Cybersecurity Awareness Month: Protecting Your Business

Cybersecurity is not only a concern for large organizations. Businesses of every size depend on technology to store client information, process transactions, communicate with employees, and support day-to-day operations. As a result, companies across industries—including commercial real estate, property management, leasing services, and investment management—can face meaningful cyber risk whether their teams work in an office, remotely, or in a hybrid environment.

Cybersecurity Awareness Month is an important opportunity to review the practices that help protect your organization. Strong security does not always depend on complex systems or substantial investments. Consistent habits, well-defined procedures, and an informed workforce can significantly reduce exposure. Alongside appropriate cyber insurance, these measures can help organizations prepare for and respond to unexpected cyber events.

Help Employees Identify Cyber Risks

Many cyber incidents begin with an everyday error. A realistic phishing message, unfamiliar attachment, fraudulent login page, or unexpected request can lead an employee to disclose sensitive information or unintentionally provide unauthorized access.

Ongoing cybersecurity education helps employees recognize suspicious emails, unknown links, unusual requests for confidential data, and other signs of potential fraud. Encouraging people to report questionable activity without hesitation can also help an organization contain a threat before it affects broader systems or operations.

Improve Access Controls Across Your Systems

Protecting company accounts begins with managing who can access them. Multi-factor authentication, or MFA, adds a second verification step—such as a temporary code, authentication application, or biometric confirmation—before a user can sign in.

MFA is particularly important for accounts that contain sensitive information, including email, payroll systems, financial platforms, cloud applications, client databases, and tools used for valuation and advisory work. If a password is exposed, the additional verification requirement may still prevent an unauthorized person from entering the account.

Access permissions should also be reviewed on a regular basis. Employees should receive only the access required to perform their responsibilities. When someone changes roles or leaves the organization, permissions should be revised or removed promptly to limit unnecessary exposure.

Maintain Current Software, Devices, and Passwords

Cybercriminals frequently target outdated software with known vulnerabilities. Timely updates to operating systems, business applications, antivirus programs, firewalls, and connected devices can close important security gaps. When practical, automatic updates can help ensure critical patches are not missed.

Strong password practices are equally essential. Each account should use a long, unique password that is not repeated on other platforms. A password manager can help employees create and securely store complex credentials, reducing the need to rely on memory while supporting better security habits.

Business devices require the same level of attention. Laptops, smartphones, tablets, and portable storage devices may hold or connect to valuable company information, including property management records, leasing data, office market insights, and real estate investment materials. Password or biometric protection, encryption where available, and remote-wipe capabilities can help reduce the impact of a lost or stolen device. Employees should also know whom to contact immediately if a company device cannot be located.

Assess the Information Your Business Needs to Protect

Effective cybersecurity starts with understanding the information your organization collects, stores, and uses. A straightforward risk assessment can help identify the assets that need the greatest degree of protection.

Consider questions such as:

• What types of business information do we collect and retain?
• Where is this information stored?
• Which employees, vendors, or partners can access it?
• What would the effect be if the information were lost, stolen, encrypted, or shared in error?

This review may include client records, employee information, payment data, contracts, pricing materials, internal files, property data, and the systems that support daily business activities. Once an organization understands what it needs to safeguard, it can more effectively prioritize the appropriate protective measures.

Address Vendor Access, AI Use, and Security Policies

Many organizations rely on third parties for payroll, payment processing, accounting, marketing, cloud storage, IT support, and other business services. In commercial real estate, outside partners may also support property management, workplace consulting, capital markets activity, and transaction services. Because vendors may have access to business information, it is important to understand what data they need, how they protect it, and whether their access can be limited. Access should be removed promptly when a vendor relationship ends.

Security policies should reflect how employees perform their work in practice. Teams that use remote access, cloud platforms, mobile devices, shared drives, or AI tools need clear guidance on acceptable use and the responsible handling of sensitive information.

AI tools deserve focused attention as they become part of more daily workflows. Employees may use AI to prepare drafts, organize data, or summarize documents, but confidential client details, financial information, employee records, and sensitive business documents must be handled carefully. Assigning responsibility for evaluating AI-related risk helps ensure these tools are used appropriately rather than leaving critical decisions to individual judgment.

Plan for Recovery Before a Cyber Incident

Even organizations with strong preventive controls cannot eliminate cyber risk entirely. For that reason, recovery planning is as important as prevention.

Dependable backups can help a business restore operations after files are deleted, encrypted, or otherwise compromised. Automated backups and at least one backup maintained separately from the primary network provide added protection when systems become unavailable.

Every organization should also maintain a clear incident response plan so employees understand what to do when suspicious activity occurs. Whether the concern involves phishing, ransomware, unusual account behavior, a missing device, or accidental data disclosure, knowing whom to contact and how to respond can reduce confusion, support faster action, and help limit further harm.

Cyber Insurance Supports a Broader Security Strategy

Technology safeguards, employee training, access controls, timely software updates, backups, and internal policies all contribute to reducing cyber exposure. However, even organizations with mature security practices can experience a cyber incident.

Cyber insurance is intended to complement preventive efforts by helping businesses manage certain costs that may follow a covered event. Depending on the coverage, this may include expenses related to data breaches, business interruption, legal exposure, notification obligations, and recovery assistance. Reviewing cybersecurity practices alongside insurance coverage can help identify potential gaps before an incident occurs.

If you have questions about cyber liability insurance or would like to review your current coverage, contact our team. We are here to help you better understand your options and develop a stronger strategy for protecting your business.