When a small business faces ransomware or a hijacked mailbox, the instinct is to call the IT person who handles everyday problems. According to Colton of Sitalingi Cybersecurity, that instinct is understandable but often mismatched to the situation.
When Standard IT Support Isn't Enough
Colton describes a common pattern: by the time a small business seeks specialized incident response, they have already tried their regular IT contact.
Most small businesses that reach specialized incident response help have already tried their regular IT person. That person is usually good at everyday issues like patching, basic troubleshooting, and restoring from a recent backup. When the problem is active ransomware or a mailbox that has already been used to send fake payment instructions, a simple reimage or password reset often is not enough.
— Colton, Sitalingi Cybersecurity
The gap isn't about competence, Colton suggests. It's about scope. Regular IT can handle normal support afterward, but the first day or two of a real incident needs different steps: determining how far the attacker got, preserving evidence, and restoring operations without making things worse.
The Evidence Problem Nobody Talks About
One of the most practical omissions in small-business incident response guides, according to Colton, is the risk of destroying evidence through well-intentioned actions.
The most common issue is people wiping out the best evidence without meaning to. Everyone is used to the old IT advice to restart the computer. That works for a frozen app, but it is the wrong first move if you think the machine was compromised. Restarting clears the memory.
— Colton, Sitalingi Cybersecurity
That memory can hold running programs, active connections, and signs of the attack not yet written to disk. Colton's guidance: if it is safe, disconnect the computer from the network and leave it powered on until someone qualified can examine it.
Other recurring problems include coordinating the response through the same compromised email account and restoring from backups before verifying they are clean. For readers building an incident response plan, these are concrete checkpoints worth adding.
First-Hour Decisions That Create Extra Work
Colton identifies two scenarios where owners tend to move too fast in the wrong direction.
Lost or Stolen Laptop
The quick decision that causes the most unnecessary downtime is issuing a full remote wipe the moment a laptop is reported missing.
A wipe makes sense once you are sure it was stolen or that it will not turn up. If the laptop is only misplaced and shows up a day later, an irreversible wipe creates downtime you did not need.
— Colton, Sitalingi Cybersecurity
A better sequence, according to Colton: revoke active sessions and reset passwords immediately, including any other accounts or password-manager vaults reachable from the device; confirm whether the drive was encrypted; try a remote lock or locate if management tools support it; and only then decide on a wipe. Waiting hours because "it might be in the car" is another frequent miss, since the window to limit access is short.
Locked or Compromised Mailbox
Changing the password is necessary but often insufficient. Attackers commonly leave behind inbox rules that forward or delete messages, extra forwarding addresses, or additional sign-in methods.
A password change alone can leave them with continued access. Another common mistake is coordinating the recovery through the same compromised mailbox, which can tip the attacker off.
— Colton, Sitalingi Cybersecurity
Owners also sometimes delete suspicious messages before anyone has reviewed the rules and logs. Colton's recommended first-hour focus: revoke all sessions, review and remove rules and forwarding, and use a separate trusted communication channel. Resources like Microsoft's guidance on compromised accounts outline similar steps.
Why These Patterns Persist
Colton ties these mistakes to a natural reaction: the urge to fix things as fast as possible. But the sequence that actually limits damage prioritizes stopping further access and preserving useful information before cleanup or restoration.
For small businesses without dedicated security staff, the takeaway is not to become incident responders overnight. It is to recognize when a situation exceeds routine IT support, avoid actions that destroy evidence, and know the order of operations that buys time rather than burning it. A written incident response plan that accounts for these first-hour decisions can make the difference between a contained event and a prolonged recovery.