5 cyber security basics every UK business needs

There’s a myth that cyber criminals only go after big companies. The reality is the opposite: most attacks are automated, indiscriminate, and aimed at whoever is easiest to breach. For a smaller or under-resourced organisation, that usually means tighter budgets and thinner defences, exactly what attackers look for.

The good news is that you don’t need an enterprise budget to be secure. A handful of well-run basics stops the overwhelming majority of attacks. Here are the five we’d put in place first.

1. Turn on multi-factor authentication everywhere

Passwords get leaked, guessed and phished every day. Multi-factor authentication (MFA) adds a second step, usually a prompt on your phone, so a stolen password alone isn’t enough. It’s the single highest-impact thing most businesses can do, and it’s free on services like Microsoft 365 and Google Workspace.

2. Keep everything patched and up to date

Most successful attacks exploit known weaknesses that already have a fix available. Applying updates promptly, to laptops, phones, servers and software, closes those holes before they can be used. Automating this so it happens quietly in the background is far more reliable than hoping people remember.

3. Back up your data, and test the restore

Ransomware works because it makes your data unavailable. A good backup makes that threat far less frightening. We follow a 3-2-1 approach: three copies of your data, on two types of storage, with one kept securely off-site. Crucially, a backup you’ve never restored from is just a hope, test restores turn it into a guarantee.

4. Train your team to spot phishing

The majority of breaches start with a person clicking something they shouldn’t. Short, practical training, backed by the occasional simulated phishing email, turns your team from your biggest risk into your best line of defence. People don’t need to become experts; they just need to pause before they click.

5. Get Cyber Essentials certified

Cyber Essentials is a UK government-backed scheme covering five core controls. Working towards it forces good habits, reassures customers, is often required to win contracts, and can lower your insurance costs. It’s a practical, affordable badge that proves you take security seriously.

Where to start

If you do nothing else this quarter, turn on MFA and check your backups actually restore. From there, a short security review will show you exactly where your gaps are, and most are quick and inexpensive to close.