Small businesses should start by analyzing what data they have and who has access to the data, he said, drawing the parallel between that exercise at work and what a homeowner might do, such as photographing valuables in case there is a burglary. If it is difficult for security or IT people to persuade company owners to invest in analysis and prevention, he suggests drawing a cost-benefit analysis.