A Cyber Security Awareness Month guide for C2S members from Nick Rowntree, Director of System 15, an IT support and cyber security expert.

You don’t have to be a big business to be a target.

The first step to avoiding a cyber-attack is recognising your business, no matter how small, is a target.

It’s easy to assume cyber criminals only go after household names and large corporations. But the government’s latest Cyber Security Breaches Survey (published April 2026) says otherwise.

43% of businesses experienced a cyber breach or attack in the past 12 months. While larger businesses were hit more often (69%), medium-sized businesses were second (65%) but small (46%) and Micro (42%) aren’t far behind- and the numbers of incidents reported for SMEs are increasing.

Why smaller businesses are in the firing line

Most cyber-attacks aren’t hand-picked. While headline-grabbing whale-phishing or spear-phishing – which aims for specific organisations or individuals are becoming more sophisticated, in general, cyber-criminals use automated tools to scan for weak passwords, unpatched software and exposed systems, and then using generative AI send convincing phishing emails in bulk. They don’t check how many employees you have first.

Smaller businesses can also be easier to break into. They often have fewer dedicated cyber security resources, fewer staff, covering multiple roles and often spend less time covering off basic cyber hygiene measures, including fewer risk assessments, formal security policies and business continuity plans.

Meanwhile, the impact of these attacks is real, highly disruptive and growing. The share of breached businesses reporting a loss of revenue or share value rose from 2% to 5%. For a small business, a few days of disruption, a damaged reputation and a costly restoration bill can be harder to absorb compared to a larger counterpart.

The good news is that most cyber-attacks can be prevented with good basics. Applied consistently, and backed by regular staff training, they can significantly reduce your risk.
 
Here are the five we advise clients to start with:

1. Turn on multi-factor authentication (MFA)

If you only do one thing this year, make it this.

MFA lowers the risk of an account being compromised by 99.2%

MFA asks for a second proof of identity on top of your password, such as a prompt in an authenticator app, a hardware key or a biometric scan. If a criminal steals or guesses a password, they still can’t get in without that second factor.

Switch it on for everything you can; email, Microsoft 365, cloud storage, finance systems and remote access, and don’t make exceptions for senior staff, who are often the most valuable targets. Where possible, choose app-based or hardware MFA methods over text messages, as they’re harder to intercept.

2. Use strong, unique passwords (and a password manager)

While MFA is your safety net, good passwords still matter. Weak and reused passwords, especially across personal and professional devices remain one of the easiest ways into a business. If one account is leaked in a breach, criminals will try the same details across email, cloud services and banking.

The National Cyber Security Centre recommends long passwords made from three random words, which are easier to remember and harder to crack than short, complicated ones. A business password manager such as Keeper takes care of the rest, generating and storing a unique password for every account so nobody has to reuse one or write it down. And please, no passwords (or passwords1) on sticky notes stuck to monitors!

3. Keep software and devices up to date

Out of date patches account for more than 60% of all data breaches.

Software updates often contain fixes for security flaws that attackers already know about. Every day a patch is delayed is another day criminals use to try and exploit it.

Automate updates wherever you can, and don’t forget the things that are easy to overlook: servers, firewalls and routers, laptops that rarely come into the office, and browser plugins.

Hardware that no longer receives security updates or accounts that are no longer used should be replaced or archived because it’s a hidden risk no matter how well they still work.

4. Train your people

Sadly, phishing, the most common route into a business doesn’t target software, it preys on human behaviour.  It affects 38% of UK businesses, and when it works, it’s particularly painful, as 69% of affected businesses rated it the most disruptive type of breach or attack.

Your team can be your strongest defence, but also your single point of weakness, unless they know what to look for and you have secondary checks in place.

Regular awareness training with simulated phishing emails and clear guidance on reporting suspicious messages builds good habits that can make the difference when it’s the last call of a busy week or an email asking for urgent payment as the finance controller shuts down for a holiday.

It’s also important to make reporting suspicious activity easy and blame-free, so staff speak up quickly rather than hoping nobody noticed.

5. Back up your data, and check your restoration process

Do you know what would be restored in the event of a breach, or do you just hope it will be ok if you switch your machine off and on?

No defence is perfect, which is why backups matter. If ransomware encrypts your files, a device fails or someone deletes something important, a recent clean backup lets you recover your essential information.

Keep copies in more than one place, including off-site or in the cloud, and protect them with encryption and separate access.

Remember that Microsoft 365 data such as email, SharePoint, OneDrive and Teams needs backing up too. Most importantly, test your restoration process regularly, because too many small businesses only discover their backups don’t work when they really need them.

Get the foundations right with Cyber Essentials

These five steps are the foundations of good cyber security, and Cyber Essentials is a practical way to put them in place and prove it. Cyber Essentials is a government-backed certification, that is designed to demonstrate you have good security practice and that you are protected against the most common attacks.

Working towards certification means securing user accounts and access (including MFA and password controls), keeping software and devices patched, and protecting your devices and network. It also gives your customers, insurers and supply chain partners confidence that you take cyber security seriously.

Find out where you’re exposed, free

Not sure where your business stands? Our free cyber security review checks the areas where your business is most likely to get caught out and gives you a clear action plan to help close the gaps, with no obligation.Book your free cyber security review