For most small companies in Vietnam, cybersecurity basics for businesses are not about expensive software or a dedicated security team. They are about a handful of habits that stop the most common attacks: strong passwords, a second check when logging in, a sceptical eye for fake messages, regular backups, and software that stays up to date. Vietnam faces a large volume of online attacks — the National Cybersecurity Association counted roughly 552,000 cyberattacks on information systems in the country in 2025 — yet most of the damage starts with something simple, like a reused password or one careless click.
Start with passwords and two-factor authentication
Passwords are still the front door to almost every business account: email, banking, cloud storage, social media pages, and the shop’s sales system. If one password is reused across several services, a single leak opens them all. The fix is straightforward. Every account should have its own long password — a phrase of four or five random words is easier to remember and harder to guess than a short string of symbols. A password manager, even a free one, can generate and store them so nobody has to memorise dozens of logins.
The second step matters even more: turn on two-factor authentication everywhere it is offered. That means logging in requires both the password and a one-time code from an authenticator app or a text message. Data from VNPT’s threat intelligence team shows that more than 70 percent of attacks on organisational systems in Vietnam in early 2025 came through compromised accounts — usually obtained by brute-force guessing, credential-stealing malware, or direct intrusion. Two-factor authentication blocks most of those paths at once. Apply it first to email and banking.
Learn to spot phishing before anyone clicks
Phishing is a message designed to look trustworthy — a delivery notice, a bank alert, a supplier invoice, or a request from the boss — that tricks someone into handing over a password or opening a malicious file. In Vietnam, fake messages often arrive through SMS, Zalo, Facebook Messenger, and email, and they frequently impersonate banks, delivery companies, or government services. The details change constantly, but the pattern stays the same: urgency, a link or attachment, and a request for credentials or payment.
Teach everyone in the business three checks before clicking anything. First, look at the sender: does the address or number actually belong to the organisation it claims to be? Second, hover over the link — without clicking — and see where it really leads. Third, treat urgency as a warning sign: real banks and real suppliers rarely demand immediate action through a link in a message. When in doubt, open the service directly from its own app or website instead of following the link.
Back up like your business depends on it, because it does
Ransomware is the attack small businesses fear most, and for good reason: it encrypts files and demands payment to restore them. In the first half of 2025, ransomware caused more than 10 million US dollars in damage in Vietnam, with over three terabytes of data encrypted, according to VNPT Cyber Immunity. The National Cybersecurity Association’s survey found that ransomware was among the five most common attack types in 2025, alongside denial-of-service attacks, gambling-link injection, advanced persistent threats, and data theft.
The single best defence is a backup the attacker cannot reach. Follow the 3-2-1 rule: three copies of important data, on two different kinds of storage, with one copy off-site or offline — for example, the working files, a copy on an external drive unplugged after each backup, and a copy in a cloud service. Test the restore at least once: a backup nobody has ever restored is a hope, not a plan. Keep a short list of what matters most — customer records, invoices, contracts, product photos — so recovery starts with the essentials.
Keep software updated and limit who can install things
Most attacks do not use exotic techniques. They use known weaknesses in software that already has a fix available. Operating systems, browsers, office software, and the apps on staff phones all receive security patches regularly, and delaying those updates leaves the door open. Turn on automatic updates wherever possible, and set a weekly routine — say, Friday afternoon — to check that every work computer and phone is current.
Access control is the other half of this habit. Not everyone needs administrator rights on every machine. Give staff the access they need for their job and nothing more, and remove accounts promptly when someone leaves. If the business uses shared computers, make sure each person has a separate login rather than one shared account, so a mistake or a departure does not compromise everyone at once.
Make a simple plan and train your team
Technology alone is not enough. The same national survey found that 52.30 percent of agencies and businesses in Vietnam reported suffering damage from cyberattacks in 2025, up from 46.15 percent the year before — even as the total number of attacks fell. Attackers are becoming more selective and better prepared, which means awareness matters more, not less. The encouraging sign is that the share of organisations providing cybersecurity awareness training reached 75.93 percent in 2025.
A small business does not need a thick policy document. A one-page plan is enough: who to call first when something looks wrong, how to isolate an affected computer (disconnect it from the network), and where the backups live. Run a short session with the team every few months — fifteen minutes on the latest scam messages circulating, a reminder about two-factor authentication, a check that everyone knows the plan. The goal is not to make everyone a security expert. It is to make the basics automatic, so that a single tired click does not become a crisis.
It also helps to know the rules that apply. Vietnam’s data protection and online platform rules, explained in our guides to Decree 13/2023 on personal data protection and Decree 147/2024 on online platforms, set expectations for how customer information is handled. Good security habits make those obligations much easier to meet. And as public services move online, the same discipline applies to identity: our guide to VNeID, the one app for identity and public services, explains how verified digital identity is becoming part of everyday business.
What this means
Cybersecurity for a small business is mostly a set of small, repeated habits: unique passwords with two-factor authentication, a sceptical pause before clicking, backups that are stored offline and tested, software that is kept current, and a team that knows what to do when something looks wrong. None of these steps is expensive, and none requires specialist knowledge. Together they block the attacks that cause most of the damage in Vietnam today. Start with the account that matters most — usually email or banking — and work through the list one item at a time.