Cyber Security for Small Business: Where to Start in 2026

Most small firms do not get breached because attackers are clever — they get breached because a few basic controls were never switched on. Good cyber security for small business is not about buying the most expensive tool; it is about getting a short list of fundamentals right, in the right order, and keeping them running.

Why small businesses are targets

There is a persistent myth that criminals only go after large organisations. In reality, small businesses are attractive precisely because they tend to hold useful data — customer records, payment details, supplier access — while running leaner security than a big enterprise. Many attacks are not personal at all: automated tools scan the internet constantly, probing for exposed services, unpatched software and reused passwords, then exploiting whatever they find.

The UK's National Cyber Security Centre (NCSC) — part of GCHQ — publishes free, practical guidance aimed specifically at small organisations, which is a strong signal that this segment is squarely in scope for attackers. The most common routes in are unglamorous:

• Phishing emails that trick a staff member into entering credentials or opening a malicious attachment.
• Weak or reused passwords that are guessed, sprayed or bought from a previous breach.
• Unpatched software where a known vulnerability has a fix available that was never applied.
• Ransomware that encrypts files and demands payment, often arriving through one of the routes above.

The reassuring flip side: because these routes are so common, the defences against them are well understood and largely affordable. You do not need a security operations centre, a big budget or a full-time specialist to close most of the gaps a small business faces. What you do need is a deliberate plan and the discipline to keep the basics switched on, rather than a drawer full of half-configured tools bought in a panic after a scare.

The essential controls

If you do nothing else this year, work through the six controls below. They map closely to the fundamentals promoted by the NCSC and the UK government's Cyber Essentials scheme, and together they block the large majority of opportunistic attacks.

1. Multi-factor authentication (MFA)

MFA asks for a second proof of identity — typically a code from an app or a hardware key — on top of a password. It is the single most effective control most small businesses can turn on, because it neutralises stolen or guessed passwords. Enable it everywhere it is offered, starting with email, remote access and any admin account. Where possible, prefer an authenticator app or hardware key over SMS codes, which are more easily intercepted.

2. Backups you have actually tested

Backups are your insurance against ransomware, hardware failure and human error. Follow the common 3-2-1 principle: three copies of important data, on two types of media, with one kept off-site or offline. Crucially, an untested backup is a hope, not a plan — schedule a restore test so you know the data comes back cleanly and you know how long it takes.

3. Patching and updates

Applying updates promptly closes the known vulnerabilities that automated attacks rely on. Turn on automatic updates for operating systems, browsers and applications wherever you can, and keep an eye on devices that fall out of support — once a product stops receiving security updates, it becomes a standing risk that no amount of care can patch.

4. Endpoint protection (antivirus and EDR)

Every laptop, desktop and server needs protection against malware. Traditional antivirus blocks known threats; endpoint detection and response (EDR) goes further, watching for suspicious behaviour and giving you a way to investigate and contain an incident. Many small businesses start with solid business antivirus and add EDR-style capabilities as they grow. Whatever you choose, make sure it is centrally managed so you can see, at a glance, which devices are protected.

5. Email security

Since email is the most common delivery route for attacks, hardening it pays off quickly. Use a reputable email provider with strong spam and phishing filtering, and configure the standard sending-domain protections (SPF, DKIM and DMARC) so others cannot easily impersonate your domain. Combine that with MFA on mailboxes and you have addressed a large share of the risk.

6. Staff awareness training

Your people are not the weakest link so much as the most-targeted one. Short, regular training on how to spot phishing, handle data and report anything suspicious turns staff into a genuine layer of defence. Make reporting easy and blame-free — you want people to flag a mistaken click immediately, not hide it.

Cyber Essentials & basic compliance

Cyber Essentials is a UK government-backed certification scheme, operated by the IASME Consortium on behalf of the NCSC. It is designed to help organisations of any size demonstrate that they have the basic technical controls in place. The scheme centres on five control areas — firewalls, secure configuration, user access control, malware protection and security update management — which overlap closely with the essentials above.

There are two levels:

• Cyber Essentials — a self-assessment, verified by a certification body, covering the five core controls.
• Cyber Essentials Plus — the same controls, but with an independent hands-on technical audit for added assurance.

Certification is not legally mandatory for most businesses, but it can be a practical door-opener: some public-sector contracts and larger clients ask suppliers to hold it, and working towards it is a structured way to check your fundamentals. Treat it as a floor, not a ceiling — a certificate confirms you have the basics, not that you are immune.

Cyber Essentials is about technical controls; it does not, on its own, cover your obligations for handling personal data. If you store or process customer information, UK GDPR and the Data Protection Act still apply, and you should understand how your tools handle that data. Our GDPR and SaaS checklist walks through the questions to ask software vendors before you trust them with personal data.

Build in-house or outsource security?

Once the essentials are clear, the practical question is who keeps them running. Most small businesses land somewhere on a spectrum between doing everything themselves and handing the whole function to a specialist.

• In-house / DIY. Viable for the basics if someone has the time and confidence to own MFA, backups, patching and endpoint protection. It is the cheapest option in cash terms, but it competes with everything else on that person's plate — and security tends to lose when it is nobody's core job.
• Managed security provider (MSP / MSSP). An external team configures, monitors and maintains your defences, often bundling endpoint protection, patching, backups and 24/7 alerting. You pay a recurring fee, but you gain expertise and, importantly, someone whose job it is to notice when something is wrong at 2am.

The right answer depends on your risk, your data and your capacity. A two-person consultancy with tested backups and MFA everywhere may be perfectly safe running things itself. A firm handling sensitive client data, or one that simply cannot afford downtime, usually benefits from outsourcing monitoring and response to people who do it full time. A common middle path is to keep day-to-day controls in-house while paying a provider for monitoring, incident response and an annual review.

Whichever route you take, keep ownership of the fundamentals: know where your data lives, who can access it, and how you would recover if the worst happened. A provider can run your controls, but the responsibility for your business stays with you.

FAQ