Cyber Security for UK Small Businesses and Home Users

Start with a threat model (5 minutes, saves months)

Before spending a penny on tools, write down three things: (1) what data would hurt most if it leaked, (2) what would happen if you lost access for 72 hours, and (3) who could plausibly want to hurt you. For a plumber that's the invoice ledger and the customer database. For a solicitor it's client files and Companies House filings. For a family it's usually photos and banking access. Every control below is judged against that list — anything that doesn't defend one of those three questions is optional.

• Write it down on one page. Not a spreadsheet.
• Include the people, not just the systems (who has admin? who could be phished?).
• Revisit every six months or after any material business change.

Identity is the new perimeter — get MFA right

80% of the incidents we see start with a compromised password. MFA blocks nearly all of them — but SMS-based MFA is now considered weak (SIM-swap attacks are trivial). Use an authenticator app (Microsoft Authenticator or Authy) for everything that supports it, and hardware keys (YubiKey) for admin accounts. In Microsoft 365, enforce Conditional Access that requires MFA from unknown locations and blocks legacy auth entirely — this alone stops password-spray attacks dead.

• Enforce MFA on: email, banking, Companies House, HMRC, all cloud admin accounts.
• Kill SMS MFA where an app or key is offered.
• Rotate any password that pre-dates MFA being on — assume it leaked.
• For M365: block legacy auth, require MFA on all users, enforce it via a Conditional Access policy (not just per-user settings).

Endpoint protection: what actually catches things

Windows Defender (now Microsoft Defender for Endpoint on Business plans) is genuinely competitive with paid AV in independent testing (AV-Test, SE Labs). For most small businesses it's the right choice — provided you also enable ASR rules, controlled folder access, and tamper protection. On Macs, XProtect + Gatekeeper is baseline; add Malwarebytes or Sentinel for anything storing client data. What you should NOT do is stack three AV products — they'll fight each other and slow the machine to a crawl.

• Turn ON: cloud-delivered protection, tamper protection, controlled folder access.
• Deploy ASR rules in audit mode first, then enforce.
• Patch OS + browser + Office monthly. This still matters more than any AV upgrade.

Email is still where 90% of attacks start

Business email compromise (BEC) — where an attacker gets into your mailbox, watches for an invoice going out, and quietly changes the bank details — is the single most expensive incident type we see for UK SMBs. Prevention is layered: SPF, DKIM and DMARC properly configured on your domain (not just SPF), MFA enforced, mailbox forwarding rules alerted on, and a bank-detail-change policy that requires a phone call to a known number.

• Publish DMARC at p=reject once SPF and DKIM are clean — quarantine is a stepping stone, not a destination.
• Turn on mailbox auditing and alert on: new inbox rules, external forwarding, mass deletes.
• Bank detail changes ALWAYS confirmed by voice on a previously-known number.

Backups: 3-2-1, tested, or it doesn't count

Three copies of the data, on two different media, with one off-site. And crucially: an untested backup is a hopeful backup. Ransomware crews now specifically target backup infrastructure — a Veeam or Synology backup on the same network is the first thing they encrypt. For SMBs we recommend Backblaze or Wasabi for offsite, immutable snapshots enabled, and a quarterly restore drill that a non-technical staff member can complete with the runbook.

• Immutable / object-lock on the offsite copy — non-negotiable in 2026.
• Test restores quarterly. Actually restore a file, don't just check the job succeeded.
• M365 needs its own backup (Barracuda, Datto, AvePoint) — Microsoft's retention is not a backup.

Cyber Essentials — worth it or not?

Yes, if you're bidding for public sector or supply-chain work — it's often mandatory. Otherwise it's a solid forcing function to get the basics right and a credibility marker for clients. Cyber Essentials Plus adds an external audit and is genuinely more rigorous. Budget £300–£500 for basic and £1,500–£2,500 for Plus depending on org size. We do the readiness work and remediation; the assessment itself is done by an IASME-accredited certification body.

If it happens: the first 60 minutes

Disconnect the affected machine from the network — cable out, Wi-Fi off — but do NOT power it down (you lose volatile evidence). Change passwords for any account that touched the machine, from a known-clean device. Notify your bank if financial data was on it. If it's a ransomware event and you have UK operations, you must consider ICO notification within 72 hours if personal data was involved. Don't pay unless a specialist has told you there's no other way — most decryptors are useless and payment marks you as a repeat target.

• Isolate — don't power off.
• Change credentials from a known-clean device.
• Preserve logs before you rebuild.
• Call us, or call an incident response specialist — not the person who set the system up.