October 2026 | ATS Connection

PHP2Shell: What the Critical PHP Flaw Means for Your Business Website (October 2026)

Posted on 22 October 2026 by Jake Boase

The short answer: PHP2Shell is the name given to two critical security flaws in PHP, the software that runs WordPress and most business websites. Fixes were released on 21 October 2026. The flaws can let an attacker take over a web server with a single request, without logging in, and attacks were already being attempted before the fixes came out. Updating WordPress or your plugins does not fix it. The PHP software on the server has to be updated, which is usually your hosting provider’s job. If your website runs on a server that can no longer receive updates, it needs to move.

In this guide:

What is PHP2Shell?
Why it is so serious
Is my website affected?
Who has to fix it?
What to do today
Why old servers are the real problem
Signs your server may already have been attacked
Frequently asked questions
Sources

What is PHP2Shell?

PHP2Shell is the nickname for two vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. PHP rates both at 9.2 out of 10 on the CVSS scale, which puts them in the critical category. Both allow remote code execution, meaning an attacker can run their own commands on the web server.

In plain terms, both are memory handling bugs. One is triggered when PHP runs out of memory part way through handling a request, leaving internal data half set up. The other leaves data from one request lying around for the next request handled by the same process. An attacker who can trigger either bug with a carefully crafted request can take control of the server.

Details leaked ahead of the planned disclosure date, so the PHP project brought its release forward and published fixed versions on 21 October 2026.

Why it is so serious

No login needed. The PHP security team says a working exploit exists for servers using Apache with mod_php, where a single unauthenticated request can trigger the attack before any website code runs.
It affects almost every setup. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all affected. Reports say nearly every PHP version going back years is vulnerable.
Attacks started early. Cloudflare reported attack attempts before the fixes were released, and security firm watchTowr reported active exploitation attempts on the day of release.
Your security plugin cannot see it. The attack happens inside PHP before WordPress loads, so WordPress security and firewall plugins do not stop it.

The UK National Cyber Security Centre (NCSC) told organisations to update affected systems immediately, and where that is not possible, that they “should consider taking the system offline until it can be fully mitigated”. In the Netherlands, several government services were taken offline as a precaution while systems were patched.

Is my website affected?

If your website or web application runs on PHP, assume it is affected until you have confirmed the server is running a fixed version. That includes almost every WordPress, WooCommerce, Joomla, Drupal and Laravel site, plus many customer portals and booking systems. The fixed versions are:

PHP version	Fixed in	Notes
8.5	8.5.12	Supported
8.4	8.4.27	Supported
8.3	8.3.36	Supported
8.2	8.2.35	Security fixes only, and support ends on 31 December 2026
8.1 and older (including 7.4)	No official release	Only patched if your Linux distribution or a paid long-term support vendor provides a backport. Plan to upgrade.

One catch: Linux distributions often fix the problem without changing the main version number, so a server can show an older-looking number and still be patched. Your host or IT provider can confirm this by checking the package changelog for the two CVE numbers.

To see which PHP version a WordPress site uses, go to Tools, Site Health, Info, Server in your WordPress dashboard.

Who has to fix it?

This depends on how your website is hosted, and it is the question most businesses cannot answer straight away.

How your site is hosted	Who patches PHP	What you should do
Shared hosting or managed WordPress hosting	Your hosting provider	Ask them in writing whether the fixed PHP is installed on your server
A virtual private server (VPS) or dedicated server managed by your host	Usually your host, but check your agreement	Confirm who is responsible and when it was done
An unmanaged VPS or your own server	You, or your IT provider	Update PHP from your Linux distribution and restart PHP-FPM or Apache
A server on an operating system that is no longer supported	Nobody can patch it in the normal way	Protect it now and plan a move to a supported server

Several large hosting companies have said they are patching shared hosting themselves, but that customers on a VPS or dedicated server must update PHP on their own. If you have a VPS, do not assume someone else has done it.

What to do today

List every PHP website and web application you rely on, including your main website, any customer portal, booking system or intranet, and anything an agency built for you years ago.
Find out who hosts each one and who is responsible for patching it. Ask for a written answer: “Is the fixed version of PHP for CVE-2026-109618 and CVE-2026-109619 installed on our server, and when was it installed?” A reply about firewall protection is not the same as a patched server.
If you manage the server yourself, install the fixed PHP packages from your Linux distribution and restart PHP-FPM or Apache so the new version is actually running.
If it cannot be patched today, put the site behind Cloudflare with the proxy switched on. Cloudflare has deployed firewall rules for the known attacks, and they are available on every plan, including the free one. Treat this as a stopgap, not a fix. For anything holding customer data, follow the NCSC’s advice and consider taking it offline until it is fixed.
Check for signs of an attack (see the list below), because some servers will have been targeted before they were patched.
Plan to move anything on PHP 8.1 or older, or on an operating system that no longer gets updates. PHP 8.2 also reaches the end of support on 31 December 2026, so it is worth moving straight to 8.3 or newer.

Why old servers are the real problem

A patched, supported server can be fixed in minutes. The businesses with a real problem are the ones whose website sits on a server running an operating system that has reached end of life. Those servers cannot receive the updated PHP packages in the normal way, so the flaw stays open.

Rebuilding on a supported operating system, such as a current Ubuntu LTS or Debian release, with a supported version of PHP is the only lasting fix. A move also gives you a chance to set up proper backups and automatic security updates, so the next PHP flaw is a routine update rather than an emergency. Ask your provider two questions: what operating system your server runs, and when it stops getting security updates.

Signs your server may already have been attacked

Patching stops new attacks but does not remove an attacker who is already in. Researchers and incident response teams suggest checking for:

New or unfamiliar .php files, especially in upload folders such as wp-content/uploads
Administrator accounts or plugins you do not recognise
New scheduled tasks (cron jobs) on the server
Spam pages appearing in Google results for your site, or malware warnings from your host or browser
Server logs showing bursts of out-of-memory errors or repeated server errors, or PHP processes restarting for no clear reason

If you find anything, restore from a backup taken before the problem started, change every password connected to the site and server, and get help before putting it back online.

Not sure where your website is hosted, or who is meant to be patching it? Our cyber security team in Arundel and Chichester can check your websites and web applications, confirm whether they are patched and move anything that cannot be patched onto a supported server. We are Cyber Essentials certified and have supported businesses since 2015. For anything urgent, call us on 01903 255 159.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10. They can let an attacker run code on a web server without logging in. Fixed versions of PHP were released on 21 October 2026.

Does updating WordPress fix PHP2Shell?

No. The flaws are in PHP, the software WordPress runs on, not in WordPress or its plugins. The PHP software on the server has to be updated, which is normally done by your hosting provider or whoever manages your server.

How do I know if my website is affected?

If your website runs on PHP, assume it is affected until your host confirms the server runs a fixed version: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a Linux distribution package that includes the fix. In WordPress you can see the PHP version under Tools, Site Health, Info, Server.

Is PHP 8.1 or 7.4 still safe to use?

Not without extra work. The PHP project no longer releases updates for 8.1 and older. Some Linux distributions and paid long-term support vendors have released their own fixes, but the safest route is to upgrade to PHP 8.3 or newer on a supported server.

Does Cloudflare protect against PHP2Shell?

Partly, and only for now. Cloudflare has deployed firewall rules for the known attack methods on all plans, and a site behind Cloudflare is harder to attack. Attackers have already been changing their methods to get around firewall rules, so it does not replace updating PHP.

Sources

The Hacker News: PHP issues emergency patches for two critical PHP2Shell RCE flaws, 21 October 2026
BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws, 21 October 2026
Help Net Security: PHP2Shell, critical PHP vulnerabilities patched, 21 October 2026
ITPro: Security agencies warn patch now or take systems offline, including the NCSC’s advice
Digital Applied: PHP2Shell fixes by distribution, control panel and PHP version
Meow Apps: PHP2Shell, what to do on your WordPress site

This article reflects what was known on 21 October 2026. The situation is moving quickly and we will update it as more is confirmed.

Hotel WiFi: A Practical Guide for UK Hotels (2026)

Posted on 11 October 202615 October 2026 by Jake Boase

The short answer: Good hotel WiFi needs three things: a survey-led design with enough access points for your building, a fast and resilient internet connection behind it, and separate networks so guests never share a network with your reception, payments or property management system. Get those right and WiFi stops being a complaint. Get the separation wrong and you can also fall foul of PCI DSS, the card industry’s security standard.

