Practical cyber defence for the smaller guys
Business email compromise rarely arrives with a bang. It arrives as a tidy little rule that forwards invoices to an address you do not recognise and marks the originals as read. Here is how a small UK team can find those rules, read the tells, and close the door in about twenty minutes.
When a small UK organisation changes IT support, web developer or backup provider, the contract ends long before the access does. This is a practical 60-minute exit audit: map every provider login, revoke remote access, recover domain and DNS control, check RMM agents and backup consoles, and get written confirmation that the old provider is out.
Big-client procurement teams are asking sharper security questions in 2026, and small UK teams often answer them by guesswork or copy-paste. This is a calm, repeatable way to answer honestly, back up claims with evidence, and turn the questionnaire into a sales advantage.
Coworking and serviced offices are convenient, but shared Wi-Fi, visitors, cleaners and post rooms quietly widen your attack surface. Use this practical room-by-room review to close the gaps without an enterprise budget.
Most small organisations think of their domain as a web address. It is actually the front door for your email, your invoices and your reputation — and it is usually left unlocked. Here is a practical audit a non-specialist can finish in half an hour.
Every breach headline comes with a follow-up sales call, and small UK teams end up paying for dashboards nobody opens. Here are five common security purchases worth declining at renewal, with the cheaper or free control that actually moves the needle.
Scam-awareness posters don't change behaviour; a short, repeatable drill does. Here's a 15-minute exercise built around the fake courier texts, HMRC emails and Companies House impersonation attempts UK small teams actually receive.
When one person handles finance, admin and supplier calls, an urgent payment request can sound completely normal. This tabletop walks a small UK team through invoice fraud and voice cloning, then sets out the controls and first-hour steps that actually help.
Your backup dashboard will happily show green for a year while quietly failing to give you your own files back. Here's a 15-minute quarterly drill that tests the only thing that matters: whether a real person can restore a real file on a real deadline.
Cyber Essentials is a photograph of your organisation on one particular Thursday. Twelve months later, the photo is out of date, the scope has quietly changed and the badge is doing more reassuring than the controls are. Here's the unglamorous work that happens after the certificate arrives.
The 72-hour clock doesn't care that your finance director is on holiday and your IT provider is on a call queue. Here's a fill-in-the-blanks runbook for the UK GDPR reporting window, written for teams who have never had a lawyer on speed dial — including the mistakes that turn a messy Tuesday into a regulatory headache.
Outsourcing the technical work is sensible. Outsourcing the accountability is not a thing that can actually happen, no matter what the invoice suggests. A blunt look at where your MSP's scope ends, where your risk quietly begins, and the questions worth asking before the next renewal lands on your desk.
You do not need a consultant or a platform licence to get the basics right. The UK has quietly built one of the better free cyber toolkits in the world, and most small organisations walk straight past it. Here are ten resources worth your time, roughly how long each takes to stand up, and the traps that stop them working.
UK cyber insurers have moved from asking whether you have multi-factor authentication to asking for the screenshot, the date and the person who checked. For small organisations, the difference between a paid claim and a denied one is rarely the attack itself — it is the paperwork that did or did not exist beforehand.