Practical cyber defence for the smaller guys
Most small organisations think of their domain as a web address. It is actually the front door for your email, your invoices and your reputation — and it is usually left unlocked. Here is a practical audit a non-specialist can finish in half an hour.
Every breach headline comes with a follow-up sales call, and small UK teams end up paying for dashboards nobody opens. Here are five common security purchases worth declining at renewal, with the cheaper or free control that actually moves the needle.
Scam-awareness posters don't change behaviour; a short, repeatable drill does. Here's a 15-minute exercise built around the fake courier texts, HMRC emails and Companies House impersonation attempts UK small teams actually receive.
When one person handles finance, admin and supplier calls, an urgent payment request can sound completely normal. This tabletop walks a small UK team through invoice fraud and voice cloning, then sets out the controls and first-hour steps that actually help.
Your backup dashboard will happily show green for a year while quietly failing to give you your own files back. Here's a 15-minute quarterly drill that tests the only thing that matters: whether a real person can restore a real file on a real deadline.
Cyber Essentials is a photograph of your organisation on one particular Thursday. Twelve months later, the photo is out of date, the scope has quietly changed and the badge is doing more reassuring than the controls are. Here's the unglamorous work that happens after the certificate arrives.
The 72-hour clock doesn't care that your finance director is on holiday and your IT provider is on a call queue. Here's a fill-in-the-blanks runbook for the UK GDPR reporting window, written for teams who have never had a lawyer on speed dial — including the mistakes that turn a messy Tuesday into a regulatory headache.
Outsourcing the technical work is sensible. Outsourcing the accountability is not a thing that can actually happen, no matter what the invoice suggests. A blunt look at where your MSP's scope ends, where your risk quietly begins, and the questions worth asking before the next renewal lands on your desk.
UK cyber insurers have moved from asking whether you have multi-factor authentication to asking for the screenshot, the date and the person who checked. For small organisations, the difference between a paid claim and a denied one is rarely the attack itself — it is the paperwork that did or did not exist beforehand.
You do not need a consultant or a platform licence to get the basics right. The UK has quietly built one of the better free cyber toolkits in the world, and most small organisations walk straight past it. Here are ten resources worth your time, roughly how long each takes to stand up, and the traps that stop them working.