In this guide:

Why hotel WiFi lets guests down
What good hotel WiFi looks like
Keep guest WiFi away from your payments and systems
Hotel WiFi and PCI DSS
Collecting guest details through WiFi
The Booking.com phishing threat
Hotel WiFi checklist
Frequently asked questions
Sources

Why hotel WiFi lets guests down

Most hotel WiFi problems come from a handful of causes:

The building. Thick stone or brick walls, fire doors, long corridors and several floors all block wireless signals. Gardens, terraces and outbuildings are often left out entirely.
Too few access points. A router behind reception and a few plug-in extenders cannot cover a hotel. Extenders also cut speed and make devices drop out as guests move around.
Not enough internet capacity. On a busy evening dozens of guests stream, video call and back up photos at once. A connection sized for the office will not cope.
One flat network. Guests, staff, card terminals and cameras all on the same network is slow to troubleshoot and a security risk.
No one looking after it. Consumer equipment with no monitoring means problems are found by guests, not by you.

Historic buildings are the hardest case. When we upgraded the network at the Norfolk Arms Hotel in Arundel, a 37-room listed property, thick stone walls blocked wireless signals and listed status restricted where equipment could go. The answer was a leased line and access points placed discreetly throughout the hotel and gardens, with separate guest WiFi networks.

What good hotel WiFi looks like

A site survey first. Measuring signal room by room, including bars, function rooms and outdoor areas, tells you how many access points you need and where. It is the difference between planned coverage and guesswork.
Business-grade access points, centrally managed. A managed system lets guests roam from room to restaurant without dropping off, and lets your IT provider see and fix problems remotely.
Cabled access points where possible. Wiring each access point back to a network switch gives far more reliable speeds than wireless repeaters.
An internet connection sized for your busiest night. Busy hotels often need a leased line, which gives the same speed in both directions and a business service level agreement.
A backup connection. A second line or 4G or 5G backup keeps guests and card payments online if the main line fails.
Monitoring. Your IT provider should be alerted when an access point or the internet line goes down, ideally before a guest notices.

Our business WiFi and wireless network service covers surveys, design and installation, and our IT support for hotels keeps the whole setup monitored and supported.

Keep guest WiFi away from your payments and systems

The most important design decision is separation. A typical hotel should run at least these networks, kept apart from each other:

Network	Who or what uses it	Key settings
Guest WiFi	Guests’ phones, laptops and TVs	Internet only, client isolation so guest devices cannot see each other, speed limits per device if needed
Staff network	Reception PCs, office laptops, the property management system	Strong WPA2 or WPA3 security, password changed when staff leave
Payments	Card terminals and any device that handles card data	Never on guest WiFi, with security controls between it and every wireless network, as PCI DSS requires
Building systems	CCTV, door locks, heating controls, smart TVs	Kept apart from both guests and staff, with default passwords changed

Separation stops a guest’s infected laptop from reaching your reception PC, keeps cameras and smart devices out of reach, and makes problems far easier to trace.

Hotel WiFi and PCI DSS

If you take card payments, the Payment Card Industry Data Security Standard (PCI DSS) applies, and it has specific rules for wireless networks. In PCI DSS v4.0.1:

Requirement 1.3.3: network security controls must be installed between all wireless networks and the cardholder data environment, and all wireless traffic into that environment must be denied by default.
Requirement 11.2.1: you must test for wireless access points, detect and identify both authorised and unauthorised ones, at least once every three months.
Requirements 2.3.1 and 2.3.2: for any wireless network connected to card systems, vendor defaults such as default encryption keys must be changed, and keys must be changed when someone who knows them leaves.

The simplest way to meet these is to keep card terminals on their own isolated network, or on their own mobile data connection, never on guest WiFi, and to have your IT provider document the setup. Your card provider or acquiring bank will tell you which self-assessment questionnaire applies to you.

Collecting guest details through WiFi

Many hotels use a WiFi login page to collect email addresses. That is allowed, but email marketing has to follow PECR, and the ICO’s guidance is clear on the main points:

You normally need consent before sending marketing emails to individuals.
Consent must be freely given. Making agreement to marketing a condition of a service is unlikely to be valid consent.
You must not use pre-ticked boxes, silence or inactivity as consent.
The soft opt-in, which lets you market similar products without consent, only applies to details you collected during a sale or negotiations for a sale, and you must offer an opt-out when you collect the details and in every message.

The simplest approach is to let guests connect without signing up to marketing, and offer the newsletter as a separate, unticked choice. Your privacy notice should explain what the login page collects and why. This is general information, not legal advice.

Some hotels also filter guest WiFi. Friendly WiFi is a voluntary, government-supported accreditation that confirms a venue’s public WiFi blocks pornography and child abuse content, which is worth considering if families stay with you.

The Booking.com phishing threat

Hotels are a deliberate target. In March 2025 Microsoft reported a phishing campaign, running since December 2024, that impersonated Booking.com and targeted people at hospitality organisations across Europe and other regions. The emails posed as guest complaints, booking requests or account checks, then led staff to a fake verification page that tricked them into running a command which installed malware designed to steal passwords and financial data.

Phishing is the most common attack UK businesses face. The government’s Cyber Security Breaches Survey 2025/26 found that 43% of businesses reported a breach or attack in the previous 12 months, and phishing affected 38%.

A few steps make a big difference for hotel teams:

Turn on multi-factor authentication for email, your booking platform extranets and the property management system.
Check guest messages and account alerts by logging in to the booking platform directly, never through a link in an email.
Treat any page that asks you to paste or run a command as an attack.
Keep reception and back office PCs off the guest WiFi, with up-to-date security software.

Our cyber security services help hotels protect email and Microsoft 365 and monitor for threats around the clock.

Hotel WiFi checklist

Coverage has been surveyed in every room, public area and outdoor space.
Access points are business grade, centrally managed and cabled where possible.
The internet connection copes with your busiest evening, with a backup line.
Guests, staff, card payments and building systems are on separate networks.
Guest devices are isolated from each other.
Default passwords and encryption keys have been changed, and staff passwords change when people leave.
Wireless access points are checked at least every three months if card systems are in scope.
The WiFi login page does not force guests to accept marketing.
Someone is alerted when the WiFi or internet line goes down.

If you would like a second opinion on your hotel’s WiFi, our team in Arundel and Chichester can survey your property, review how your networks are separated and recommend practical fixes. We have supported businesses since 2015, and we also look after phones and telecoms for hospitality.

Frequently asked questions

Should hotel guest WiFi be separate from the hotel’s own network?

Yes. Guests should be on their own network, kept apart from reception PCs, the property management system, card terminals and CCTV. If you take card payments, PCI DSS requires network security controls between all wireless networks and the cardholder data environment, with wireless traffic into it denied by default.

How many WiFi access points does a hotel need?

It depends on the building rather than the number of rooms alone. Thick walls, long corridors, several floors and outdoor areas all change the answer. A site survey that measures signal room by room is the reliable way to plan coverage, and it avoids paying for access points you do not need.

Can a hotel collect guest email addresses through the WiFi login page?

Yes, but marketing emails need valid consent unless the soft opt-in applies. The ICO says consent must be freely given, that making marketing a condition of a service is unlikely to be valid consent, and that pre-ticked boxes must not be used. Keep the WiFi login and the marketing choice separate.

Is open guest WiFi without a password safe?

Open WiFi lets anyone nearby join and offers guests less protection. A password shared at check-in or a login page, combined with client isolation so guest devices cannot see each other, is a safer setup. Your own staff and payment systems should never share a network with guests.

What internet connection does a hotel need for guest WiFi?

Enough to cope with your busiest evening, when many guests are streaming and calling at once. Busy hotels often need a leased line, which gives the same speed in both directions with a business service level agreement, plus a backup connection so WiFi stays up if the main line fails.

Does hotel guest WiFi need content filtering?

Some venues filter guest WiFi to block harmful content. Friendly WiFi is a voluntary accreditation, supported by the government, which confirms that a venue’s public WiFi blocks pornography and child abuse content. It is worth considering if families stay with you.

Sources

PCI Security Standards Council: PCI DSS v4.0.1, requirements 1.3.3, 2.3.1, 2.3.2 and 11.2.1
ICO: How do we comply with the PECR electronic mail marketing rules?
Microsoft Threat Intelligence: Phishing campaign impersonates Booking.com, March 2025
DSIT: Cyber Security Breaches Survey 2025/26, published 30 April 2026
UK Safer Internet Centre: What is the Friendly WiFi scheme?

This guide is general information, not legal or compliance advice. Check your PCI DSS obligations with your card provider.

What Is EFM? Ethernet First Mile Explained for UK Businesses (2026)

Posted on 10 October 202615 October 2026 by Jake Boase

The short answer: EFM (Ethernet in the First Mile, often called Ethernet First Mile) is a business internet connection that bonds between two and eight copper telephone pairs from your local exchange to give the same speed in both directions, usually up to about 35 Mbps, with a business service level agreement. Today it is outpaced by full fibre and fibre leased lines, and it runs on the copper network Openreach is retiring, so most businesses should treat EFM as a stopgap rather than a long-term choice.

