Practical cyber defence for the smaller guys
That helpful scheduling app from lunchtime may still have the keys to your inbox. Here is a practical twenty-minute sweep for finding third-party app consents in Microsoft 365 and Google Workspace, judging which scopes are too generous, and revoking the ones nobody can defend.
Most small teams treat an old phone like a spare charger: useful one day, forgotten the next. But a retired handset can still hold email, MFA prompts and shared files, often with live sessions attached. This is a 30-minute retirement routine for UK teams with no helpdesk.
Multifunction printers are networked computers with an admin login, a web console and a hard drive that quietly hoards everyone's paperwork. Most small UK offices set them up once, never touch them again, and hand them back at the end of the lease with the data still inside. Here's a practical half-hour routine to fix that.
A work laptop or phone goes missing on a train, in a taxi or at a conference, and suddenly everyone remembers the device register was last updated in a different financial year. This is a calm, rehearsable lost-device routine for small UK teams: what to freeze, when to wipe, what to keep as evidence, and how to test the whole thing before it matters.
Business email compromise rarely arrives with a bang. It arrives as a tidy little rule that forwards invoices to an address you do not recognise and marks the originals as read. Here is how a small UK team can find those rules, read the tells, and close the door in about twenty minutes.
When a small UK organisation changes IT support, web developer or backup provider, the contract ends long before the access does. This is a practical 60-minute exit audit: map every provider login, revoke remote access, recover domain and DNS control, check RMM agents and backup consoles, and get written confirmation that the old provider is out.
Coworking and serviced offices are convenient, but shared Wi-Fi, visitors, cleaners and post rooms quietly widen your attack surface. Use this practical room-by-room review to close the gaps without an enterprise budget.
Big-client procurement teams are asking sharper security questions in 2026, and small UK teams often answer them by guesswork or copy-paste. This is a calm, repeatable way to answer honestly, back up claims with evidence, and turn the questionnaire into a sales advantage.
Most small organisations think of their domain as a web address. It is actually the front door for your email, your invoices and your reputation — and it is usually left unlocked. Here is a practical audit a non-specialist can finish in half an hour.
Every breach headline comes with a follow-up sales call, and small UK teams end up paying for dashboards nobody opens. Here are five common security purchases worth declining at renewal, with the cheaper or free control that actually moves the needle.
When one person handles finance, admin and supplier calls, an urgent payment request can sound completely normal. This tabletop walks a small UK team through invoice fraud and voice cloning, then sets out the controls and first-hour steps that actually help.
Scam-awareness posters don't change behaviour; a short, repeatable drill does. Here's a 15-minute exercise built around the fake courier texts, HMRC emails and Companies House impersonation attempts UK small teams actually receive.
Your backup dashboard will happily show green for a year while quietly failing to give you your own files back. Here's a 15-minute quarterly drill that tests the only thing that matters: whether a real person can restore a real file on a real deadline.
Cyber Essentials is a photograph of your organisation on one particular Thursday. Twelve months later, the photo is out of date, the scope has quietly changed and the badge is doing more reassuring than the controls are. Here's the unglamorous work that happens after the certificate arrives.
The 72-hour clock doesn't care that your finance director is on holiday and your IT provider is on a call queue. Here's a fill-in-the-blanks runbook for the UK GDPR reporting window, written for teams who have never had a lawyer on speed dial — including the mistakes that turn a messy Tuesday into a regulatory headache.
Outsourcing the technical work is sensible. Outsourcing the accountability is not a thing that can actually happen, no matter what the invoice suggests. A blunt look at where your MSP's scope ends, where your risk quietly begins, and the questions worth asking before the next renewal lands on your desk.
UK cyber insurers have moved from asking whether you have multi-factor authentication to asking for the screenshot, the date and the person who checked. For small organisations, the difference between a paid claim and a denied one is rarely the attack itself — it is the paperwork that did or did not exist beforehand.
You do not need a consultant or a platform licence to get the basics right. The UK has quietly built one of the better free cyber toolkits in the world, and most small organisations walk straight past it. Here are ten resources worth your time, roughly how long each takes to stand up, and the traps that stop them working.