The ultimate guide to cyber security for businesses 

Criminals want the data you hold, and your systems and people give them a way in. Here's what the latest figures show: 

• 43% of UK businesses reported a cyber security breach or attack in the past 12 months, around 612,000 companies. (DSIT and Home Office, UK Cyber Security Breaches Survey, published 30 April 2026) 
• Phishing was the most common type of breach or attack, experienced by 38% of UK businesses. (Same survey) 
• The global average cost of a data breach rose 12% to a record $4.99 million in 2026. (IBM, Cost of a Data Breach Report 2026) 
• The median perceived cost of the most disruptive breach or attack was £0 for UK businesses, according to the Cyber Security Breaches Survey 2025/26 from DSIT. For the costliest 5% of cases, the perceived cost reached £4,000, rising to £10,000 for medium and large businesses. 

Money is only part of the damage. Reputation, customer trust, regulatory fines and disruption to operations can last far longer than the direct cost of an incident. 

Under UK GDPR, serious data breaches can attract fines of up to £17.5 million or 4% of global annual turnover, whichever is higher. In 2026, the ICO fined South Staffordshire Water £963,900 after a 2020 cyber attack exposed data on around 633,000 people. 

Microsoft's 2026 Digital Defense Report found that most attacks linked to potential vulnerability exploitation involved well-known, long-disclosed CVEs. It also says these vulnerabilities are effectively mitigated once vendor updates are applied and systems are properly secured. 

This guide covers the threats and the practical steps you can take to protect your business today. 

Most attacks fall into two groups. Some try to steal your login details. Others trick someone into running something harmful. Most begin with a person, so understanding how attackers work is your first line of defence. 

Human error

Sending an email to the wrong person, misconfiguring a system or leaving a screen unlocked can all expose data. The Verizon 2026 Data Breach Investigations Report found the human element was present in 62% of breaches, including errors, social engineering and misuse. Build processes that make mistakes less likely and easier to catch. 

Phishing

Phishing is the most common form of attack, and it isn't going away. A phishing attack is where a criminal impersonates a trusted person or organisation, such as a bank, a delivery firm or a colleague, to get you to share sensitive information or click a link that installs malware. 

Microsoft's 2026 Digital Defense Report found that nearly 85% of reported phishing emails between April and June 2026 carried an impersonation signal. In its Defender Experts data, phishing accounted for 11% of initial access techniques, while user execution and valid accounts together made up over half of the activity observed. 

Criminals send most phishing in bulk with little personalisation, and they rely on volume. A 1% success rate across one million emails still gives 10,000 victims. Watch for these red flags: 

• The sender's address doesn't match the organisation it claims to be from. Check the full address, not just the name. 
• Your name isn't in the "To" field, so you may have been blind copied with many others. 
• The greeting is generic, such as "Dear customer". 
• The message creates urgency, such as "Your account will be suspended". 
• Links don't go where they claim. Hover over every link before you click. 
• You weren't expecting an attachment, especially .exe or .zip files, or Office files with macros. 
• The spelling or grammar is poor, though AI is making this a weaker warning sign. 
• It asks for information a legitimate organisation wouldn't request by email. 

Tip: Homoglyph attacks swap letters for visually identical characters from another alphabet, such as Cyrillic. A lookalike web address can look right to the eye and still lead to a different site. Check links before you trust them. 

AI has shifted the balance between attackers and defenders, and not always in defenders' favour. 

AI-powered attacks and deepfakes

AI-generated phishing is now hard to tell apart from genuine messages. The old warning signs, such as poor grammar, generic greetings and implausible stories, are fading. Microsoft's 2026 report says attackers use AI across several stages of an attack, including reconnaissance, social engineering and malware development. Microsoft's 2026 report says the disclosure-to-exploitation window has shrunk to single-digit days. It also describes one ransomware group moving from web-facing exploitation to deploying ransomware in as little as 24 hours. 

Deepfake audio and video are now a business threat. Attackers can generate convincing audio or video of executives, managers or clients from a few seconds of audio or a handful of images. They use these to: 

• Impersonate executives on video calls to approve fraudulent transfers 
• Clone voices to instruct staff by phone 
• Create fake IDs for financial fraud 
• Persuade staff to reset MFA or grant remote access 

In one high-profile case, a finance employee at engineering firm Arup made 15 transfers totalling HK$200 million (about US$25 million) after a video call with deepfake colleagues. Arup confirmed it was the victim, and a spokesperson told CNN that none of its internal systems were compromised.

AI attacks that run with little human input 

AI tools can now carry out reconnaissance, identify weaknesses, write personalised attacks and launch them at scale, with little human input at each step. IBM's Cost of a Data Breach Report 2026 says AI enabled one in four malicious breaches, a 56% increase on the previous year, and that those breaches cost an average of $6 million. 