In this guide:

What is EFM?
How does EFM work?
How fast is EFM?
EFM vs FTTC, full fibre and fibre leased lines
Is EFM being switched off?
Is EFM still worth it?
If you have an EFM line now
Frequently asked questions
Sources

What is EFM?

EFM stands for Ethernet in the First Mile. The name comes from the IEEE 802.3ah standard, approved in 2004, which set out ways to carry Ethernet over the “first mile” between a telecoms network and a customer’s building. In the UK, the term almost always means one thing: a business connection delivered over several ordinary copper telephone pairs, bonded together to act as one line.

You will see EFM sold under several names, including Ethernet First Mile, EFM leased line, copper leased line, bonded copper and Ethernet over copper. They all describe the same idea. What sets EFM apart from broadband is how it behaves:

Symmetrical speed. Uploads are as fast as downloads, which matters for cloud backups, video calls and remote access.
Usually uncontended. The bandwidth is yours rather than shared with neighbouring premises, so it should not slow down at busy times.
Business service level agreement. Providers commit to fix time targets, often with compensation if they miss them, rather than broadband’s best efforts.
Resilience built in. If one copper pair develops a fault, the line usually stays up at a lower speed on the remaining pairs.

How does EFM work?

An EFM line uses the same kind of copper pairs that carry a traditional phone line. Instead of one pair, the provider connects several, usually between two and eight, from your premises back to equipment in your local telephone exchange. Each pair carries a symmetrical DSL signal, and the equipment at each end combines, or “bonds”, them into a single Ethernet connection. From the exchange, your traffic travels over the provider’s fibre network.

Because the copper runs all the way to the exchange rather than to a nearby street cabinet, distance matters a great deal. The IEEE standard’s long reach copper option is rated at up to about 5.7 Mbps per pair at distances of up to 2.7 km, and speeds fall as the cable gets longer. UK providers generally offer EFM only within roughly 4 to 4.5 km of cable from the exchange.

One major EFM provider quotes a typical installation time of about 25 working days, quicker than a fibre leased line because it uses existing copper. For comparison, our leased line cost guide suggests planning for 30 to 90 working days for a fibre leased line.

How fast is EFM?

Most UK EFM services run from 2 Mbps up to about 35 Mbps, the same in both directions. Some providers cap their EFM product lower, for example at 20 Mbps over two or four pairs. Three things decide what you can get:

Number of pairs. More bonded pairs means more bandwidth, up to the provider’s maximum, usually eight pairs.
Distance from the exchange. The further the copper runs, the weaker the signal and the lower the speed.
Line quality. Older or longer copper, joints and electrical interference all reduce the speed each pair can carry.

Providers often guarantee a speed below the line’s maximum, so check the guaranteed figure in the contract rather than the headline. To see what a given speed means in practice, try our upload and download time calculator.

EFM vs FTTC, full fibre and fibre leased lines

	EFM	FTTC broadband	Full fibre broadband	Fibre leased line
Typical maximum speed	Up to about 35 Mbps	Up to 76 Mbps download	Up to 1,600 Mbps download	10 Mbps to 10 Gbps
Upload speed	Same as download	Much slower than download	Slower than download, for example 115 Mbps on a 1 Gbps service	Same as download
Shared with others	Usually not	Yes	Yes	No
Service level agreement	Business SLA	Broadband terms	Broadband terms	Business SLA
Runs over	Bonded copper pairs to the exchange	Fibre to the cabinet, copper to you	Fibre all the way	Dedicated fibre all the way

FTTC and full fibre maximum speeds are as quoted by Openreach. Fibre leased line speeds are the range we supply.

EFM vs a fibre leased line

Both give you symmetrical, dedicated bandwidth with a business service level agreement. The difference is headroom. EFM tops out at about 35 Mbps, while a fibre leased line starts at 10 Mbps and can grow to 10 Gbps on the same connection. Ours start from £200 a month plus VAT. For most businesses that need guaranteed bandwidth, a fibre leased line is now the better long-term choice.

EFM vs FTTC and full fibre broadband

FTTC and full fibre are broadband: faster downloads, usually for less money, but shared bandwidth, slower uploads and no business-grade guarantees. If your business mainly downloads and can live with broadband terms, full fibre will usually beat EFM on speed and price. If you depend on uploads, hosted phone calls or a guaranteed fix time, EFM or a fibre leased line gives you more certainty.

Is EFM being switched off?

We have not seen a published national switch-off date for EFM. But EFM depends on two things that are being phased out: Openreach’s copper lines and the local exchanges they connect to.

Copper is being retired. Openreach stopped selling new analogue phone lines nationally on 5 September 2023, and BT intends to retire the old analogue phone network by 31 January 2027.
Copper sales stop exchange by exchange. Under Ofcom’s copper retirement rules, once full fibre reaches more than 75% of premises in an exchange area, Openreach can stop selling copper-based services there, with a year’s notice to providers.
Exchanges are closing. Openreach plans to close around 4,600 of its roughly 5,600 exchanges, starting with 105 sites due to be completed by around 2030/31.

EFM equipment sits in the local exchange, so as copper is withdrawn and exchanges close, EFM services will have to move. The practical advice is the same whatever the exact timing: if your business relies on EFM, plan your move to fibre now, while you can choose the timing, rather than waiting for a notice.

If you also have phone lines or alarm and payment lines on the old copper network, our guide to the 2027 switch-off covers what needs to move.

Is EFM still worth it?

EFM can still make sense in a few situations:

Full fibre is not yet available at your address and a fibre leased line would need significant building work.
You need symmetrical bandwidth and a business service level agreement now, and modest speeds are enough.
You want a second, separate connection as a backup alongside fibre.

If none of these apply, a fibre leased line or full fibre will usually give you more speed for the money and a connection that will not need replacing as copper is retired. For a backup line that does not rely on copper at all, 4G and 5G business mobile broadband is another option.

If you have an EFM line now

Find your contract end date and any notice period, so you can plan a move without paying to leave early.
Check what is available at your address. Full fibre coverage has grown quickly, so it is worth checking again even if it was not available last time.
Look at your usage. If cloud backups, video calls or file uploads are slow, you have probably outgrown EFM already.
Ask your provider whether your exchange is in a stop sell area or on the closure list.
Allow time for a fibre install. A fibre leased line can take several months, so start well before your EFM contract ends.

Our team in Arundel and Chichester can check what is available at your premises and give you a straight answer on whether full fibre, a leased line or business broadband is the right replacement. We have supported businesses since 2015 and manage the carrier for you.

Frequently asked questions

What does EFM stand for?

EFM stands for Ethernet in the First Mile, often shortened to Ethernet First Mile. It comes from the IEEE 802.3ah standard approved in 2004, which defined ways to run Ethernet over the connection between a telecoms network and a customer’s premises, including over ordinary copper telephone pairs.

Is EFM a leased line?

EFM is often sold as a copper leased line. Like a fibre leased line it gives you the same speed up and down, is usually uncontended and comes with a business service level agreement. The difference is that it runs over bonded copper telephone pairs rather than a dedicated fibre, so speeds are much lower, typically up to about 35 Mbps.

How fast is EFM?

Most UK EFM services offer between 2 Mbps and about 35 Mbps, the same in both directions. The speed you can get depends on how many copper pairs are bonded, usually two to eight, and how far your premises are from the telephone exchange.

How far from the exchange can you get EFM?

Providers generally limit EFM to premises within roughly 4 to 4.5 km of cable from the exchange, and speeds drop as the distance grows. The cable route is often longer than the straight line distance, so an availability check at your address is the only reliable answer.

Is EFM being switched off?

We have not seen a published national switch-off date for EFM. However, EFM runs over the copper network that Openreach is retiring, and Openreach plans to close around 4,600 of its roughly 5,600 exchanges, starting with 105 sites due to be completed by around 2030/31. Businesses on EFM should plan their move to fibre rather than wait for a deadline.

What is the difference between EFM and FTTC?

FTTC is shared fibre broadband to the street cabinet, with copper for the last stretch. It offers faster downloads, up to 76 Mbps according to Openreach, but much slower uploads and no business-grade guarantees. EFM gives a lower but symmetrical, usually uncontended speed with a business service level agreement.

Sources

Ethernet in the first mile (IEEE 802.3ah), overview of the standard
Openreach: fibre broadband, FTTC and full fibre speeds
Openreach: retiring the copper network
Ofcom: copper retirement second threshold statement, 9 September 2026
The Register: Openreach copper stop sell, October 2024
ISPreview: Openreach exchange closures, February 2025
Published specifications from UK EFM providers, for speeds, pairs, distances and installation times

Speeds, distances and availability vary by provider and address. This guide reflects what we found in October 2026.

