Three days with nobody in the office. For most of your team, that is the point of the Thanksgiving long weekend. For anyone trying to break into a small business, it is the point too.
Attackers have favoured holiday weekends for years, and the logic is not complicated. Ransomware that starts encrypting files on a Friday evening has until Tuesday morning before anyone notices. A compromised mailbox can sit quietly through three days of nobody reading the alerts. Timed for when the office is empty, an incident that would have been caught in an hour gets three days to spread instead.
While no checklist makes a business immune, a handful of checks on Friday afternoon removes most of that advantage. None of them take long.
1. Confirm last night's backup actually ran
Not that backups are configured. That last night's job finished, and that it covered everything. Backup tools report success while quietly skipping a folder somebody added in the summer. If something does go wrong over the weekend, a recent, complete copy is the difference between a restore and a rebuild. If you have never tested one, the backup restore test guide in our templates takes five minutes.
2. Check who has administrator access
Pull the list of administrator accounts in Microsoft 365 or Google Workspace and read it. You are looking for former staff, a consultant from a project two years ago, and any account nobody can identify. Administrator accounts are the ones attackers want most, and an unused one is the easiest to take over unnoticed. Anyone who should not be on that list comes off it today, not on Tuesday.
3. Hold any payment changes until Tuesday
If a supplier or client emails asking to update their banking details, it waits until after the weekend and gets confirmed by phone on a number you already had. Fraudsters time these requests for exactly the moment when the person who would normally question them is about to log off for three days. A rule that says "no banking changes on a Friday" costs nothing.
4. Install the pending updates before you leave
Restart the machines that have been asking to restart all week. Updates that are downloaded but not installed protect nobody. Leaving them for the weekend also means machines restarting on their own at some point, which is fine for a laptop and a problem for anything that needs to stay running.
5. Shut down what does not need to be on
A desktop left running all weekend with someone's email open is an unwatched door. Unless a machine genuinely needs to stay on, shut it down. For the ones that do, such as a server or a reception PC that runs a booking system, make sure they are locked and patched.
6. Know who to call
Write down, somewhere that is not your email, who to call if something goes wrong over the weekend: your IT provider, your bank's fraud line, and your cyber insurer's claims number. Unfortunately, the moment you need those numbers is usually the moment your email is unavailable or untrustworthy. A printed page in a drawer is still the most reliable incident plan a small business can have.
If something does go wrong
Disconnect the affected machine from the network, but leave it powered on so it can be examined. Do not pay anything, do not delete anything, and call your IT provider before trying to fix it yourself. Then call your insurer, because most policies expect to be told promptly, and some have a response team you are required to use.
Our verdict
None of this is sophisticated, and that is the point. The businesses that get hurt over long weekends rarely lacked an expensive security product. They lacked someone spending twenty minutes on Friday afternoon making sure the basics were in place before everyone left.
We would rather your Thanksgiving be uneventful. Spend the twenty minutes, then enjoy the turkey.
For the businesses we support, this is part of the routine rather than a Friday scramble: backups monitored, admin access reviewed, and someone watching the alerts while the office is closed. More on that in managed IT and help desk.