The old advice to look for bad grammar and suspicious links is no longer enough. Verification procedures, security culture and technical controls matter more than ever. 

Ransomware 3.0

Ransomware remains the dominant threat for businesses of all sizes. The Verizon 2026 DBIR found ransomware involved in 48% of breaches, up from 44% the year before. Modern ransomware often goes further than locking your files: 

• Data theft: attackers steal data before encrypting it, then threaten to publish or sell it unless you pay. 
• Customer threats: attackers threaten to contact your customers directly. 
• Denial of service: some groups add DDoS attacks to increase the pressure. 

The same report found that 69% of ransomware victims didn't pay. We recommend you don't pay either. Paying marks you as a target for repeat attacks and doesn't guarantee your data comes back. Take legal and law enforcement advice first. 

Ransomware-as-a-Service has also lowered the barrier to entry. Criminal groups sell ready-made toolkits, so less skilled attackers can run sophisticated campaigns. Tested, offline backups are your strongest answer.

Supply chain attacks

Attackers increasingly target suppliers, software vendors and service providers to reach their customers. The Verizon 2026 DBIR found breaches with third-party involvement rose 60% year on year, to 48% of all breaches. A compromised payroll provider, cloud storage vendor or IT support company can expose your data, however strong your own defences are. The 2020 SolarWinds attack, which inserted malicious code into a software update, affected thousands of organisations, including government agencies. 

Insider threats

Some risks come from inside your organisation: 

• Accidental insiders make mistakes, such as falling for phishing or sending data to the wrong person. 
• Negligent insiders bypass policy for convenience, for example by using personal devices or unsecured networks. 
• Malicious insiders steal or leak data on purpose, often for money or out of grievance. 

Generative AI adds a new twist. The Verizon 2026 DBIR reports that 45% of employees are now regular users of AI on corporate devices, up from 15% a year earlier, and that 67% of those users accessed AI platforms through non-corporate accounts. Set a clear AI usage policy, and make approved tools easy to use. 

The DBIR also suggests a simple control: review account activity when someone with access to sensitive data resigns or is let go. It notes that this review has caught numerous breaches in its dataset. 

Business email compromise (BEC)

BEC happens when attackers infiltrate or spoof email accounts to trick staff into moving money or sharing sensitive data. Common scenarios include: 

• CEO fraud: an urgent, confidential transfer request that appears to come from the chief executive 
• Invoice fraud: a supplier's payment details are swapped for a fraudulent account 
• Payroll diversion: a request to change an employee's bank details 

Microsoft found that around 25% of attacks mimic an organisation's trusted operating environment or someone inside it, and that HR, payroll and benefits scams drove 77% of those cases. Verizon's DBIR also found that 51% of payroll diversion attacks land on a Monday or Tuesday, when staff are working through the week's requests. 

The FBI's Internet Crime Complaint Center (IC3) reported $3.05 billion in business email compromise losses in 2025, across 24,768 complaints, up from $2.77 billion in 2024 (FBI IC3 2025 Internet Crime Report). 

Always verify requests to change payment details, or urgent transfers, through a known phone number. Don't check by replying to the email.

Knowing the threats is only the start. The steps below cover the controls that matter most. 

Build a security culture

Technology alone won't protect you. Your people matter most. A strong security culture means everyone, from the CEO to the newest recruit, understands the risks, knows what to do and feels able to act. 

• Get buy-in from the top. If senior leaders don't take security seriously, staff won't either. 
• Involve people in writing procedures. Policies that staff helped create are the ones they follow. 
• Make training regular and practical. An annual tick-box course isn't enough. Use simulated phishing, interactive modules and real examples. 
• Don't punish honest mistakes. If people fear blame, they hide incidents, and the damage grows. 
• Recognise good security behaviour, especially staff who spot threats or report incidents. 
• Appoint security champions in larger teams. 
• Review procedures regularly as threats change. 

Zero trust architecture

The old model of trusting everything inside the network and blocking everything outside doesn't suit remote working, cloud services or mobile devices. Zero trust works on one principle: never trust, always verify. 

• Continuous verification: check identity at every access request, not just at login. 
• Least privilege: people get access only to what their role needs. 
• Micro-segmentation: split the network into zones, so a breach in one area can't spread freely. 
• Assume breach: design systems on the basis that attackers may already be inside. 

Zero trust is built from several controls, so start with identity and access management, then expand in stages. 

Multi-factor authentication (MFA)

MFA is one of the most effective controls you can use, and it's still underused. The latest UK Cyber Security Breaches Survey found 47% of UK businesses had two-factor authentication in place. 