Cyber Security and Resilience Bill: What It Means for Small Businesses (2026)

Posted on 9 October 202615 October 2026 by Jake Boase

The short answer: The Cyber Security and Resilience Bill updates the UK’s cyber security law for essential services and, for the first time, brings medium and large managed IT providers into scope. In-scope providers will have to register with the Information Commission, put proportionate security measures in place, report significant incidents within 24 hours and tell affected customers. Most small businesses will not be regulated directly, but the Bill will change what you can expect from your IT provider, and from larger customers you supply. It is not law yet: it has passed the Commons and its Lords Committee stage, and Lords Report stage is scheduled for 26 October 2026.

In this guide:

What is the Cyber Security and Resilience Bill?
Where has the Bill got to?
Who does it apply to?
Why IT providers are being brought in
What in-scope IT providers will have to do
Does it affect my business?
Eight questions to ask your IT provider
What to do now
Frequently asked questions
Sources

What is the Cyber Security and Resilience Bill?

The Cyber Security and Resilience (Network and Information Systems) Bill reforms the Network and Information Systems Regulations 2018, known as the NIS Regulations. These are the UK’s only cross-sector cyber security law, and they cover essential services such as energy, transport, health, drinking water and digital infrastructure, plus some digital services like cloud computing and online marketplaces. The government describes the 2018 rules as out of date and insufficient.

The Bill has three pillars: widen the scope to cover more of the organisations essential services depend on, give regulators stronger tools, and let the government update the rules quickly as threats change. It also requires more incidents to be reported. The government’s summary of the Bill sets out why:

Cyber attacks are estimated to cost UK businesses £14.7 billion a year, about 0.5% of GDP.
Over 40% of UK businesses experienced a cyber attack, equivalent to more than 600,000 organisations.
The National Cyber Security Centre (NCSC) handled 429 incidents in the year to September 2025, of which 204 were nationally significant, more than double the previous year.

Where has the Bill got to?

The Bill was introduced in the House of Commons in November 2025 and has completed its Commons stages. In the House of Lords it has finished Committee stage, and Report stage is scheduled for 26 October 2026, with Third Reading to follow. The latest version, as amended in Grand Committee, was published on 7 September 2026.

Royal Assent is only the start. A few measures take effect on Royal Assent or two months after, but most of the new duties, including those for managed service providers, critical suppliers and incident reporting, will be switched on later through secondary legislation. The government plans to consult on the detail during 2026 and has said affected organisations will get an adjustment period before new duties apply. We will update this guide as that detail is published.

Who does it apply to?

Who	Covered now (NIS 2018)	Covered under the Bill
Operators of essential services (energy, transport, health, water, digital infrastructure)	Yes	Yes
Some digital services (cloud computing, online marketplaces, search engines)	Yes, medium and large only	Yes, medium and large only
Managed service providers (IT providers)	No	Yes, medium and large
Data centres	No	Yes, above set thresholds
Large load controllers	No	Yes, above set thresholds
Critical suppliers designated by a regulator	No	Yes, of any size

Source: government factsheets on the Bill, updated 30 June 2026.

Why IT providers are being brought in

Managed service providers usually have broad, trusted access to their customers’ systems. That makes them an attractive target: one successful attack on a provider can reach many businesses at once. The government’s factsheet on managed service providers points to an incident in May 2024 involving an MSP that put the personal data of around 270,000 serving military personnel, reservists and veterans at risk. Its 2025 policy statement estimated that this measure would bring a further 900 to 1,100 MSPs into scope.

A provider is in scope if it provides managed services in the UK, meaning the ongoing management of a customer’s IT systems with access to those systems, and is not a small or micro enterprise. The government gives examples:

In scope	Out of scope
An IT company managing a business’s systems, on site or remotely, including backups, monitoring and firewall management	A company that installs IT systems but does not manage them afterwards
An IT security company providing ongoing firewall management and incident response through a connection to the customer’s systems	A software company selling software as a product, including ad hoc remote patch updates
An IT company providing ongoing management of a cloud service, including configuration and monitoring	An accountancy, tax or legal firm advising by email, phone or in person

The small business exemption

Small and micro providers are exempt from the managed service provider duties. The Bill defines size using the EU test in Commission Recommendation 2003/361/EC, the same test the current rules use for digital services:

Size	Staff	Turnover or balance sheet total
Micro	Fewer than 10	Up to €2 million
Small	Fewer than 50	Up to €10 million
Medium	Fewer than 250	Turnover up to €50 million or balance sheet up to €43 million

So many local IT providers, including the smaller firms most small businesses use, will fall outside the managed service provider rules. Two caveats: a provider that is part of a larger group may have to count the whole group, and any provider, however small, can be designated as a critical supplier.

What in-scope IT providers will have to do

Register with the Information Commission, the body formerly known as the ICO, which will regulate managed service providers.
Manage risk by taking appropriate and proportionate measures to protect the systems their managed services rely on, and to prevent and limit the impact of incidents.
Report significant incidents with a short initial notification within 24 hours and a full report within 72 hours, sent to the regulator with the NCSC informed at the same time. (Incident reporting factsheet.)
Tell affected customers. After reporting, providers will have to identify customers likely to have been affected and notify them with details of the incident.
Appoint a UK representative if they are based overseas.

Regulators will be able to inspect, issue enforcement notices and fine. Under the Bill, maximum penalties rise to £17 million or 4% of worldwide turnover, whichever is higher, for the more serious breaches, and £10 million or 2% for less serious ones. What counts as a “significant” incident will be set out in secondary legislation after consultation.

Does it affect my business?

If you run a small business that is not an essential service and not an IT, cloud or data centre provider, the Bill is unlikely to regulate you directly. It can still reach you in three ways.

1. Through your IT provider

If your IT provider is medium or large, it will be regulated. You should see clearer incident notifications, more scrutiny of how it secures remote access to your systems, and possibly new contract terms. If your provider is small, the law will not require any of this, but nothing stops you asking for the same standards.

2. If you supply essential services

Regulators will be able to designate a supplier as critical if it directly supplies an operator of essential services, or a regulated digital or managed service provider, relies on IT to do so, and a disruption to it would have a significant impact on the economy or daily life in the UK. Size is no barrier: small and micro businesses can be designated. Designation follows a set process, including consultation, and can be appealed. We expect it to be uncommon, but it is worth knowing about if you supply the NHS, energy, water or transport.

3. Through larger customers

We expect regulated organisations, and the larger businesses that supply them, to look harder at the security of the suppliers they depend on. In practice that means more security questionnaires and more requests for evidence such as Cyber Essentials when you tender for work. Our analysis of government data shows Cyber Essentials uptake is already rising fast, with contracts among the main reasons firms certify.

Eight questions to ask your IT provider

Whether or not your provider is in scope, these questions tell you a lot about how seriously it takes the access it has to your business:

Are you in scope of the Cyber Security and Resilience Bill as a managed service provider, and if not, why not?
If you have a security incident that could affect us, how quickly will you tell us, and is that written into our contract?
How is your remote access to our systems secured? Does every engineer account use multi-factor authentication?
Who in your team has administrator access to our systems, and how is that access removed when someone leaves?
Do you hold Cyber Essentials, or Cyber Essentials Plus? When was it last renewed?
Where are our backups held, how often are they tested, and could an attacker who got into our network delete them?
Do you have an incident response plan for your own business, and have you tested it?
Which other companies do you rely on to support us, such as remote monitoring tools or cloud platforms, and how do you check their security?

If you are weighing up a change of provider, our guide to how managed service providers work explains what a good one should cover.

What to do now

This Bill does not require small businesses to do anything yet, although existing data protection law already does, including reporting serious personal data breaches. The measures behind the Bill are simply good practice, and most are cheap or free:

Get the basics certified. Cyber Essentials covers the five controls that stop most common attacks, and it is increasingly what customers ask for.
Turn on multi-factor authentication for every cloud service and every admin account, including your IT provider’s.
Check your backups are separate from your main network and that someone has actually tested a restore.
Write a one-page incident plan: who to call, how to reach your IT provider out of hours, and when to contact your insurer and the Information Commission (formerly the ICO).
Use the free NCSC tools. The Cyber Action Toolkit gives small businesses a tailored set of actions, and Early Warning is a free NCSC service that alerts you to potential attacks on your network.
Check your email domain. Our free DMARC checker shows in seconds whether criminals can send email that looks like it came from you.

If you would like a second opinion on where your business stands, our cyber security services team in Arundel and Chichester can review your setup and your current provider’s access. We are Cyber Essentials certified ourselves and have supported businesses since 2015.

Frequently asked questions

Is the Cyber Security and Resilience Bill law yet?

Not yet. It has passed the House of Commons and its Lords Committee stage, and Lords Report stage is scheduled for 26 October 2026, with Third Reading to follow. Even after Royal Assent, most of the new duties, including those for managed service providers, will only start once secondary legislation is made, and the government has said affected organisations will get time to adjust.

