How to Protect Your Business from Cyber Threats: A Practical Guide for UK SMEs

Nearly half of UK small and medium-sized businesses suffered a cyber incident last year, according to ESET’s 2026 SMB Cyber Risk Report. The most common causes weren’t sophisticated nation-state attacks. They were phishing emails, unpatched software, and weak passwords. Things that are entirely preventable.

The uncomfortable truth: UK organisations now face an average of 1,589 cyber attack attempts every week, a 34% increase on the previous year. And the UK is currently the top European target for ransomware gangs.

Yet government data from the 2025/2026 Cyber Security Breaches Survey shows that small businesses are actually going backwards on the basics. Fewer are conducting risk assessments, maintaining formal security policies, or preparing continuity plans than they were 12 months ago.

This guide sets out the practical steps your business needs to take, in plain language, without requiring a dedicated IT security team to implement them.

Understand What You’re Protecting (and Why It Matters)

Before putting any technical controls in place, you need to know what data and systems your business relies on. This isn’t a bureaucratic exercise. It’s the foundation everything else is built on.

Start with a simple risk assessment

A basic risk assessment doesn’t require specialist software or an external consultant to complete. Ask yourself:

• What data do we hold? Customer records, financial data, employee information, contracts.
• Where is it stored? On-site servers, cloud platforms, employee laptops, mobile devices.
• Who can access it? Which staff, and do they all need the level of access they have?
• What would happen if we lost it? Could the business continue? What would the regulatory consequences be?

The National Cyber Security Centre (NCSC) recommends this kind of structured review as the starting point for any cyber security programme, regardless of business size.

Know your legal obligations

If your business holds personal data about customers, employees, or suppliers, you’re subject to UK GDPR. The Information Commissioner’s Office (ICO) requires you to keep that data secure and to report certain types of breach within 72 hours. A cyber attack that exposes personal data isn’t just a reputational problem. It can result in regulatory fines and enforcement action.

Around one in seven businesses (14%) currently hold personal data that isn’t protected by encryption or anonymisation, according to the government’s 2025/2026 survey. That’s a significant compliance gap that many owners aren’t aware of.

Secure Your Passwords and Access Controls

Weak or reused passwords remain one of the most common entry points for attackers. It’s a straightforward problem with a straightforward fix, yet it’s still responsible for a significant proportion of breaches across UK businesses.

Set a strong password policy

The NCSC recommends moving away from complex, frequently changed passwords towards longer passphrases. Three random words strung together (for example, “carpet-thunder-lamp”) are harder to crack by brute force than a short password full of special characters, and far easier for staff to remember.

Your password policy should require:

• A minimum of 12 characters for all business accounts.
• No password reuse across different services or platforms.
• No shared logins between members of staff.
• Passwords changed only when a breach is suspected, not on a fixed schedule (routine expiry actually encourages weaker choices).

Enable multi-factor authentication (MFA)

MFA requires users to verify their identity through a second method when logging in, typically an authentication app or a code sent to a mobile device. Even if a password is stolen, MFA stops an attacker from using it.

Enable MFA on every business-critical account, including:

• Business email (Microsoft 365, Google Workspace)
• Cloud storage and file sharing platforms
• Accounting and payroll software
• Any system that holds customer or financial data

A password manager makes it practical for staff to maintain unique, strong passwords across every account without the cognitive burden of remembering them all. This is one of the highest-impact, lowest-cost controls a small business can implement.

Keep Software and Devices Updated

Unpatched software is one of the most exploited vulnerabilities in small business environments. Attackers actively scan for systems running outdated software because the weaknesses are publicly known and the fixes are available. If you haven’t applied them, you’re leaving a door open.

Enable automatic updates wherever possible

Software vendors release security patches when vulnerabilities are discovered. The longer those patches go uninstalled, the greater the window of exposure. For most businesses, enabling automatic updates is the simplest and most reliable approach.

