# How to defend against cyberattacks: the checklist that matches how attacks actually happen

> Every incident in this series has a dull cause: a controller left on the internet, an old firmware, a password with no second factor, a payment approved on a phone call. The defence is just as dull and works. Here it is, in the order that tends to matter, with the incident that proves each point.

Updated 2026-11-03 · Payaries · https://www.payaries.com/blog/how-to-defend-against-cyberattacks-what-works

## Eight things that matter

> **Written 3 November 2026.** General guidance for businesses, drawn from the incidents linked below; not a substitute for a professional assessment. Payaries is a technology platform, not a security adviser. This article reports public information and is not legal or security-consulting advice. Facts in fast-moving stories change — read the primary sources linked below.

| Do this | Because of |
|---|---|
| Take management interfaces off the public internet | France's CERT-FR said exposing a refrigeration controller's interface was against best practice. [Fridge attacks](https://www.payaries.com/blog/supermarket-fridge-cyberattacks-europe-2026) |
| Know what you own, then patch or replace it | Danfoss said the affected French units ran outdated firmware. [IoT and OT](https://www.payaries.com/blog/why-everything-connected-gets-hacked) |
| Require multi-factor sign-in everywhere that matters | Colonial Pipeline reportedly lacked it on the account used. [Infrastructure](https://www.payaries.com/blog/critical-infrastructure-cyberattacks-explained) |
| Verify payments out of band, with two approvers | Arup lost HK$200m to a fake video call. [Deepfakes](https://www.payaries.com/blog/deepfake-fraud-seeing-is-no-longer-believing) |
| Tighten the help desk and password reset process | M&S's chairman said attackers impersonated an employee to get a help-desk password reset. [Retail](https://www.payaries.com/blog/retail-cyberattacks-ms-coop-jaguar-land-rover) |
| Keep offline, tested backups and a manual fallback | Downtime, not the ransom, is the main cost. [Ransomware](https://www.payaries.com/blog/ransomware-economy-crime-as-a-business) |
| Map and limit your suppliers' access | Third-party involvement doubled to 30% in Verizon's report. [Concentration](https://www.payaries.com/blog/concentration-risk-one-vendor-one-update-one-outage) |
| Alert on physical reality, not just IT | Attackers reportedly stretched freezer defrost cycles from one hour to eight to delay alarms. A temperature alert that does not depend on the controller cannot be silenced by it. |

## Close the gap faster than AI can open it

CrowdStrike's data puts average time from first access to lateral movement at 29 minutes, and Belgium's cyber centre says AI can now be used to exploit weaknesses. The practical consequence is to treat **time to patch** and **time to detect** as the numbers you manage. Anything that does not need to be on the internet, remove; anything that must be, update first. See [how AI is making attacks faster](https://www.payaries.com/blog/how-ai-is-making-cyberattacks-faster-and-cheaper).

## If you take or send payments

- Use a dedicated, least-privilege API key per integration, and rotate it when staff leave.
- Sign every API request. [Payaries requests are signed with HMAC-SHA256](https://www.payaries.com/guides/sign-crypto-payment-api-requests), so a forged request without the secret is rejected.
- Verify the signature on every incoming [webhook](https://www.payaries.com/guides/verify-crypto-webhook-signatures) before you mark an order paid; never trust a redirect alone.
- Set withdrawal limits and require human approval above a threshold, particularly if an AI agent is involved: see [AI agents and Payaries](https://www.payaries.com/ai-agents).
- Reconcile invoices against your own records daily.

None of this makes a business attack-proof, and Payaries is a payment gateway rather than a security product. It narrows the one slice of exposure that a payment integration controls.

## The larger point

Technology is not turning on civilisation; people are using powerful, cheap and widely shared tools against systems that were built for efficiency before safety. The answer is not less technology but the unglamorous discipline we expect elsewhere: inspection, maintenance, redundancy and checking who you are dealing with. A freezer controller is now critical infrastructure, and it should be treated like it.

## Questions

**What is the most effective defence against cyberattacks?**
No single control, but the common causes in recent incidents are exposed management interfaces, unpatched or unsupported devices, missing multi-factor authentication, and payments approved on an unverified request. Fixing those covers a large share of real incidents.

**How can a small business protect itself?**
Turn on multi-factor authentication, keep software and devices updated, back up offline and test the restore, verify payment changes by calling back on a known number, and keep a list of the suppliers you depend on.

**How do I secure a crypto payment integration?**
Use least-privilege API keys, sign requests, verify webhook signatures before fulfilling an order, set withdrawal limits with human approval, and reconcile regularly.

## Try it

Run a real invoice before you commit: [Payaries — www.payaries.com](https://www.payaries.com/signup). Payaries is a multi-chain crypto payment gateway — https://www.payaries.com

## Keep reading

- https://www.payaries.com/blog/supermarket-fridge-cyberattacks-europe-2026 — Someone is hacking supermarket fridges: what we know about the attacks across Europe
- https://www.payaries.com/guides/sign-crypto-payment-api-requests — How to sign crypto payment API requests (HMAC-SHA256)
- https://www.payaries.com/guides/verify-crypto-webhook-signatures — How to verify crypto payment webhook signatures
- https://www.payaries.com/blog/why-everything-connected-gets-hacked — Why everything with a network cable ends up hacked: IoT and OT explained
- https://www.payaries.com/blog/deepfake-fraud-seeing-is-no-longer-believing — Deepfake fraud: what happens when a video call can be faked
- https://www.payaries.com/blog/how-ai-is-making-cyberattacks-faster-and-cheaper — How AI is making cyberattacks faster, cheaper and harder to spot
- https://www.payaries.com/blog/retail-cyberattacks-ms-coop-jaguar-land-rover — Shelves, showrooms and assembly lines: what the M&S, Co-op and Jaguar Land Rover attacks taught us