Does the Cyber Security and Resilience Bill apply to small businesses?

Most small businesses are not directly regulated. The Bill covers operators of essential services, data centres, large load controllers, and medium and large managed and digital service providers. A small business can still be designated as a critical supplier if it supplies a regulated organisation and a disruption would have a significant impact on the UK.

Which IT providers are covered by the Bill?

Managed service providers that provide ongoing management of IT systems for UK customers, such as remote monitoring, backups or firewall management, unless they are a small or micro enterprise. The Bill uses the EU definition, under which a small enterprise has fewer than 50 staff and turnover or balance sheet of no more than 10 million euros.

How quickly will incidents have to be reported?

In-scope organisations will have to send a short initial notification within 24 hours of becoming aware of a significant incident, and a full report within 72 hours. Managed service providers will also have to identify customers likely to have been affected and tell them.

Who will regulate managed service providers?

The Information Commission, the body formerly known as the ICO. In-scope providers will have to register with it, and it will be able to inspect, enforce and fine.

What are the fines under the Bill?

Up to 17 million pounds or 4% of worldwide turnover, whichever is higher, for the more serious breaches, and up to 10 million pounds or 2% of worldwide turnover for less serious ones. Regulators decide the actual amount within those limits.

Sources

UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill, bill page and current version (as amended in Grand Committee, 7 September 2026)
GOV.UK: Summary of the Bill, factsheet updated 30 June 2026
GOV.UK: Relevant managed service providers, factsheet updated 30 June 2026
GOV.UK: Incident reporting, factsheet updated 30 June 2026
GOV.UK: Enforcement, factsheet updated 30 June 2026
GOV.UK: Designating critical suppliers
DSIT: Cyber Security and Resilience Policy Statement, April 2025
The Network and Information Systems Regulations 2018, regulation 1
NCSC: Cyber Action Toolkit announcement
NCSC: Early Warning

This guide explains the Bill as it stood in October 2026. It is general information, not legal advice.

How Much Does a Leased Line Cost in the UK? 2026 Prices Explained

Posted on 8 October 202615 October 2026 by Jake Boase

The short answer: A leased line for a UK business typically costs about £200 to £400 a month for 100Mbps and £350 to £700 a month for 1Gbps, excluding VAT, on a three-year contract, according to published UK price guides. For 10Gbps, Selectra’s guide gives about £1,500 to £3,000 a month. Installation is often free on a 36 or 60-month contract, but if the carrier has to build new ducts or dig up a road to reach you, excess construction charges can add thousands of pounds. Our own leased lines start from £200 a month, excluding VAT, and every quote is for your exact address.

Last updated: 8 October 2026. Prices checked against UK leased line price guides published between January and October 2026. Leased line prices are quoted per address, so treat every figure here as a guide, not a quote.

In this guide

What is a leased line?
How much does a leased line cost per month?
Installation and excess construction charges
What affects the price?
How long does installation take?
Leased line vs full fibre broadband
Can you get help with the cost?
How to get an accurate quote
Leased lines from ATS Connection
Frequently asked questions

What is a leased line?

A leased line is a private fibre connection between your premises and your provider’s network that nobody else shares. You get the full speed you pay for in both directions, all day, and it comes with a business service level agreement that sets out how quickly faults must be fixed.

Leased lines usually differ from ordinary broadband in three ways:

Dedicated. The capacity is yours alone, so speeds do not drop when the neighbours start streaming at five o’clock.
Symmetric. Upload is as fast as download, which matters for cloud backups, video calls, large files and phone systems.
Backed by a service level agreement. Faults are fixed against targets set out in the agreement, usually with compensation if they are missed.

That is what you are paying for. If your business runs on Microsoft 365, cloud software and internet phones, the connection has become as important as the electricity, and a leased line is how you make it dependable. Our guide to fibre broadband explains the cheaper options it is usually compared with.

How much does a leased line cost per month?

Published UK price guides put a leased line between 100Mbps and 1Gbps at about £200 to £700 a month, excluding VAT. The speed matters less than you might expect: in those guides, going from 100Mbps to 1Gbps costs less than double, partly because the cost of reaching your building is much the same whatever the speed.

Leased line prices, 2026

What a leased line costs each month, by speed

Indicative UK monthly leased line prices on a 36-month contract, excluding VAT and any excess construction charges, with business full fibre for comparison.

Business full fibre1Gbps, for comparison

£30 to £50

Leased line100Mbps

£200 to £400

Leased line500Mbps

£325 to £625

Leased line1Gbps

£350 to £700

Leased line10Gbps

£1,500 to £3,000

£0£1,000£2,000£3,000 a month

Source: Selectra’s UK leased line price guide (accessed October 2026). Your own price depends on your address, the carrier and the contract length.

Different guides publish slightly different figures, so here are three side by side. They broadly agree:

Speed	Selectra (36 months)	Business Broadband Hub (60 months)	Babble
100Mbps	£200 to £400	£175 to £312	From around £200
500Mbps	£325 to £625	£257 to £332	Not given
1Gbps	£350 to £700	£300 to £450	Typically from £300
10Gbps	£1,500 to £3,000	Bespoke quotes (city estimates from £1,500)	Well above £1,000

Monthly prices from Selectra (excluding VAT, accessed October 2026), Business Broadband Hub (urban quotes, September 2026) and Babble (January 2026). Business Broadband Hub and Babble do not say whether their figures include VAT.

You will also see much lower “from” prices advertised. Amvia, for example, shows 100Mbps from £69 a month and 1Gbps from £129, while quoting a wider range of up to about £400 and £700. Amvia says these are indicative and depend on your postcode and which carriers reach you, so treat them as a floor rather than an expectation.

Over a typical three-year contract, a 1Gbps line at £350 to £700 a month comes to roughly £12,600 to £25,200 before VAT. That is the number to compare with the cost of your team losing its connection for a day.

What does leased line installation cost?

On a three or five-year contract, standard installation is often included, and published guides commonly describe it as free on those terms. On a one-year contract, or where the line needs more work, expect a one-off charge. These are the costs that can sit on top of the monthly rental:

Cost	Typical published range	When it applies
Installation or connection	Free to £3,000 for up to 1Gbps	Often waived on 36 or 60-month contracts
Excess construction charges	Nil to £10,000 or more	When new ducts, poles or roadworks are needed
Wayleave	Nil to £10,000 or more	When a landlord’s permission is needed to run fibre through their property
Router or other hardware	Nil to £200	Often included by the provider
Backup connection	£20 to £80 a month	Optional, to keep you online if the leased line fails
Static IP addresses	£3 to £5 per address a month	Some providers include a set number

Ranges from Selectra and Business Broadband Hub, 2026. Selectra’s figures exclude VAT; Business Broadband Hub does not say.

What are excess construction charges?

Excess construction charges, often shortened to ECCs, are what a carrier charges when reaching your building costs more than its standard installation covers: new ducts, extra poles, a longer fibre run or roadworks. On new Openreach Ethernet Access Direct lines, Openreach absorbs the first part of that cost. In March 2026 it told providers it was raising that allowance from £2,800 to £3,680, excluding VAT, according to ISPreview.

In a city centre with fibre already in the street, ECCs are usually nil. On a rural site or a new-build estate they can be large: Selectra says £15,000 to £50,000. The important thing is when you find out. ECCs often only come to light after you have signed and the carrier has surveyed the route, so ask for a written ECC assessment, and how any ECC will be handled, before you sign.

What affects the price of a leased line?

Two businesses on the same street can be quoted different prices, because the price is worked out for each address. The main factors are:

Distance to the nearest fibre. The closer your building is to an existing fibre point, the cheaper the line and the less risk of construction charges.
Which carriers reach you. More competing networks at your address usually means keener prices.
Speed. Faster lines cost more, but the jump from 100Mbps to 1Gbps is usually smaller than people expect.
Contract length. Three and five-year terms usually bring lower monthly prices and free installation. One-year terms cost more on both.
Resilience. A backup line, or a second leased line by a different route, adds cost but keeps you online when the main line fails.
The service level agreement. Faster fix times and round-the-clock repair usually cost more than standard cover.

How long does a leased line take to install?

Plan for about 30 to 90 working days from order to going live, which is roughly six weeks to four months. Published UK guides put a typical installation in that range: Amvia says 30 to 90 working days, and Selectra says 45 to 90 working days for an established site, and six to nine months for some rural sites and business parks.

From order to live

How long a leased line takes to install

A typical order, step by step. The pink steps are where delays and extra costs often come from.

Step 1

Quote

The provider checks which carriers reach your address and prices the line.

Step 2

Order and survey

An engineer surveys the route into your building and where the equipment will go.

If needed

Excess construction charges

If new ducts, poles or roadworks are needed, the carrier may quote extra build costs after the survey.