Apply this to:

• Operating systems on all computers and servers (Windows, macOS)
• Business applications including your email client, accounting software, and browsers
• Firmware on routers, firewalls, and network equipment
• Mobile devices used for work purposes

Replace unsupported systems

If any device or software in your business is no longer receiving security updates from the manufacturer, it represents an ongoing risk. Windows 10, for example, reached end of support in October 2025. Any machine still running it is no longer receiving security patches, making it a liability on your network.

Keep an inventory of your hardware and software, including version numbers and support end dates. This doesn’t need to be sophisticated. A simple spreadsheet updated annually is enough to ensure nothing slips through.

Key point: The 2026 ESET SMB report found that unpatched vulnerabilities were among the top causes of cyber incidents across UK businesses. Keeping systems current is one of the most effective controls available and one of the most consistently overlooked.

Defend Against Phishing and Social Engineering

Phishing is the single biggest cyber threat facing UK businesses with fewer than 250 employees. The UK Cyber Security Breaches Survey found that 84% of businesses that reported a breach identified phishing as the attack method. And these attacks are becoming harder to spot. Criminals now use AI tools to craft highly convincing, personalised messages that don’t look anything like the poorly written scam emails of a few years ago.

What phishing looks like today

Modern phishing attacks go well beyond fake bank emails. Your staff need to be alert to:

• Spear phishing: Targeted emails that appear to come from a known contact, supplier, or senior colleague, often requesting an urgent payment or login.
• Invoice fraud: Fake invoices or payment redirection requests that mimic genuine suppliers.
• Smishing: Phishing via text message, often impersonating delivery companies, HMRC, or banks.
• Vishing: Phone calls from individuals posing as IT support, banks, or government agencies.

Train your team regularly

A single annual training session isn’t enough. Short, regular sessions are far more effective at keeping awareness sharp. The NCSC recommends quarterly phishing simulations alongside brief monthly refreshers covering specific threats such as invoice fraud or suspicious links.

Our guide on cyber security tips to share with employees covers the key messages your team needs to hear, in language that doesn’t require a technical background to understand.

The most important thing you can do is create a culture where staff feel comfortable reporting something suspicious without fear of blame. An unreported near-miss is a missed opportunity to prevent the real thing.

Back Up Your Data Properly

Ransomware attacks lock your files and demand payment for their return. Even if you pay, there’s no guarantee you’ll get your data back. The only reliable defence is a backup that ransomware can’t reach.

Follow the 3-2-1 backup rule

The 3-2-1 rule is the recognised industry standard for backup resilience:

• 3 copies of your data in total (the original plus two backups)
• 2 different storage types (for example, an external drive and a cloud service)
• 1 copy stored offsite or in a separate cloud environment, isolated from your main network

This matters because ransomware often targets connected drives and network shares. If your backup is mapped to the same system that gets encrypted, it gets encrypted too.

Test your backups

A backup you’ve never tested is a backup you can’t trust. Schedule a restore test at least quarterly to confirm that your data can actually be recovered, and that the process is documented clearly enough for someone other than the person who set it up to follow.

Backups should cover:

• Critical business data: customer records, financial files, contracts, project data
• Email and calendar data if hosted on your own infrastructure
• System configurations for any servers or key devices, to speed up recovery after an incident

The cost of a well-structured backup solution is a fraction of the cost of a ransomware recovery. The average UK business took just over four weeks to recover from a breach in 2026, according to ESET’s research. That’s four weeks of disruption, lost revenue, and reputational damage that a solid backup could have dramatically reduced.

Secure Your Network and Devices

Your network is the infrastructure everything else runs on. Gaps here can undermine every other control you’ve put in place.

Network security essentials

At a minimum, every business should have:

• A business-grade firewall configured to block unauthorised inbound and outbound traffic. Consumer routers are not designed for business use and lack the controls needed to protect a working environment.
• A separate guest Wi-Fi network for visitors and personal devices. This keeps untrusted devices isolated from your main business systems.
• A VPN for remote workers connecting to business systems from home or public networks. Without one, data transmitted over public Wi-Fi can be intercepted.

