Cybersecurity Risks for Small Businesses and Cheap Fixes

Cybersecurity risks for small businesses are mostly ordinary: a stolen email password, a laptop that has not been updated, a supplier with access to your files, or one person who holds every administrator login. They are ordinary because small firms usually have no IT team, a limited budget and a lot of trust.

That is also encouraging. The cheapest controls address the most common problems, and none needs a security department. This guide covers the risks that are specific to small organisations and what to do about them, in order of cost and impact.

Survey figures come from the Cyber Security Breaches Survey 2025/2026 (DSIT and DCMS, April 2026), the latest edition as at October 2026.

Why small businesses are exposed

Attackers rarely pick small firms by name. Most attacks are automated: mass phishing, password guessing against exposed logins and scans for unpatched software. Size does not filter them out.

The survey data bears this out. In the 2025/2026 edition, 42% of micro businesses (fewer than 10 staff) and 46% of small businesses reported a breach or attack in the previous 12 months, against 43% across all businesses. Phishing was the most common type, affecting 38% of businesses overall.

Small firms also have less to fall back on. Only 21% of micro businesses had a formal incident response plan, compared with 57% of medium businesses. When something goes wrong, the first decisions are made under stress, without a plan.

Resources are the real gap. Many small firms rely on a part-time contractor, a willing colleague or a family member for IT, and none of them is watching alerts at night or checking whether updates have installed.

The consequences can be disproportionate too. A week without email or invoicing is a minor interruption for a large organisation with several sites and a spare team. For a ten-person firm it can threaten cash flow.

The risk of one person holding the admin keys

In many small firms, one individual set up Microsoft 365, the domain, the website and the broadband, and they alone know how to get back in. That person may be an office manager, a director or an outside contractor.

This is a business continuity risk as much as a security risk. If they are ill, leave on bad terms or lose their own account to phishing, the firm has no recovery route. A single compromised administrator account also gives an attacker everything at once.

Smaller firms also tend to share logins for convenience, such as one account for the website, social media or an accounting package. Shared credentials mean nobody can tell who did what, and nobody notices when a leaver still has access.

Fixes are inexpensive:

• Keep at least two named administrators, and a sealed emergency account with a long unique password stored offline.
• Use separate admin accounts for admin tasks, not the account used to read email daily.
• Record who owns the domain registration, DNS, Microsoft 365 tenant and website hosting, and make sure the business, not an individual, is the registered owner.
• Remove access on the day someone leaves, using a short written checklist.

If an outside provider holds your credentials, read our guidance on what to do when an IT provider will not hand over admin access.

Free tools, personal accounts and shadow IT

Free tools are not the problem. The risk is unmanaged ones: file-sharing accounts opened with a personal email address, free PDF converters, browser extensions and consumer messaging apps used for client documents.

When data sits in an account the business does not control, it cannot be backed up, audited or removed when someone leaves. Free versions also tend to lack the protections that business plans include, such as audit logs and admin controls.

Review the list twice a year. Ask each team what they actually use, and move anything that holds client or financial data into an approved tool rather than banning it outright, which usually just drives it out of sight.

A practical rule is to keep a one-page list of approved tools for email, file storage, messaging and password management, and to say plainly that client data stays inside them. If your firm already pays for Microsoft 365, most needs are covered by what you own. Our Microsoft 365 support team often finds that licences already include security features that nobody has switched on.

Supplier risk and personal devices

Suppliers. Accountants, bookkeepers, marketing agencies and software vendors often hold copies of your data or have access to your systems. The survey found that 15% of businesses reviewed the risks posed by their immediate suppliers. For a small firm, a short check is enough: does the supplier use multi-factor authentication, where is your data held, and how will they tell you about a breach? See our analysis of supply chain breaches for how these links are abused.

Personal devices. Staff phones and home laptops are convenient, and they are rarely updated by anyone but the owner. The Cyber Essentials requirements (version 3.3, April 2026) put personal devices that access organisational data or services in scope, so they cannot be ignored if you certify.

Minimum rules for personal devices: a screen lock, automatic updates switched on, no shared family profiles for work data, and the ability to remove business data from a lost phone. A mobile device management tool such as Intune does this at scale. Even without one, a written policy that staff sign gives you something to enforce.

Cybersecurity risks for small businesses: the cheapest controls

The NCSC Small Business Guide is written for firms without specialists. It organises advice around five areas, and each maps to a specific risk.

Start with multi-factor authentication on email and any account that touches money or client data. Then switch on automatic updates, test one restore from backup, and agree a rule that bank detail changes are confirmed by phone on a known number.

The DSIT survey shows where firms fall short: 74% of businesses had a password policy but only 47% used two-factor authentication. Our cyber security for small business page covers what a managed service adds beyond these basics.

Cyber Essentials and the link to insurance

Cyber Essentials is the NCSC-backed scheme built around five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC Cyber Essentials overview says certification starts at £320 plus VAT, priced by organisation size, and that Cyber Essentials Plus adds independent technical testing.

For a small firm it works as a ready-made scope of work. It tells you what to fix, and the certificate is increasingly requested by customers and tenders. See our Cyber Essentials requirements checklist and Cyber Essentials cost guide, or have us handle the process through our Cyber Essentials service.

On insurance, the NCSC page notes that UK organisations with a turnover under £20 million that certify their whole organisation automatically receive cyber liability insurance arranged by IASME, including incident response support. Terms and exclusions apply, so read the policy. How policies differ and what insurers ask for is a separate subject from risk reduction.

A sensible first 30 days

If you do nothing else this month, work through this order.

• Week 1: list your administrators, domain, Microsoft 365 tenant and key suppliers. Add a second administrator.
• Week 2: turn on multi-factor authentication for email and finance systems.
• Week 3: enable automatic updates on every device, retire anything that no longer receives them, and test a restore.
• Week 4: hold a 30-minute session on spotting scams and write a one-page plan for who to call if something goes wrong.

A small business IT support partner can run these steps with you, and managed IT support keeps them from slipping once the first month is over.

Conclusion

The cybersecurity risks for small businesses are well understood and largely preventable: weak email security, unmanaged devices, one person holding every key and suppliers nobody has asked questions of. Fixing them costs time more than money, and most of the work is a one-off set-up followed by light, regular checks. Small gains stack up quickly when none of the basics are in place.

Work through the NCSC guide's five areas, consider Cyber Essentials as your checklist, and write down who can do what. For help setting priorities, talk to NetMonkeys about a practical small business security plan.

Frequently Asked Questions (FAQs)