If you run a small business, cyber security can easily fall down the to-do list. You’re busy serving customers, managing staff and keeping the day-to-day work moving. Unless you have an IT team, protecting systems may not feel like your job.
And when a major cyber attack makes the news, it’s often a household name that’s affected. It’s understandable to think criminals are interested in bigger organisations, and that a small firm like yours is unlikely to attract attention.
The difficulty is that many attacks don’t begin with someone choosing a business because of its name or size. Automated tools look for exposed systems and weak points. Fraudsters send large volumes of emails and wait for a response. They’re looking for opportunity, not a particular company profile.
Small Businesses Are Part Of The Picture
The UK Government’s Cyber Security Breaches Survey 2025 found that 43% of UK businesses had identified a cyber security breach or attack in the previous 12 months. That’s an estimated 612,000 businesses.
The figures also show that cyber incidents aren’t limited to large organisations. Half of small businesses, those with 10 to 49 employees, reported a breach or attack. Among micro businesses with 1 to 9 employees, the figure was 41%. Large businesses reported a higher rate, at 74%, but the small-business figures are still substantial.
These figures cover identified incidents, not just successful attacks that made the news. Phishing was the most common type reported. It affected 85% of businesses that had experienced a breach or attack.
The survey distinguishes between a breach or attack and a cyber crime. The latter is a narrower category. It found that an estimated 25% of small businesses had experienced at least one cyber crime in the previous year.
That doesn’t mean every small business is under constant attack. It does mean that being small isn’t a dependable form of protection.
Why Criminals Look For Opportunity
Many cyber attacks are automated. Criminals use tools to scan for common weaknesses, such as exposed remote access, outdated software or accounts without effective protection. These tools don’t need to know whether a business has 5 employees or 5,000. They look for a way in.
Other attacks rely on people and everyday business processes. A convincing email might ask an employee to open an attachment, share a password or pay an invoice. A fraudster may impersonate a supplier or senior colleague and ask for a change to bank details.
The aim is often practical: access an account, redirect a payment, steal data or disrupt work. Criminals may follow the money or look for an easy opportunity. A smaller organisation can be attractive if it has useful information, makes regular payments or lacks basic safeguards.
The effect doesn’t have to be dramatic to be disruptive. Losing access to email, files or accounting systems can delay orders, payments and customer replies. Even a phishing email that doesn’t succeed can take staff time to investigate and report.
Common Risks In Everyday Work
Weak or reused passwords can leave several accounts exposed if one password is guessed or stolen.
No multi-factor authentication (MFA) means a password may be all that stands between a criminal and an important account.
Unpatched software may leave known weaknesses open for attackers to exploit.
Untested backups may not help when you need to restore files after accidental deletion, equipment failure or ransomware.
Limited staff awareness can make it harder to spot suspicious links, unexpected attachments or urgent payment requests.
Relying on antivirus alone can leave gaps. Antivirus is useful, but it doesn’t replace updates, MFA, secure backups or careful account management.
A Small Business Can Be Reached Through A Partner
Your business may not be the first organisation an attacker approaches. They may try to reach you through a supplier, service provider or another trusted contact.
For example, a compromised email account could be used to send a convincing invoice to a customer. Or an attacker could misuse access that a third party has to your systems. This is one reason not to assume that a supplier’s size or reputation removes the need to ask sensible security questions.
The 2025 survey found that just 14% of businesses formally reviewed the cyber security risks posed by their immediate suppliers, and 7% reviewed their wider supply chain. For small businesses, the figures were 21% and 11% respectively.
You don’t need a complex supplier audit to make a start. Know which providers can access your systems or hold your data. Check that access is still needed, and ask how they manage security and report incidents.
Practical Steps That Make A Difference
You don’t need to build a large IT department to improve your security. Start with the accounts and systems your business depends on most, such as email, online banking, payroll, cloud storage and your website.
The National Cyber Security Centre’s guidance for small organisations sets out practical steps. You can use it to work through your arrangements at a manageable pace.
Use unique passwords. A password manager can help you create and store different passwords for each account. Use passkeys where available.
Turn on MFA. This adds another check when someone signs in. Start with email, banking, payroll and administrator accounts.
Install updates. Keep computers, phones, apps and routers up to date. Updates often fix known security weaknesses.
Back up important information. Keep backups protected from everyday access, and test that you can restore files from them.
Help staff spot and report suspicious messages. Make it clear that staff should check unusual requests, especially changes to bank details or urgent payment instructions. Verify these through a known phone number, not the contact details in the message.
Limit access. Give each person access to the systems and information they need for their role. Remove accounts promptly when someone leaves.
Consider Cyber Essentials As A Baseline
Cyber Essentials is a UK Government-recommended certification for organisations of all sizes. It focuses on 5 technical areas: firewalls, secure configuration, security updates, user access control and malware protection.
Certification won’t remove every cyber risk, and it isn’t a substitute for staff awareness or reliable backups. It can, however, give you a clear baseline to work towards and help demonstrate to customers that you take security seriously. Some organisations also require suppliers to hold certification.
We provide support with Cyber Essentials certification, including a readiness check and help working through the assessment. The right approach depends on your systems, your customers’ requirements and your budget.
Security Should Fit The Business
There’s no need to buy every security product on the market. Start by understanding what you rely on, what would be difficult to recover and where basic protections are missing. A considered plan can make better use of your budget than reacting to every new warning or sales message.
If you’re not sure where to begin, we can help you review your set-up and identify practical next steps. Our cyber security support is tailored to your needs, whether you want advice on one area or ongoing support.
We’re based in Seaton Burn and work with businesses in Newcastle, Northumberland, Durham and across the wider UK. You’re welcome to have a free, no-obligation conversation with us about your current arrangements. Call 0191 691 3300: we’ll listen first and help you decide what makes sense for your business.