Step 3

Build and permissions

Fibre is laid to your building. A landlord wayleave or a road permit can add weeks.

Step 4

Install, test and go live

Usually 30 to 90 working days after you order. Equipment is fitted, the line is tested and your network moves across.

The 30 to 90 working day range reflects figures published by UK providers and price guides in 2026. Rural sites and business parks that need new construction can take six months or more.

Delays usually come from the physical build: permits to dig, a landlord who has to sign a wayleave, or a blocked duct. If you are moving office or your current contract ends on a fixed date, order the leased line early and keep a broadband or 4G connection in place until it is live.

Leased line vs full fibre broadband: which do you need?

Full fibre broadband has narrowed the gap. It is fast and far cheaper, and for many small offices it is enough. The difference is in what happens at busy times, how fast you can upload, and what happens when it breaks.

	Leased line	Full fibre broadband
Capacity	Dedicated to you	Shared with other premises on the same part of the network
Upload speed	The same as download	Usually much lower than download
Repairs	Fix times set out in a service level agreement	Usually standard broadband support, without a financially backed service level agreement
Price for 1Gbps	About £350 to £700 a month, excluding VAT	About £30 to £50 a month for business plans
Time to install	Usually 30 to 90 working days	Usually much quicker where full fibre is already available

Prices from Selectra, 2026.

As an example of the upload gap, the fastest consumer full fibre package that Openreach described in August 2024 offered 1.8Gbps download but 120Mbps upload, according to ISPreview. A leased line of 1Gbps gives you 1Gbps both ways. To see how long your own backups or files would take on each, try our upload and download time calculator.

A leased line is usually worth it when:

A lost connection would stop the whole business, not just slow it down.
Your phones run over the internet, as most business phones will once the old phone network closes. Our guide to the Big Switch Off in January 2027 explains the deadline.
You upload a lot: cloud backups, large drawings or video, or many people on video calls at once.
Many people rely on the same connection at once, or you link several sites together.

If that does not sound like you, full fibre broadband with a 4G or 5G backup is often the better value. Our business broadband page covers those options, and you can test your current broadband speed to see where you stand today. If you have been offered EFM, a copper alternative to a fibre leased line, our guide to EFM explains how it compares.

Can you get help with the cost of a leased line?

Not through the main national scheme any more. The government’s Gigabit Broadband Voucher Scheme closed to new voucher project submissions on 31 August 2026, according to GOV.UK, although projects already agreed can still be delivered. Some local authorities have run their own schemes, so it is worth checking with your council, but do not build a voucher into your budget.

The more reliable ways to cut the cost are a longer contract, choosing the speed you actually need rather than the fastest on offer, and getting quotes from providers that can use more than one carrier at your address.

How do you get an accurate leased line quote?

Because every price is worked out for one address, a useful quote needs a few details from you, and a few answers from the provider. Ask for these before you compare prices:

The full address and postcode, including the floor or unit, so the right building is checked.
Which carrier and which speed, and whether the speed can be increased later without a new installation.
Installation charges, in writing, including what happens if excess construction charges come back after the survey.
The service level agreement: the guaranteed fix time, whether it covers evenings and weekends, and any compensation if it is missed.
What backup is included, if any, and what it costs to add.
Who supports it day to day. When the internet stops, you want one number to call, not a carrier’s queue.

Leased lines from ATS Connection

We supply business leased lines at speeds up to 10Gbps, starting from £200 a month, excluding VAT. Every quote is for your exact address and sets out the installation timeline, so you know what you are getting before you commit, and we can add failover so your business stays online if the main line has a problem.

Because we are also an IT support company, the same team that supplies your line looks after the network, WiFi, phone system and computers that depend on it. When something stops working, you call one number and we find the fault, whichever part of the chain it is in. We have looked after businesses from Arundel since 2015, and today support more than 100 businesses from offices in Arundel and Chichester.

For a price for your building, request a leased line quote, or book a free IT review if you want a wider look at whether your connection, network and phones are ready for the next few years.

Frequently asked questions

How much does a leased line cost per month in the UK?

Published UK price guides put a 100Mbps leased line at about £200 to £400 a month and a 1Gbps line at about £350 to £700 a month, excluding VAT, on a three-year contract. For 10Gbps, one guide gives about £1,500 to £3,000 a month. The exact price depends on your address.

Is leased line installation free?

Standard installation is often included on 36 or 60-month contracts. Shorter contracts usually carry a one-off installation charge, and excess construction charges apply if the carrier has to build new ducts, poles or roadworks to reach you.

What are excess construction charges?

Excess construction charges are extra costs a carrier passes on when reaching your building needs more work than standard installation covers, such as new ducts or roadworks. They are usually nil in city centres but can run into thousands of pounds on rural sites, and are often confirmed after a site survey.

How long does a leased line take to install?

Typically 30 to 90 working days from order, which is roughly six weeks to four months. Sites that need new construction, wayleaves or road permits can take six months or more.

Is a leased line worth it for a small business?

It is worth it when losing the connection would stop the business, when phones and key systems run over the internet, or when you upload a lot of data. For a small office without those needs, full fibre broadband with a 4G or 5G backup is often better value.

What is the difference between a leased line and fibre broadband?

A leased line is dedicated to your business, has the same upload and download speed, and comes with fix times set out in a service level agreement. Full fibre broadband is shared with other premises, usually uploads much more slowly than it downloads, and is repaired on broadband terms, but costs far less.

Sources

Onsite vs Remote IT Support: What Gets Fixed Where, and What It Costs

Posted on 7 October 202614 October 2026 by Jake Boase

The short answer: Remote IT support fixes problems over a secure connection without anyone travelling, and in our experience it handles most day-to-day issues: accounts, email, software and slow computers. Onsite IT support means an engineer comes to your premises, which you need for physical jobs such as swapping a failed part, installing a network or moving office. Most small businesses do best with both: remote support first, because it is faster, and an engineer on site when a job needs hands on. The question to ask a provider is not which one they do, but how on-site visits are covered and charged.

Last updated: 7 October 2026. ONS hybrid working figures and NCSC guidance checked on the same date.

In this guide

What is onsite IT support?
What is remote IT support?
Onsite vs remote IT support: the difference
Which IT jobs need an engineer on site?
What about staff who work from home?
Is remote IT support secure?
How much does onsite IT support cost?
Do you need a local IT company?
Onsite and remote IT support from ATS Connection
Frequently asked questions

What is onsite IT support?

Onsite IT support is when an IT engineer comes to your office, shop or site to do the work in person. It is the traditional model: something breaks, someone visits, and the engineer fixes it at the desk or in the comms cupboard.

Today it is mostly used for work that cannot be done any other way, because it involves touching equipment:

Replacing failed hardware, such as a laptop screen, a hard drive or a network switch.
Installing and cabling networks, WiFi access points, firewalls and comms cabinets.
Setting up phone systems, broadband and new offices, and handling office moves.
Tracing physical faults, such as a cable unplugged under a desk or a failing power supply.

Some businesses also like regular scheduled visits, for example a day a month, so staff can raise things face to face. That can suit larger offices, but for many small teams it is hard to justify, because problems rarely wait for the visit.

What is remote IT support?

Remote IT support is when an engineer fixes a problem without being in the room. Your staff contact the helpdesk, and the engineer connects securely to the computer or the system involved, sees what the user sees and fixes it while they talk. Nobody travels, so the fix can start within minutes.

Good remote support also works when nobody has called. Monitoring software on each device reports problems such as a failing disk, a stopped backup or missing security updates, so many faults are fixed before anyone notices them. Our post on remote monitoring and management explains how those tools work, and our guide to proactive IT support covers the routine work they make possible.

Because so much business software now lives in Microsoft 365 and other cloud services, many IT problems are not in the building at all. A Teams issue, a shared mailbox or a OneDrive sync fault gets fixed the same way whether the user is at their desk, at home or in a hotel.

Onsite vs remote IT support: what is the difference?

The difference is where the engineer is. That one fact changes how fast help arrives, what it costs and which problems it can solve.

	Remote IT support	Onsite IT support
How it works	An engineer connects securely to the device or system	An engineer comes to your premises
How fast help starts	Can start within minutes of the call	When an engineer can travel to you
Best for	Accounts, email, Microsoft 365, software, settings and security alerts	Hardware, cabling, networks, installs and office moves
Home and hybrid workers	Same service wherever they are	Only practical at the office
Typical charging	Usually included in a monthly fee	Included, capped or charged per visit, depending on the contract
Limits	Cannot touch hardware	Slower, and travel time costs money

How remote and onsite IT support compare.

So it is rarely a choice of one or the other. Remote support should be the first response for almost everything, because it is faster and works for everyone. Onsite support is the backstop for physical work. The best arrangements diagnose remotely first, so when an engineer does visit, they already know the fault and bring the right part.

