Small business owners often think nobody would bother attacking them. The government’s own survey suggests otherwise, although the reality is less dramatic than the headlines. Most attacks are not clever. They are automated, cheap and looking for an unlocked door. That is why some basic steps go a long way.
The short version
- 43% of UK businesses reported a cyber security breach or attack in the last 12 months, including 42% of micro and 46% of small businesses.1
- Phishing is by far the most common type.1
- Cyber Essentials is a government-backed scheme built around five technical controls.2
- Only 5% of businesses hold it, so having it can help you stand out.1
What the numbers say
The UK government’s Cyber Security Breaches Survey 2025/2026 found just over four in ten businesses, about 612,000, had experienced a breach or attack in the last 12 months.1 Phishing attacks were experienced by 38% of businesses, making them the most common and most disruptive type.1 Ransomware was far rarer, at 1% of businesses.1
It is worth being balanced here. The survey found the median perceived cost of the most disruptive breach was £0 for businesses, with most falling between £0 and £200.1 So most incidents are a nuisance rather than a disaster. A minority are far worse, however, and for a small business a serious one could mean days without email, payments or customer records.
The five controls
Cyber Essentials is built around five technical controls, designed to prevent the most common internet-based threats.2 The NCSC compares most attacks to a thief trying your front door to see if it is unlocked, and describes Cyber Essentials as making sure that door is locked.2
| Control | What the NCSC says it does | In plain English |
|---|---|---|
| Firewalls | Create a security filter between the internet and your network | Block unwanted traffic |
| Secure configuration | Set up computers securely to minimise ways in | Remove default passwords and unused software |
| Security update management | Prevent criminals using software vulnerabilities | Install updates promptly |
| User access control | Control who can access your data and services | Give people only what they need |
| Malware protection | Identify and immobilise malicious software | Stop viruses before they do harm |
The first two columns come from the NCSC, and the plain-English column is ours.2
Why get certified?
The NCSC gives three reasons: protection against the most common online threats, showing customers you take security seriously, and the fact that a growing number of organisations require suppliers to be certified to bid for work.2
Certification is still relatively rare. Only 5% of businesses hold it, up from 3%, including 12% of small businesses, up from 5%.1 More businesses, 24%, report having the five types of control in place without being certified.1 Being able to prove it may be useful when you are trying to win work from larger customers.
The scheme is delivered by IASME, which manages a network of over 400 cyber security organisations that can advise you and help you get certified.2 The NCSC also provides a free readiness tool and lets you preview the questions at no cost.2
What to do this week
You do not need to be certified to take these steps. They are our suggestions for where to start, in order of how much they reduce your risk.
- Turn on two-step sign-in for email first. With access to your email, a criminal can reset most of your other passwords.
- Use a password manager. The NCSC has guidance on password managers and passkeys for small organisations.3
- Turn on automatic updates on every phone and computer.
- Back up what you could not bear to lose, and check you can restore it. The NCSC’s small organisations guide includes backups among its core tips.3
- Teach everyone one rule about payment changes. If an email asks you to change bank details or pay urgently, ring the person on a number you already have.
- Remove old accounts. When someone leaves, close their access the same day.
Do not forget your suppliers
The survey found relatively few businesses review the risks from their suppliers: 14% looked at immediate suppliers in the previous edition.4 If your website, booking system or accounting software holds customer data, its security is part of yours. Ask suppliers simple questions: who can access our data, how do you back it up, and how would you tell us about a breach?
When something does go wrong
Decide now who you would call. Write it down somewhere you can reach even if your computers are down. If personal data is involved, you may have just 72 hours to report it to the ICO.
Security is built into how we make software, including two-step sign-in, restricted access and careful handling of customer files. If your business depends on systems or spreadsheets you worry about, our data and automation and custom software services can help. You can also read our case analyses of public incidents to see what goes wrong at a larger scale.
Sources
-
Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026, published 30 April 2026, accessed 7 November 2026. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9
-
National Cyber Security Centre, Cyber Essentials, accessed 7 November 2026. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7
-
National Cyber Security Centre, Small organisations guide to cyber security, published 9 April 2026, accessed 7 November 2026. ↩ ↩2
-
Department for Science, Innovation and Technology, Cyber security breaches survey 2025, accessed 7 November 2026. ↩
Data and automation
Less copying between systems, fewer spreadsheet errors, and reports you can believe.
See how it works