Device security

Every device that connects to your business network is a potential entry point. Apply these controls across all company devices:

• Enable screen locks with a PIN or biometric authentication on all laptops and mobile devices.
• Enable remote wipe on company-owned phones and laptops so data can be erased if a device is lost or stolen.
• Install business-grade endpoint protection (antivirus and anti-malware) and keep it updated.
• Create a clear BYOD policy if staff use personal devices for work, setting out minimum security requirements.

Apply least-privilege access

Not every member of staff needs access to every system. The principle of least privilege means giving people access only to the systems and data their role requires. Review permissions whenever someone changes role or leaves the business. Former employees with active credentials are a common and avoidable risk.

Have a Plan for When Things Go Wrong

Prevention is essential, but no set of controls is 100% effective. The businesses that recover quickly from a cyber incident are the ones that planned for it before it happened.

Only 25% of UK businesses have a formal incident response plan in place, according to the government’s 2025/2026 survey. Among micro businesses, that figure drops to 21%. This means the majority of small businesses would be improvising their response in the middle of a crisis.

What an incident response plan should cover

Your plan doesn’t need to be lengthy. It needs to be clear, practical, and accessible to the people who’ll need it. It should address:

• Who is responsible for leading the response, and who covers that role if they’re unavailable.
• How to isolate affected systems to prevent the incident from spreading.
• Who to notify: your IT provider, your insurer, affected customers, and if personal data is involved, the ICO within 72 hours.
• How to restore operations using your backups, and in what priority order.
• How to communicate with staff, customers, and suppliers during the disruption.

Test the plan at least once a year. A tabletop exercise where key staff talk through a hypothetical scenario is enough to identify gaps before a real incident exposes them.

Our guide to building a cyber security prevention plan walks through the five steps every business should take to get a plan in place.

Consider Cyber Essentials certification

Cyber Essentials is a government-backed scheme that certifies businesses against a set of foundational security controls. Only 12% of UK businesses currently hold the certification, despite it being one of the clearest signals to customers, partners, and insurers that your security posture is sound. The self-assessment version costs under £500 and is a practical starting point for any SME.

A Practical Cyber Security Checklist for UK SMEs

Use this as a starting point to assess where your business currently stands. It covers the foundational controls every SME should have in place.

Risk and compliance

• Completed a basic data and systems risk assessment
• Identified all personal data held and confirmed it is protected
• Reviewed and documented who has access to what

Passwords and access

• Strong password policy in place across the business
• Multi-factor authentication enabled on all critical accounts
• Password manager deployed for staff

Software and devices

• Automatic updates enabled on all operating systems and applications
• Inventory of hardware and software maintained, with end-of-support dates noted
• Business-grade endpoint protection installed and up to date

Network security

• Business-grade firewall in place
• Guest Wi-Fi network separate from the main business network
• VPN available for remote workers

Backups

• 3-2-1 backup strategy in place for all critical data
• Backups tested at least quarterly
• Recovery process documented

People and process

• Staff trained on phishing and social engineering threats
• Clear process for reporting suspicious activity
• Incident response plan documented and tested
• Cyber Essentials certification achieved or in progress

When to Bring in External Support

Most small businesses don’t have a dedicated IT security team, and they don’t need one. But they do need someone responsible for keeping the basics in place and responding when something goes wrong.

The 2026 ESET research found that 86% of UK SMBs don’t outsource any part of their cyber security responsibilities, despite a majority acknowledging they lack the in-house skills to manage it effectively. That’s a significant gap between the risk businesses face and the resource they’re committing to address it.

A managed IT provider with security expertise can take on the monitoring, patching, backup management, and incident response that most small businesses struggle to maintain consistently on their own. The value isn’t just in the technical capability. It’s in having someone who knows your systems, responds quickly when something goes wrong, and keeps your defences current as the threat landscape evolves.

If you’d like to discuss how we can help your business build a more resilient security posture, get in touch with the ECL team. We work with businesses across Essex and the wider UK to put practical, proportionate cyber security measures in place, without the jargon.