.

Fix: use long, unique passphrases, ban obvious choices, and never reuse a password across systems.

4. Unpatched computers and devices

Software updates often fix security holes that attackers already know about. Machines left months behind are easy targets, including routers, access points and cameras, which many businesses forget.

Fix: schedule regular updates for operating systems, applications and network equipment. Replace devices that no longer receive updates.

5. Treating antivirus as a one-time purchase

Installing antivirus once and never checking it leaves gaps. Licences expire, protection gets switched off, and some computers never report in.

Fix: use centrally managed endpoint protection so someone can see every device's status in one place. Our guide on ESET PROTECT explains how this works.

6. Falling for phishing and payment fraud

Fake invoices, urgent messages from "the director", and links that imitate banks or mobile money services remain a major way into businesses. They depend on pressure and speed, not technical skill.

Fix: train staff to pause and verify. Confirm any change of payment details through a known phone number, not by replying to the message. Make it normal and safe to report suspicious messages.

7. Flat networks where everything can reach everything

If guest Wi-Fi, staff laptops, CCTV, POS terminals and servers all share one network, a single infected device can reach the rest.

Fix: separate your network into segments (VLANs) for guests, staff, servers, cameras and payment systems, and control what each can access. This is standard on the networks we design.

8. Leaving old accounts active

Former employees, interns and contractors often keep access to email, files and systems long after they leave.

Fix: keep a simple joiners-and-leavers checklist. When someone leaves, disable their accounts the same day and recover company devices.

9. Backups that are untested or reachable by attackers

A backup stored on a shared drive, or never restored as a test, may not save you from ransomware or hardware failure.

Fix: keep an offsite and immutable copy, use separate credentials, and test restores regularly. See our guide on backup and disaster recovery.

10. No plan for when something goes wrong

When an incident happens, confusion costs time. Who do staff call? Who can disconnect a device? Who decides whether to contact customers or the authorities?

Fix: write a one-page incident plan: contacts, first steps, who decides, and where backups and key credentials are kept. Practise it once a year.

A 30-day action plan

You do not need to fix everything at once. Start here:

Week 1: turn on MFA for email and cloud accounts. Give every user their own login.

Week 2: list every computer and device, check updates and antivirus status, and remove accounts for people who have left.

Week 3: check that backups ran, test a file restore, and confirm one copy is offsite.

Week 4: run a 30-minute staff session on phishing and payment fraud, and write your one-page incident plan.

When to bring in help

If you do not have an in-house IT person, or you are unsure what is exposed on your network, an outside assessment is the fastest way to find out. Backspace reviews networks, endpoints, backups and physical security together, because attackers do not respect the boundaries between them.

Book a free site assessment or call +256 786 394 913.