I sat down with a Northland builder last week. Good operator – builds a handful of homes a year, sends invoices that can hit $200,000 a pop. Sharp guy.
His email? Running in an old program on his computer. The mailbox itself hosted by the same company that built his website. Backups done by hand, when he remembers. No second layer of security. No cyber insurance.
I asked him about it. His answer was the one I hear most: “I’ve never had a breach, so I’ve always sort of trusted it.”
That’s the bit that worries me. Let me explain why – in plain English.
What “email on your computer” actually means
The old way of doing email – POP3 (Post Office Protocol) – pulls your messages down onto one machine and leaves the only real copy sitting on that hard drive. Not in the cloud. On the computer under the desk.
Back when you had one PC and one job on the go, fine. But today that setup is carrying three risks at once, and most owners have never been told about any of them.
Risk one – the hard drive is the only copy. Modern drives are soldered-in chips now. No moving parts, nothing to recover. When one dies – and they do – manual backups are only as good as the last time you actually did one. Miss a fortnight, lose a fortnight. Everything.
Risk two – one password is the whole lock. No multi-factor authentication (that second code on your phone). So if someone guesses or steals the password to your web host, they’re straight into your email. No alarm. Nobody gets told.
Risk three – this is the one that costs real money. If a scammer gets into your email, they sit and watch. Then they wait for a big invoice to go out – and quietly change the bank account number on it before your client pays. You’ve done nothing wrong. The client pays the wrong account. On a $200k invoice, that’s not a computer problem – that’s a house deposit gone.
“But nobody bothers a business my size”
That logic flipped years ago.
It used to be you were too small to be worth a hacker’s time. Now it’s the opposite – you’re the easy one. You haven’t spent what the big guys spend on security, so you’re the cheaper door to kick in. It’s the smaller businesses getting hit these days, precisely because they think they’re too small to be a target.
And it’s not always your email they come through. I’ve watched website hosts themselves get compromised – the attacker gets in once, then pushes malware out through every customer site they host. One local outfit got done and it flowed straight through to their customers’ sites. The sites still looked completely normal. That’s the whole trick.
The good news – none of this is dramatic to fix
You don’t rip everything out. You move email off the web host and into a proper cloud platform like Microsoft 365, set up properly:
- Your mail lives in one place and syncs across every device – laptop, phone, ute – always current.
- MFA on by default, with threat protection watching for the dodgy stuff.
- Real backup and recovery, so a dead hard drive is a shrug, not a disaster.
- And your email separated from your website – two different jobs, two different homes. One has a bad day, the other keeps running.
And get cyber insurance while you’re at it. A professional firm I know got hit for $700,000. Their insurance covered it – without it, that was the whole business gone. Cover costs a lot less than most owners expect – and next to nothing against what one intercepted invoice would set you back. That’s the maths.
The bottom line
“It’s never been hacked” isn’t a security plan – it’s a run of good luck you can’t see the end of. If your email still lives on your computer, hosted by your website company, with manual backups and one password protecting it, you’re carrying a risk nobody’s put a number on for you.
Here’s the easy first step. We’ve put a free two-minute cyber readiness check online – plain-English questions about your email, your files, your backups and your website, and a straight score at the end. No cost, no obligation. You’ll simply know where you stand.
If you’d rather we just took a look ourselves, give us a ring on 09 222 7770. We’ll tell you straight.