Practical cyber defence for the smaller guys
Hiring brings CVs, links, right-to-work scans and personal data into a small team's inbox faster than anyone can process it. This is a practical routine for keeping applicant files contained, spotting nasty attachments and clearing candidate data on a timetable you can actually keep.
A move is rarely just furniture. It quietly reshuffles keys, codes, post and supplier records. This is the practical check for small UK teams who want the old office closed properly before the new one opens.
A QR code stuck to a café table feels harmless until someone peels it back and finds another code underneath. Here’s a practical sticker sweep for UK cafés, clinics and other small venues, plus the staff escalation steps and printing policy that stop a quiet swap turning into a customer phishing incident.
Most small UK teams configured their video-call settings once, during a rushed onboarding, and haven't looked since. This is a practical fifteen-minute audit of waiting rooms, passcodes, screen-share rights and recording notices across Zoom, Teams and Google Meet — plus a simple outsider test you can run from a phone.
That little router in the cupboard is often running one flat network for staff, visitors, printers and the till. This is a plain-English twenty-minute check for small UK offices: admin passwords, guest isolation, firmware, WPS and the guest password everyone knows.
Most small teams think about firewalls and phishing, then tip a decade of office clutter into a wheelie bin without a second glance. This is a practical thirty-minute audit for paper, old kit, branded tat and unwanted post — plus the wipe-or-destroy basics and a simple leave-the-building checklist that works when nobody owns facilities.
Cancelling a SaaS tool is a billing event, not a security event. This 30-minute exit check helps small UK teams export what matters, revoke integrations, close admin routes and keep a record that stands up to UK GDPR accountability.
Recruitment ads are written for candidates, but they're published to the open web and read by people who will never apply. Here's a twenty-minute routine — browser and a spreadsheet, nothing else — for finding the free reconnaissance in your own job posts and rewriting it without making the role impossible to fill.
Auto-replies, voicemail greetings and shared calendars are supposed to help colleagues, not strangers. But a rushed away message can hand an attacker your travel dates, your cover contact and a named person to impersonate. Here's a quick audit and a set of templates that keep the handover useful without doing reconnaissance for fraudsters.
UK funders have started asking small charities for evidence of basic cyber governance, not a certificate on the wall. Here is a one-page pack you can assemble in 45 minutes — owner, assets, backups, incident route, training — with wording that does not oversell.
Most small UK teams have a password vault called something like ‘Team Stuff’. It works right up until you need to know who can get into it, who owns each entry, and what happens when the person who set it up leaves. Here is a timed sweep to turn it from a dusty shared drawer into something with actual owners.
Repeated sign-in prompts are a quiet way to wear a small team down until someone taps Approve. Here is a short rehearsal, the settings worth switching on in Microsoft 365 and Google Workspace, and a helpdesk script that checks the login without making anyone feel stupid.
An AI assistant doesn't grant anyone new access — it just makes every old permission instantly searchable. Before you switch Copilot or Gemini on for the team, spend an afternoon finding the folders that should never have been open in the first place, and write a prompt policy that fits on one side of A4.
Your mobile number is probably doing more security work than anyone in the office realises: password resets, bank codes, payroll logins and that helpful 'text me a code' button. This is a calm, practical tabletop exercise for small UK teams who need to know what to do in the first hour if that number is taken over.
A shared info@ mailbox is handy until a supplier email vanishes, the password lives on a sticky note, and nobody can say who read what. Here is a calm 45-minute migration plan for UK small teams moving to named accounts, delegated access, and proper second factors.
That helpful scheduling app from lunchtime may still have the keys to your inbox. Here is a practical twenty-minute sweep for finding third-party app consents in Microsoft 365 and Google Workspace, judging which scopes are too generous, and revoking the ones nobody can defend.
Most small teams treat an old phone like a spare charger: useful one day, forgotten the next. But a retired handset can still hold email, MFA prompts and shared files, often with live sessions attached. This is a 30-minute retirement routine for UK teams with no helpdesk.
Multifunction printers are networked computers with an admin login, a web console and a hard drive that quietly hoards everyone's paperwork. Most small UK offices set them up once, never touch them again, and hand them back at the end of the lease with the data still inside. Here's a practical half-hour routine to fix that.
A work laptop or phone goes missing on a train, in a taxi or at a conference, and suddenly everyone remembers the device register was last updated in a different financial year. This is a calm, rehearsable lost-device routine for small UK teams: what to freeze, when to wipe, what to keep as evidence, and how to test the whole thing before it matters.
Business email compromise rarely arrives with a bang. It arrives as a tidy little rule that forwards invoices to an address you do not recognise and marks the originals as read. Here is how a small UK team can find those rules, read the tells, and close the door in about twenty minutes.