MFA adds a second check at login, such as a code on your phone, an app notification or a biometric scan. Even if an attacker has your password, they can't get in without the second factor. Start with email, cloud services, financial systems, remote access tools and your password manager. 

Attackers have found ways around MFA, though. Adversary-in-the-middle (AiTM) attacks intercept authentication in real time. Microsoft's 2026 report describes AiTM as a scalable, automated identity theft pipeline, where the goal is the persistent session cookie, not just the password. Microsoft recommends phishing-resistant MFA and passkeys. A passkey only works on the site or app it was created for, so it won't sign you in to a lookalike page. MFA matters, but it's one layer among several.

Password hygiene

Weak and reused passwords remain a common cause of breaches. Current best practice: 

• Use a passphrase. The NCSC recommends three random, unrelated words. 
• Use a password manager, and turn on MFA for it too. 
• Never reuse passwords. Attackers try stolen credentials on other services, a technique called credential stuffing. 
• Change passwords as soon as you suspect compromise, including after an unexpected MFA prompt. 

Patch management

Attackers scan for unpatched systems and often exploit known vulnerabilities within days of a patch being released. The Verizon 2026 DBIR found that exploiting vulnerabilities is now the most common initial access vector, accounting for 31% of breaches. Only 26% of critical vulnerabilities in CISA's Known Exploited Vulnerabilities catalogue were fully remediated in 2025, and the median time to full resolution rose to 43 days. 

The 2017 WannaCry ransomware attack hit the NHS and infected more than 200,000 computers across over 150 countries. It exploited a vulnerability Microsoft had already patched. 

Best practice: 

• Turn on automatic updates wherever you can. 
• Set a formal patch process with defined timescales. 
• Prioritise internet-facing systems and critical infrastructure. 
• Keep an inventory of all software and hardware. 
• Plan to retire end-of-life systems that can no longer be patched.

Remote and hybrid working security

Working from home or in public spaces adds risks that don't exist in a controlled office. 

• Public Wi-Fi: use a VPN or mobile data hotspot for work. 
• Shoulder surfing: use a privacy screen and sit with your back to the wall. 
• Home networks: keep routers updated and use WPA3 encryption. 
• Personal devices: enforce device management policies and require a PIN or biometric lock. 
• Blurred boundaries: use separate devices or profiles for work and personal use. 

Make MFA mandatory for all remote access. Consider Zero Trust Network Access (ZTNA) as a more secure alternative to traditional VPNs.

Device management

Every device that connects to your network is a potential entry point. That includes laptops, phones, tablets and IoT devices such as smart printers and building access systems. 

• Keep an inventory of every device with access to company systems. 
• Enforce minimum standards: a PIN or biometric lock, encryption and an up-to-date operating system. 
• Use mobile device management (MDM) software to enforce policies and wipe lost devices. 
• Wipe devices before disposal or reuse. 
• Restrict personal devices for work, or enforce a clear bring-your-own-device policy. 
• Don't overlook IoT devices. Attackers can use them to reach wider networks. 

Clear desk, clear screen

Lock sensitive documents away when you're not using them, and lock your screen whenever you step away. Shred confidential waste onsite, or use a professional disposal service with locked bins. 

Supply chain due diligence

A weak supplier can expose your data, however strong your own defences are. Before a supplier gets access to your systems or data: 

• Check their security accreditations, such as ISO 27001, Cyber Essentials or SOC 2. 
• Review their data protection policy. 
• Identify their sub-processors and subcontractors. 
• Review their incident response process. 
• Confirm what contractual protections they offer. 

The NCSC's 12 Principles of Supply Chain Security provide a useful framework. Set minimum security standards for all suppliers, review them at set intervals, and ask for evidence rather than self-assessment. The latest UK Cyber Security Breaches Survey notes that 15% of businesses review the cyber risks posed by their immediate suppliers. 

Incident response planning

Assume you'll face an incident at some point. How well you respond depends on how prepared you are. An incident response plan should cover: 

• Detection: how you'll spot an incident, and what monitoring is in place 
• Containment: how you'll isolate affected systems 
• Eradication: how you'll remove the threat 
• Recovery: how you'll restore systems and data, and whether your backups are tested and offline 
• Communication: who needs to know, including customers, regulators, insurers and law enforcement 
• Review: what you'll change to prevent a repeat 

Test the plan regularly. Run tabletop exercises at least once a year, and give each person a clear role. A plan that's never been practised is unlikely to work under pressure. 

For backups, follow the 3-2-1 rule: three copies of your data, on two different types of media, with one copy stored offline or off-site. Ransomware now targets backup systems, so offline copies are essential. 

Cyber security is a legal and regulatory issue as well as a technical one. UK organisations face a growing set of requirements. 

