Cyber threats remain a significant issue for small businesses. The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43% of businesses identified a cyber breach or attack in the previous 12 months, including 46% of small businesses and 65% of medium businesses. The practical response is to focus on strong everyday security controls and keep them maintained.
1. Treat Phishing as Your Biggest Risk — Because It Is
Phishing is behind the vast majority of cyber incidents affecting small businesses, and in 2026 those emails are increasingly convincing, often crafted with AI. If your team can’t spot a well-written phishing attempt, your technical defences don’t matter much. Run a phishing simulation, see who clicks, and use it as a no-blame learning opportunity. Free tools exist — you don’t need a big budget to start.
2. Get Cyber Essentials Certified
Cyber Essentials is a UK government-backed certification that covers five basic security controls every business should have in place. It’s not just a badge — certified organisations suffered significantly lower breach costs last year. It also increasingly comes up in supplier and procurement questionnaires, so it’s becoming a commercial advantage as much as a security one. Costs start from a few hundred pounds.
3. Turn On MFA — Everywhere, Not Just Email
Multi-factor authentication blocks the vast majority of automated credential attacks, and it’s free on most platforms. Most businesses have it switched on for email but forget about their accounting software, CRM, or remote access tools. Go through every system your team logs into and make sure MFA is enabled across the board. It takes minutes and makes stolen passwords far less useful to attackers.
4. Lock Down Your Microsoft 365 Settings
If your business is on Microsoft 365, the default settings out of the box leave gaps that attackers know how to exploit. Make sure MFA is enforced for every user, old-style authentication methods are blocked, and you know who has admin access. If you set it up a few years ago and haven’t looked at it since, it’s worth a review — a lot may have changed.
5. Check Your Backup Actually Works
Having a backup is one thing. Knowing it works is another. If you cannot remember the last time you tested a restore, schedule one this month. Cloud backups, local backups or a combination of both are only useful if you can restore from them successfully.
6. Review Who Has Access to What
People change roles, move on, or leave entirely — but their logins often stay active. Take some time to go through user accounts across your key systems. Remove old accounts, pull back access that’s no longer needed, and make sure admin rights are only held by the people who genuinely need them. It’s one of the easiest wins in security and one of the most overlooked.
7. Don’t Let Old Software Be the Open Door
Unpatched software remains a common security risk. Standard support for Windows 10 ended on 14 October 2025. Eligible organisations can use Microsoft’s Extended Security Updates (ESU) programme while completing their migration, but Windows 10 devices should still be identified and have a clear upgrade, replacement or ESU plan. Keep supported systems patched and review anything that is out of date or no longer receiving security updates.
8. Write Down What You’d Do If Something Went Wrong
If your systems were hit tonight, who would you call? What would you do first? Most small businesses have a rough plan in someone’s head but nothing written down. Even a single page covering who to contact, how to isolate affected machines, and how to access your backups makes an enormous difference when things get chaotic. You don’t need a 40-page document — just something your team can follow under pressure.
9. Don’t Assume You’re Too Small to Be Targeted
Attackers don’t manually pick their victims — automated tools scan the internet constantly looking for weak passwords, unpatched systems, and open doors. Small businesses are attractive precisely because they tend to have fewer defences. If you’ve been operating on the assumption that you’re not interesting enough to attack, it’s worth revisiting that view.
10. Make Cybersecurity Someone’s Responsibility
In small businesses, security often belongs to everyone — which in practice means it belongs to no one. Assign one person ownership of the basics: checking backups, reviewing accounts, making sure updates are being applied. It doesn’t need to be a full-time role, just someone with a simple checklist and the time to work through it regularly.
Not Sure Where to Start?
If any of this highlights an issue, we can help. ML Services can review your current setup or carry out a full IT health check and give you a clear view of what needs attention.
Get in touch today to talk to us about your IT.
ML Services (Sussex) Ltd — Practical IT support for small businesses across Sussex and beyond.