In August half of Spain pulls down the shutters, and SMEs more than anyone. What does not slow down is the systems. Email keeps receiving, the online store keeps charging, remote access keeps listening. That asymmetry, a company at half speed and technology at full speed, is exactly what an attacker needs.

It is worth saying without drama. Summer's advantage is not technical. August attacks are no more sophisticated than March ones. What changes is reaction time. The person who would have noticed the odd charge is at the beach. The decision to switch off a system waits until someone from management answers the phone. And the external IT provider who serves you is on holiday too. Whoever gets into a system in August has something that is scarce the rest of the year, whole days with nobody watching.

The background does not let up. Spain's INCIBE handled 122,223 cybersecurity incidents in 2025, 26% more than the previous year. Online fraud is the category in full climb, with 45,445 cases, up 19%. The curve rises every year. The only thing that drops in August is your capacity to respond to it.

August does not bring more sophisticated attacks. It brings more time in which nobody is watching.

The reasonable answer for an SME is not round-the-clock monitoring. It is closing before you close, leaving access the way you leave the office, lights off and a key someone can find. Four checks and one morning are enough.

  1. A duty person with a name. If something goes off on 15 August, who gets the call? One person, one backup and their phone numbers on a sheet everyone can find. Without this, everything else arrives late.
  2. Two-factor on email and remote access. Email is the door almost every scam walks through, and in summer it is read on a phone, in a hurry. If the password alone opens it, that is this week's fix.
  3. Accounts of people who already left. June and July departures are the August classic, people who no longer work at the company and can still get in. Review recent leavers and confirm their access was truly closed, suppliers included.
  4. Minimum remote access. Whatever nobody will use in August, switch off. And your IT provider's permanent access, turned into access when called. That is the difference between a locked door and one left ajar.

Nothing on this list asks for budget or technical knowledge. It asks for half a morning and knowing who can get into your company, which is a business question, not an IT one. If going through it you discover that list does not exist, that is the real finding of the summer. To start fixing it we have prepared a basic guide with its joiners-and-leavers checklist, Who can get into your company.

August exposure is not decided in August. It is decided the day before you close, in a four-point list that fits on a whiteboard. Next year, that list will already exist.