UK GDPR and Data Protection Act 2018

UK GDPR requires organisations to put "appropriate technical and organisational measures" in place to protect personal data. You must report a personal data breach to the ICO within 72 hours of becoming aware of it, if it's likely to pose a risk to people's rights and freedoms. Where the risk is high, you must also tell the people affected without undue delay. The ICO can fine serious breaches up to £17.5 million or 4% of global annual turnover. 

Cyber Essentials

Cyber Essentials is a UK government-backed scheme that protects against the most common cyber threats. It covers five controls: firewalls, secure configuration, user access control, malware protection and patch management. Cyber Essentials Plus adds independent technical verification. Public sector contracts may require one or the other, depending on the data and systems involved. 

ISO 27001

ISO 27001 is the international standard for information security management systems. It gives you a systematic way to manage sensitive information and shows clients and partners that you take security seriously. 

UK Cyber Governance Code of Practice 

The UK Cyber Governance Code of Practice sets board-level expectations for cyber security governance. It links to the NCSC Board Toolkit and signals where UK regulation is heading. Cyber security is now a board responsibility as well as an IT issue. 

Cyber Security and Resilience (Network and Information Systems) Bill

The Bill has passed the House of Commons and completed committee stage in the House of Lords. It isn't law yet. Lords Report Stage is listed for 26 October 2026, and Royal Assent is expected between late 2026 and spring 2027. 

If enacted, the Bill would reform the NIS Regulations 2018 and introduce 24-hour and 72-hour incident reporting. For the most serious failures, a regulator could fine a business up to £17 million or 4% of its turnover, whichever is higher. Regulated sectors should track its progress. 

When things go wrong

If you suffer a breach, you'll need to: 

• Notify affected individuals without delay, explaining what happened and what you're doing about it 
• Report to the ICO within 72 hours if the breach poses a risk to individuals 
• Notify your cyber insurer and follow its guidance 
• Report to Action Fraud if a crime has been committed 
• Preserve evidence for investigators 

Don't pay a ransom until you've taken legal and law enforcement advice. 

National Cyber Security Centre (NCSC) 

The NCSC (ncsc.gov.uk) is the UK's national authority on cyber security. It offers free, authoritative guidance for organisations of all sizes, including the 10 Steps to Cyber Security, the Cyber Essentials scheme and a Small Business Guide. Start here. 

Action Fraud 

Action Fraud (actionfraud.police.uk) is the UK's national reporting centre for fraud and cyber crime. Report incidents here to receive a crime reference number. 

Security awareness training 

Look for training that includes simulated phishing, interactive modules and role-specific content. It should run throughout the year, not as a single annual event. 

Next step: Security Essentials includes security awareness training and phishing simulation, alongside device and identity controls. 

Managed security services 

If you don't have in-house security expertise, a managed security service provider (MSSP) can monitor for threats, respond to incidents and manage security on an ongoing basis. Look for relevant accreditations, such as ISO 27001 or Cyber Essentials Plus, and ask how the provider protects its own systems.

Next step: Access's IT security services cover identities, devices and data, with optional 24/7 monitoring and response. 

Cyber insurance 

Cyber insurance can help cover costs such as legal fees, notification, business interruption and, in some cases, ransom payments. Insurers now expect evidence of baseline controls before they cover you, and premiums reflect your risk profile. 

Sources 

• NCSC: ncsc.gov.uk, including 10 Steps to Cyber Security and Cyber Essentials 
• UK Cyber Security Breaches Survey (DSIT and Home Office, published 30 April 2026): gov.uk/government/statistics/cyber-security-breaches-survey 
• IBM Cost of a Data Breach Report 2026 (released 29 July 2026): ibm.com/reports/data-breach 
• Verizon 2026 Data Breach Investigations Report: verizon.com/business/resources/reports/dbir 
• Microsoft Digital Defense Report 2026: microsoft.com/en-us/security/security-insider/threat-landscape/2026-digital-defense-report 
• FBI Internet Crime Complaint Center (IC3): ic3.gov 
• Parliament, Cyber Security and Resilience (Network and Information Systems) Bill: bills.parliament.uk 
• Action Fraud: actionfraud.police.uk 
• CNN, Arup deepfake case (16 May 2024): cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk 
• Access, IT security services: theaccessgroup.com/en-gb/managed-it-services/security-solutions/ 
• Access, Security Essentials: theaccessgroup.com/en-gb/managed-it-services/security-solutions/security-essentials/ 
• Access, Security Advanced + Compliance: theaccessgroup.com/en-gb/managed-it-services/security-solutions/security-advanced-compliance/ 
• Access, Proactive Security: theaccessgroup.com/en-gb/managed-it-services/security-solutions/proactive-security/