Cyber security for small business: what to fix first

What the evidence says about small business cyber risk

The UK government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that 43% of businesses had identified a breach or attack in the preceding year. That included 42% of micro businesses and 46% of small businesses. Phishing was the most common type, affecting 38% of businesses overall.

The survey counts events that organisations recognised and were willing to report. It does not include every undetected event and is not a forecast for an individual business. It also found that 47% of businesses required two-factor authentication, showing that basic account protection still deserves attention.

The practical point is to start with the accounts and processes that keep your own business running. A convincing payment request or a compromised inbox can matter more to a small firm than a long list of unfamiliar technical terms.

Five basics to put in order

1. Secure your email

An inbox often provides access to password resets, invoices and customer conversations. A criminal who controls it may be able to impersonate you or use it to reach other services.

Use passkeys where the service supports them. Otherwise use a strong, unique password and multi-factor authentication. A password manager helps staff maintain different passwords for different services. Review account recovery too: the business should have a plan if the usual account owner loses a phone or is unavailable.

For a work email tenant, check enforcement rather than relying on staff having registered a second factor. Include administrator accounts and ask your IT provider about legacy sign-in methods and policy exclusions.

2. Protect the accounts that matter most

List banking, payroll, accounting, cloud storage, website hosting, domain registration and other systems you need to operate. Record the business owner, administrator and recovery route for each one.

Give people only the access their work requires. Use separate administrator access where appropriate, and review permissions when a person changes role or leaves. Include supplier accounts and guest access. Coordinate account closure with any legitimate need to retain records; removing access does not mean deleting information without a plan.

3. Keep devices and software supported

Maintain a simple inventory of work computers, phones, tablets and network equipment, including personal devices used for business. Record operating systems, support status and who is responsible for updates.

Switch on automatic updates where appropriate and confirm that updates actually install. Keep screen locks, firewalls and malware protection in place. When a device or application no longer receives security fixes, agree an upgrade, replacement or isolation plan with your IT provider.

Do not remove unfamiliar software at random. Identify its owner and purpose before making changes that could interrupt the business.

4. Test your backups

Start with the question: what would we need to resume work if an account or device became unavailable? Include documents, records and system configuration where relevant. Find out what your existing services retain, what can be restored and what depends on a separate backup.

Keep recovery arrangements sufficiently separate from the systems and accounts they protect. If an attacker compromises an administrator account, could they also delete every backup?

Run a controlled test with the system owner. Restore a representative file to a safe location and record the result. Do not overwrite live data during a trial. A successful small restore is useful evidence; it does not establish the time needed to recover every system.

5. Check unusual requests through another channel

Agree a simple rule for new payees, changed bank details and urgent payments: verify the request using a known phone number or another established channel. Do not use contact details supplied only in the suspicious message.

Make it easy to report a mistake or worrying message quickly. Staff should know who to contact if they enter a password on the wrong website, approve an unexpected sign-in or send information to the wrong person. Blame slows reporting down when speed matters.

In the UK, suspicious emails can be forwarded to report@phishing.gov.uk. Use the NCSC’s reporting guidance for details.

What AI changes

Convincing language is not proof that a message is genuine

Generative AI can help produce fluent messages, so poor spelling is an unreliable filter. The NCSC’s assessment of AI and the cyber threat describes how AI can assist malicious activity, including social engineering.

Verify the request and the authority behind it. A familiar writing style, logo or voice should not replace your payment approval process. A useful staff exercise is to walk through a fictional request to change supplier bank details and practise the verification step.

Staff need rules for business data

Establish which AI tools and account types are approved, what information staff may use and who can authorise an integration. Review the actual service terms and configuration. Consumer, business and enterprise versions of a product can have different controls and commitments.

Avoid pasting sensitive client information, passwords or confidential records into a tool without an approved basis and handling process. A short policy should explain the decision in terms staff recognise: which information, which tools and who to ask.

Our AI policy template provides a starting structure. Adapt it to the systems and information your organisation actually uses.

Connected tools make existing permissions more important

Microsoft 365 Copilot works with the permissions associated with a user’s access to organisational information. If a file is shared too widely, AI can make that information easier to find. Review sensitive sites and folders before adding more ways to retrieve them.

Also review agents and connected applications. Even without a paid Copilot add-on, users may provide uploaded or open content, and pay-as-you-go agents can access work data. Microsoft’s overview explains the different experiences.