Remote-first, on site when needed

How a problem gets fixed with remote-first support

A software or account problem

Step 1

You report it

By phone or email, to a helpdesk that knows your setup.

Step 2

Engineer connects

A secure remote session, with the user’s permission.

Done

Fixed on the call

No travel, no waiting for a visit.

A physical fault

Step 1

You report it

The same call, the same helpdesk.

Step 2

Remote diagnosis

The engineer confirms what has failed before anyone travels.

Step 3

Visit booked

An engineer comes on site, with the right part.

Done

Fixed and recorded

The device record is updated afterwards.

Which IT jobs need an engineer on site?

In our experience, most day-to-day requests never need a visit. The jobs that do are physical, and many of them are planned projects rather than emergencies. This is how the requests we see at ATS Connection usually split:

Where each job gets fixed

Remote, on site, or both? Common IT jobs sorted

Fixed remotely

Usually sorted on the first call, wherever the person is working.

Password resets and locked accounts
Multi-factor authentication problems
Outlook, Teams, OneDrive and SharePoint
Software installs, updates and licences
New starters and leavers
Security alerts and suspicious emails

Starts remote, may need a visit

Diagnosed remotely first, so any visit is for a known fault.

Slow or misbehaving laptops and PCs
Printers and scanners
WiFi dropping in one part of the office
Internet down for the whole office
A device that will not start

Needs an engineer on site

Hands-on jobs, often planned and priced in advance.

Swapping a failed part
New network, WiFi and cabling installs
Servers, comms cabinets and firewalls
Phone system and broadband installs
Office moves and new office set-ups

Based on how we handle requests at ATS Connection. Your own split depends on your premises and how much of your IT is in the cloud.

The middle column is where a provider proves its worth. A printer that will not print, WiFi that drops in the meeting room or an office that has lost its internet connection can usually be diagnosed remotely, and often fixed remotely too. When they cannot, a remote diagnosis means the visit is short and the fault is already known. For connection problems, our business broadband and WiFi service covers the lines and the network inside the office.

Planned onsite work is different again. Office moves, new networks, server cabinets and phone system installs should be scoped and priced before anyone travels, so there are no surprises on the invoice.

What about staff who work from home?

For home and hybrid workers, remote support is the main option. More than a quarter (28%) of working adults in Great Britain were hybrid working between January and March 2025, according to the Office for National Statistics, and the share has gradually risen since March 2022. An engineer cannot visit every kitchen table, so the support model has to work over the internet.

That changes what good support looks like. Laptops need to be managed and updated wherever they are, files need to live in the cloud rather than on an office server, and the helpdesk has to be able to fix a home worker’s problem as easily as one in the office. If your business has moved to hybrid working but your IT support still assumes everyone sits in the same building, that gap shows up as slow fixes and frustrated staff. Our guide to phone systems for remote and hybrid teams covers the calling side of the same problem.

Is remote IT support secure?

It can be, but the provider’s access to your systems needs as much protection as your own staff’s. Anyone who can connect remotely to your computers holds a powerful key, so the NCSC’s guidance on choosing a managed service provider tells smaller organisations to check how the provider manages and secures its connections into your systems.

The NCSC’s points come down to a few plain questions you can put to any provider:

How do your engineers connect to our systems, and how are those connections secured?
Do your engineers use two-step verification (multi-factor authentication) on their access to our systems, and how do you protect login details, particularly administrative ones?
Do you only have the access you need? The NCSC calls this the principle of least privilege.
Are logs kept, for how long, and can we see them if something goes wrong?
What does the contract say about ending it, and how are old accounts and access dealt with?

A provider that answers those clearly, and in writing, is one you can trust with remote access. Vague answers are a reason to look elsewhere, whatever the price.

How much does onsite IT support cost?

It depends less on the hourly rate than on how visits are covered in the contract. Contracts commonly handle on-site visits in one of three broad ways, and some mix them. The difference matters more than the headline monthly price:

How visits are covered	What it means	What to check
Included	Visits are part of the monthly fee	Whether there is a fair use limit, and which locations are covered
Capped	A set number of visits or hours each month or year	What happens when the cap runs out, and the rate after that
Charged per visit	Remote support is included, and visits are billed at an hourly or day rate	The rate, any minimum charge, and whether travel time is billed

Common ways IT support contracts handle on-site visits.

For comparison, our own prices are published. Day-to-day support is a fixed monthly fee of £30 to £48 per user on Core and £55 to £90 per user on Complete, plus VAT, with an unlimited remote helpdesk. Whether on-site visits are included depends on how close you are to our offices and which package you are on, and we set that out in your quote. Project work such as an office move is quoted separately, or charged at our ad hoc rate of £100 an hour, £340 a half day or £650 a day, plus VAT.

The IT support packages and pricing page has the full breakdown, and our guide to how much IT support costs compares the pricing models used across the UK.

Do you need a local IT company for onsite support?

Local matters for onsite work and matters much less for everything else. Remote support works the same from ten miles away as from a hundred, so for day-to-day help the things to judge are response times, how well the provider knows your setup and whether it is proactive.

Distance starts to count when something physical fails, or when you are planning a project that needs engineers in the building for a day or two. A provider that is a short drive away can be on site the same day without a large travel bill. If you are searching for IT support near you, a sensible test is to ask where the engineer who would visit you is based, and how on-site visits to your address are charged.

A good example of planned onsite work is the refit of Timothy Roe, a jeweller in Chichester. During a shop revamp, our engineers installed a modern server cabinet, replaced ageing workstations and servers, and built a mesh network with new access points. As the Timothy Roe case study records, the business now runs on a stable platform where crashes and sluggish performance are a thing of the past. None of that could have been done remotely, and it was done during the revamp without disrupting the business.

Onsite and remote IT support from ATS Connection

We provide onsite and remote IT support from offices in Arundel and Chichester, and have looked after businesses since 2015. More than 100 businesses rely on us today. Most issues are fixed remotely by named engineers who know your setup: our average response time is under 15 minutes and 98% of issues are resolved at first contact. When a job needs hands on, our engineers come on site across Sussex and into Hampshire, and remote support works the same for your staff wherever they are in the UK.

Our helpdesk is open from 9am to 5.30pm on working days, with urgent out-of-hours support when you need it, and monitoring runs 24/7 in the background. Day-to-day support sits within our fixed monthly business IT support packages, and anything outside them, such as a project or a visit your package does not cover, is quoted before we start.

If you are not sure whether your current setup is getting the right mix, book a free IT review. A senior engineer will review your current setup, security, backups and Microsoft 365, and tell you plainly what can be handled remotely and what needs attention on site.

Frequently asked questions

What is onsite IT support?

Onsite IT support is when an IT engineer visits your premises to do the work in person. It is mainly needed for physical jobs such as replacing failed hardware, installing networks, WiFi and cabling, setting up phone systems and moving office.

Can all IT problems be fixed remotely?

No, but in our experience most day-to-day ones can, including account and password problems, email and Microsoft 365 issues, software installs and security alerts. Hardware failures, cabling and installs need an engineer on site, ideally after a remote diagnosis so the visit is short.

Is remote IT support faster than onsite support?

Usually, yes. A remote session can start within minutes of a call because nobody has to travel. Onsite support depends on when an engineer can get to you, which is why it makes sense to fix what can be fixed remotely first.

Is remote IT support safe?

It is safe when the provider protects its own access to your systems. The NCSC advises checking how the provider secures its remote connections, that its engineers use two-step verification, that it only has the access it needs, and whether it keeps logs and lets you see them.

How much does onsite IT support cost?

It depends on whether your contract includes visits, caps them or charges per visit. Our monthly support is £30 to £90 per user plus VAT; whether on-site visits are included depends on your location and package and is set out in your quote, and project work is quoted separately or charged at our ad hoc rates of £100 an hour, £340 a half day or £650 a day, plus VAT.

Do you offer onsite and remote IT support together?

Yes. Most issues are fixed remotely, and our engineers come on site across Sussex and into Hampshire for jobs that need hands on, such as hardware faults, network installs and office moves.

Sources

Proactive IT Support: What It Is, What It Costs and How to Tell If You Have It

Posted on 7 October 202613 October 2026 by Jake Boase

The short answer: Proactive IT support means your IT provider looks after your systems before anything goes wrong: monitoring devices and backups around the clock, installing security updates on a schedule, replacing ageing hardware before it fails and reviewing your IT with you regularly. Reactive (break-fix) support only acts once something has broken and you have called. For a UK small business, proactive support is usually a fixed monthly fee per user; ours is £30 to £90 per user per month, plus VAT.

Last updated: 7 October 2026. Survey figures checked against the government’s Cyber Security Breaches Survey 2025/2026, with NCSC, IASME and Microsoft guidance checked on the same date.

