TikTok security chief shares free cyber tips for small businesses

Why social media accounts matter so much

TikTok's head of global security has set out a series of free measures that small and medium-sized businesses can take to protect themselves online, in a piece published by TechRadar on 14 November 2026. The advice appears as part of TechRadar Pro Perspectives, a channel for contributions from industry figures, and the views are presented as the author's own.

The argument starts with how central social media has become to smaller firms. According to the article, close to two-thirds of businesses now use social platforms, and for many small companies these accounts act as shopfront, sales channel and customer service desk at the same time. TikTok says its platform helped UK small and medium-sized firms add an estimated £3.4bn in extra economic output in 2025.

That visibility comes with risk. The article notes that in the UK, nearly half of small businesses have reported being hit by a cyber breach or attack. TikTok also states that more than 99% of the fraud and scam content it removes is taken down before anyone reports it, though this is the company's own figure.

Treat unexpected offers as unverified

The first piece of advice concerns scams that disguise themselves as opportunities. These can take the form of an unsolicited investor, a brand offering a collaboration that requires an upfront payment, or a service promising rapid follower growth. The article says such approaches work because they appeal to what founders want most: funding and expansion.

The recommended response is to treat every unexpected offer as unverified until it has been checked through the organisation's official website or an existing trusted contact, never through the link or phone number supplied in the message. The author also warns against anyone selling likes, followers or verification badges, saying this can at best deliver worthless numbers and at worst hand over control of an account.

Protect logins and give each person their own access

Account security forms the second pillar of the advice. The article recommends a unique password of at least 12 characters for every business account, so that one leaked credential cannot unlock the rest. It also urges firms to switch on 2-Step Verification, a second check beyond the password, and to use passkeys where devices support them. Passkeys replace passwords with something tied to the device, such as a fingerprint or face scan, and are described as far harder to steal.

The author adds that passwords should never be sent by email or direct message, no matter how urgent a request seems or who appears to be asking.

Shared logins are flagged as a common weak point in small teams, where a founder, a part-time social media manager and a freelancer may all use one account. The article says this makes it impossible to see who did what, and hard to remove one person without disrupting everyone. Instead, each team member should have their own access, with a password manager used to keep credentials organised. Recovery email addresses and phone numbers should be kept current, and security alerts and active devices checked regularly.

One habit is singled out as frequently overlooked: removing employees, freelancers and agencies from accounts as soon as their role ends. The author calls offboarding one of the easiest security tasks to get right.

Watch what you post and report suspicious activity

The final two suggestions concern content and reporting. Behind-the-scenes posts, such as packing orders or showing how a product is made, are described as an effective way to build an audience, but they can reveal more than intended.

If something feels wrong, whether an email or something seen on social media, the advice is to report it. The author argues that every report helps platforms identify patterns and act more quickly, protecting other businesses facing similar tactics.

What it means for small firms

The overall message is that none of these steps requires technical expertise, a dedicated IT team or a budget. The author's closing argument is that while a cyber incident can be expensive, the basic protections described cost nothing.

For readers running a small business, the practical starting points are clear: verify unexpected offers through official channels, use long unique passwords with a second verification step, give each person their own login, remove access when roles end, and check what is visible in the background of posts. Readers wanting the full guidance can consult the original article on TechRadar.