Practical cyber defence for the smaller guys
Most small UK teams have a password vault called something like ‘Team Stuff’. It works right up until you need to know who can get into it, who owns each entry, and what happens when the person who set it up leaves. Here is a timed sweep to turn it from a dusty shared drawer into something with actual owners.
Repeated sign-in prompts are a quiet way to wear a small team down until someone taps Approve. Here is a short rehearsal, the settings worth switching on in Microsoft 365 and Google Workspace, and a helpdesk script that checks the login without making anyone feel stupid.
An AI assistant doesn't grant anyone new access — it just makes every old permission instantly searchable. Before you switch Copilot or Gemini on for the team, spend an afternoon finding the folders that should never have been open in the first place, and write a prompt policy that fits on one side of A4.
Your mobile number is probably doing more security work than anyone in the office realises: password resets, bank codes, payroll logins and that helpful 'text me a code' button. This is a calm, practical tabletop exercise for small UK teams who need to know what to do in the first hour if that number is taken over.
A shared info@ mailbox is handy until a supplier email vanishes, the password lives on a sticky note, and nobody can say who read what. Here is a calm 45-minute migration plan for UK small teams moving to named accounts, delegated access, and proper second factors.
That helpful scheduling app from lunchtime may still have the keys to your inbox. Here is a practical twenty-minute sweep for finding third-party app consents in Microsoft 365 and Google Workspace, judging which scopes are too generous, and revoking the ones nobody can defend.
Most small teams treat an old phone like a spare charger: useful one day, forgotten the next. But a retired handset can still hold email, MFA prompts and shared files, often with live sessions attached. This is a 30-minute retirement routine for UK teams with no helpdesk.
Multifunction printers are networked computers with an admin login, a web console and a hard drive that quietly hoards everyone's paperwork. Most small UK offices set them up once, never touch them again, and hand them back at the end of the lease with the data still inside. Here's a practical half-hour routine to fix that.
A work laptop or phone goes missing on a train, in a taxi or at a conference, and suddenly everyone remembers the device register was last updated in a different financial year. This is a calm, rehearsable lost-device routine for small UK teams: what to freeze, when to wipe, what to keep as evidence, and how to test the whole thing before it matters.
Business email compromise rarely arrives with a bang. It arrives as a tidy little rule that forwards invoices to an address you do not recognise and marks the originals as read. Here is how a small UK team can find those rules, read the tells, and close the door in about twenty minutes.
When a small UK organisation changes IT support, web developer or backup provider, the contract ends long before the access does. This is a practical 60-minute exit audit: map every provider login, revoke remote access, recover domain and DNS control, check RMM agents and backup consoles, and get written confirmation that the old provider is out.
Coworking and serviced offices are convenient, but shared Wi-Fi, visitors, cleaners and post rooms quietly widen your attack surface. Use this practical room-by-room review to close the gaps without an enterprise budget.
Big-client procurement teams are asking sharper security questions in 2026, and small UK teams often answer them by guesswork or copy-paste. This is a calm, repeatable way to answer honestly, back up claims with evidence, and turn the questionnaire into a sales advantage.
Most small organisations think of their domain as a web address. It is actually the front door for your email, your invoices and your reputation — and it is usually left unlocked. Here is a practical audit a non-specialist can finish in half an hour.
Every breach headline comes with a follow-up sales call, and small UK teams end up paying for dashboards nobody opens. Here are five common security purchases worth declining at renewal, with the cheaper or free control that actually moves the needle.
When one person handles finance, admin and supplier calls, an urgent payment request can sound completely normal. This tabletop walks a small UK team through invoice fraud and voice cloning, then sets out the controls and first-hour steps that actually help.
Scam-awareness posters don't change behaviour; a short, repeatable drill does. Here's a 15-minute exercise built around the fake courier texts, HMRC emails and Companies House impersonation attempts UK small teams actually receive.
Your backup dashboard will happily show green for a year while quietly failing to give you your own files back. Here's a 15-minute quarterly drill that tests the only thing that matters: whether a real person can restore a real file on a real deadline.
Cyber Essentials is a photograph of your organisation on one particular Thursday. Twelve months later, the photo is out of date, the scope has quietly changed and the badge is doing more reassuring than the controls are. Here's the unglamorous work that happens after the certificate arrives.
The 72-hour clock doesn't care that your finance director is on holiday and your IT provider is on a call queue. Here's a fill-in-the-blanks runbook for the UK GDPR reporting window, written for teams who have never had a lawyer on speed dial — including the mistakes that turn a messy Tuesday into a regulatory headache.