A man-in-the-middle attack means traffic passes through an untrusted point where it can be observed, redirected, or tampered with. For small businesses, the practical concern is usually unsafe Wi-Fi, rogue access points, unmanaged devices, or staff working from locations the business does not control.
Modern HTTPS and cloud apps reduce a lot of old interception risk, but they do not remove every issue. Staff can still be led to fake portals, prompted by captive networks, exposed through unmanaged devices, or tricked into trusting the wrong network.
The “middle” is any network position between the user and the service they meant to reach. That could be a fake Wi-Fi network, an unsafe guest network, a compromised router, or a malicious hotspot portal.
The goal for defenders is to make trusted paths easy and risky paths obvious. Managed devices, secure Wi-Fi, browser updates, certificate warnings, and clear staff guidance all help.
A consultant working from a cafe, a clinic employee using guest Wi-Fi, or a law clerk travelling between client sites may all connect through networks the business does not manage. If the device is unmanaged or users ignore browser warnings, credentials and sessions become harder to protect.
The impact is often identity-related: fake login pages, session exposure, or staff trusting the wrong portal. That is why this topic connects closely to MFA, Conditional Access, compliant devices, and phishing protection.
We can review accounts, endpoints, remote access, and backup readiness against this guide.