Our Microsoft 365 security audit guide gives you specific questions for your tenant administrator. Copilot training can help staff understand the tool, alongside the technical decisions owned by your IT team.

A practical action plan

Start today

• Check how your email and important accounts use passkeys or MFA.
• Identify the person responsible for each critical system and its recovery access.
• Agree a second-channel check for changed bank details and unusual payments.
• Tell staff how to report a suspicious message or mistake.

If you use Microsoft 365, ask your administrator whether security defaults or appropriate Conditional Access policies protect the tenant. Microsoft’s security-defaults guidance explains the baseline controls. Plan changes with the administrator because sign-in policies can affect everyone.

Work through this week

• Compare active users and guests with current staff and suppliers.
• Identify devices and applications that no longer receive security fixes.
• Arrange a safe restore test and record the result.
• List AI tools, agents and integrations currently in use.
• Write down the most important unresolved questions and give each one an owner.

Build into your normal routine

• Review access when people join, move roles or leave.
• Recheck supported software, update status and backup results.
• Review important supplier access and responsibilities.
• Practise a short incident scenario: what happens if email is unavailable tomorrow?
• Review AI rules when tools, account types or connected data sources change.

Choose a review frequency that suits the importance and rate of change of the system. A one-off tidy-up will not catch new accounts and permissions indefinitely.

Where Cyber Essentials fits

Cyber Essentials is a UK government-backed scheme covering five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. It can be useful when customers require certification or when you want a defined baseline for preparation.

Certification is separate from general guidance or an informal review. Apply through IASME or a licensed certification body. The IASME FAQ explains the assessment, current fees and annual renewal. A certificate does not mean every cyber risk has been eliminated.

Use our Cyber Essentials checklist to organise scope and evidence. If you need wider questions about backups, suppliers or AI tools, our cyber security audit guide explains how to agree the scope of a broader review.

Northern Ireland and the Republic of Ireland

The NI Cyber Security Centre provides practical guidance for smaller organisations in Northern Ireland. The Irish NCSC provides guidance and incident information for the Republic of Ireland.

If personal data is involved in an incident, establish which reporting duties apply promptly. Use the relevant regulator’s guidance, such as the UK ICO or Ireland’s Data Protection Commission. Do not assume that every incident has the same reporting requirement, or that operating across the border makes the applicable rules obvious.

Know which kind of help you need

• An incident may be happening now: follow the appropriate national reporting and recovery guidance and use a suitable incident-response provider.
• You need a certificate: contact IASME or a licensed certification body.
• You need ongoing IT administration: agree responsibilities with your IT provider or managed service provider.
• You want a defined security review: establish scope, methods, provider experience, evidence handling and deliverables before commissioning it.
• You are introducing AI or Copilot: agree information access and responsibilities with your IT owner alongside the adoption work.

Blue Canvas works on AI adoption and workflows. Planning that work alongside a security review? Book a free 15-minute call to discuss the project and what needs to be agreed with your IT provider. Please do not send passwords, recovery codes or sensitive business records.

Book a free 15-minute call

FAQ

What should a small business fix first?

Start with email and important accounts, MFA, supported and updated devices, tested backups and a clear process for checking unusual payment requests. Prioritise the systems your own business needs to keep operating.

Are small businesses really a target?

Yes. The UK government’s 2025/2026 survey found that 42% of micro businesses and 46% of small businesses identified a breach or attack in the previous year. These are reported incidents, not a prediction of what will happen to any particular firm.

Has AI made phishing harder to spot?

AI can help produce convincing messages, so bad spelling is not a dependable warning sign. Verify unusual requests for money, credentials or sensitive information through a known, separate channel.

Can staff use ChatGPT or Copilot with business data?

That depends on the information, account type, service terms, settings and your organisation’s rules. Approve the tools and data uses explicitly, review connected access and give staff a clear route for questions. Do not treat every version of a product as having identical protections.

Do we need Cyber Essentials?

Check whether your customers or contracts require it and whether its defined baseline suits your needs. It covers five technical control areas; certification is a separate assessment through IASME or a licensed certification body.

Does this guide provide certification or a security audit?

No. It helps you organise practical questions and preparation. A formal review needs an agreed scope and suitable provider, and certification requires the scheme’s separate assessment process.