In this guide

What is proactive IT support?
Reactive vs proactive IT support
What does proactive IT support involve?
Why does it matter for a UK small business?
How much does proactive IT support cost?
How to tell if your IT support is proactive
Is proactive IT support worth it for a small business?
Proactive IT support from ATS Connection
Frequently asked questions

What is proactive IT support?

Proactive IT support is IT support that works to stop problems happening, rather than waiting to be told about them. The provider watches your systems continuously, fixes faults it spots before your staff notice them, keeps everything patched and planned, and still answers the phone when someone needs help.

In practice, a proactive service usually covers:

Monitoring and alerts on computers, servers, backups, security software and the network, so a failing disk, a full drive or a stopped backup raises an alert. Our post on how remote monitoring and management works explains the tools.
Patch management: installing security updates for Windows, applications and firewalls on a schedule, and checking they actually installed.
Security baselines: multi-factor authentication, endpoint protection, email filtering and admin accounts kept to the people who need them.
Backups that are tested, not just running. A backup nobody has restored from is a hope, not a plan. See backup and disaster recovery.
Lifecycle planning: knowing every device, its age and when it needs replacing, so replacements are budgeted rather than emergencies.
Regular reviews where the provider tells you what is coming: risks, renewals, ageing kit and changes in the rules.

None of this replaces the helpdesk. People still get stuck, forget passwords and need a new starter set up. The difference is that the helpdesk deals with genuine requests, not the same preventable faults over and over.

What is the difference between reactive and proactive IT support?

The difference is who notices the problem first. With reactive support you notice, usually when something stops working, and then you pay for the fix. With proactive support the provider is meant to notice first, often before it affects anyone.

	Reactive (break-fix)	Proactive (managed)
Who spots problems	Your staff, when something stops working	Monitoring, often before staff notice
Security updates	When someone remembers or a machine nags	On a schedule, with reports showing what installed
Backups	Assumed to be working	Checked, with test restores
Hardware	Replaced when it fails	Replaced on a plan, before it fails
How you pay	By the hour or by the job	A fixed monthly fee, usually per user
Provider’s incentive	Earns more when things break	Earns the same, so better off when things do not break
Planning	None, unless you ask	Regular reviews of risks, devices and budget

How reactive and proactive IT support compare.

The incentive row matters most. On an hourly model, an unreliable network is good business for the provider. On a fixed monthly fee, every avoidable fault costs the provider time it is not paid extra for, so its interests line up with yours.

Illustrative example

The same failing laptop drive, handled two ways

Reactive support

Weeks 1 to 3The drive logs errors. Nobody is watching, so nobody sees them.
Monday, 8.45amThe laptop will not start and a member of staff cannot work.
MondayA ticket is raised and joins the queue. The laptop goes off for repair.
Later that weekA replacement is bought at short notice. Files come back only if a recent backup exists.

Lost working time, possibly lost files and an unplanned bill.

Proactive support

Week 1Monitoring flags a drive health warning to the support team.
Same dayAn engineer confirms the backup is current and contacts the user.
That weekThe drive or laptop is replaced at a time that suits the user.
AfterwardsThe device record is updated, so the replacement plan stays accurate.

No lost working day, no lost files and a cost that was planned.

What does proactive IT support involve day to day?

Proactive support runs on a regular rhythm: constant monitoring in the background, monthly security updates, routine housekeeping and a periodic review. Most of it is invisible to your staff, which is the point.

What proactive IT looks like

The rhythm behind proactive IT support

Around the clock

Monitoring and alerts

Devices, disk health, backups, security software and the network are watched, and problems raise an alert.

Second Tuesday

Microsoft releases updates

Microsoft publishes its monthly security updates on the second Tuesday of each month.

Within 14 days

Critical updates installed

High-risk and critical updates go on within 14 days, as Cyber Essentials and the NCSC expect.

Every month

Housekeeping

Backups are checked, leavers’ access is confirmed as removed and unused licences are cleared.

At least yearly

Review and plan

Ageing devices, risks, contracts and budget are reviewed, so next year has no surprises.

Two of those dates are set by others. Microsoft publishes its monthly security updates on the second Tuesday of each month, often called Patch Tuesday (Microsoft Learn). And the 14-day window is now a hard rule for anyone with Cyber Essentials: for assessment accounts created after 26 April 2026, failing to install high-risk or critical security updates within 14 days of release is an automatic fail, as is missing multi-factor authentication on cloud services where it is available (IASME). The NCSC gives the same 14-day guidance when advising small businesses on choosing a managed service provider (NCSC).

Windows itself is part of the plan too. Windows 10 reached end of support on 14 October 2025, and since then security updates have only been available through Microsoft’s paid Extended Security Updates programme. A proactive provider will already have a date for replacing or upgrading any machine still running it. Our Windows 10 end of life guide explains the options.

Why does proactive IT support matter for a UK small business?

Because nearly half of small businesses identify a cyber breach or attack each year, and the basic controls that stop attacks are exactly the routine work proactive support does. The government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found:

Finding	UK businesses
Identified a cyber breach or attack in the last 12 months	43% of all businesses (46% of small and 42% of micro businesses)
Experienced phishing, the most common attack	38%
Have a policy to apply software security updates within 14 days	34%
Have a formal incident response plan	25%

Source: Cyber Security Breaches Survey 2025/2026, Department for Science, Innovation and Technology.

Put those together and the gap is plain: around two in five businesses identified a breach or attack, but only about a third had committed to patching within the 14 days that Cyber Essentials and the NCSC expect. Patching, backups and access control are not exciting, which is why they slip when nobody owns them. Owning them is what a proactive provider is paid to do.

There is a cost to the reactive approach beyond security. Every fault your staff find for themselves is time they are not working, and the failures that do the most damage (a dead server, a ransomware infection, a lost laptop with no backup) are the ones that give little warning to anyone who is not watching.

How much does proactive IT support cost?

Proactive IT support is normally a fixed monthly fee per user, with the monitoring, patching and helpdesk included. Our own plans run from £30 to £90 per user per month, depending on how much security and compliance work is included, and we publish the details:

	Core support	Complete IT and security
Per user, per month	£30 to £48	£55 to £90
Typical team of 15	£500 to £700 a month	£850 to £1,350 a month
Monitoring, patching and helpdesk	Included	Included
Managed cyber security, Microsoft 365 management, backup and disaster recovery	Not included	Included
Cyber Essentials guidance and regular IT strategy reviews	Not included	Included

ATS Connection prices, excluding VAT. Licences are billed at cost. Full details on our IT support pricing page.

Reactive support looks cheaper because you only pay when something breaks. Our own ad hoc rate is £100 an hour, £340 a half day or £650 a day, plus VAT, and that is the right choice for some very small businesses. The catch is that you pay for every fault, nobody is doing the preventive work in between, and the bill is impossible to budget. The IT support packages and pricing page has the full breakdown, and our guide to how much IT support costs compares the pricing models used across the UK.

How can you tell if your IT support is actually proactive?

Ask for evidence. A proactive provider can show you what it did last month, not just promise what it would do. Every provider says it is proactive; these eight questions separate the ones that are from the ones that only react.

Checklist

Eight questions that show whether your IT support is proactive

Ask your provider

A proactive provider can answer with

When did you last test restoring our backup?

A recent date, and what was restored.

Can you show me which devices are missing security updates?

A current report, not a promise to look into it.

Which of our devices are out of support or due for replacement?

A list with ages and dates, ideally already budgeted.

Who has administrator access to our systems?

Named accounts, protected by multi-factor authentication.

Were all our leavers’ accounts closed on their last day?

Yes, with a written starter and leaver process.

What did your monitoring catch last month?

Real examples of problems fixed before anyone noticed.

When is our next review?

A date in the diary, with an agenda.

What would happen if our main system went down tomorrow?

A clear answer: who acts, how fast and how you recover.

If most of the answers are vague, slow or “we would need to check”, your support is reactive whatever the contract calls it. Our post on the 10 signs it is time to change your IT support provider covers the other warning signs, and the free business IT benchmark gives you a quick score in about five minutes.

Is proactive IT support worth it for a small business?

For most businesses with more than a handful of staff, yes. Once people rely on shared systems, customer data and Microsoft 365 every day, the cost of a lost day or a breach quickly outweighs a monthly fee. It is less clear-cut for a two-person business working entirely in the cloud with few devices; ad hoc help may genuinely be enough there.

Signs you have outgrown reactive support:

The same problems keep coming back and nobody knows why.
Nobody can say for certain when the backup was last tested.
A customer, insurer or tender has asked about Cyber Essentials or your security controls.
One person is “the IT person” on top of their real job.
You do not know which devices are old, unsupported or out of warranty.

If two or three of those sound familiar, a proactive service is often worth it for the time saved alone. Our guide to what an IT support provider does explains the other models, including co-managed support if you already have someone in-house.

Proactive IT support from ATS Connection

We have provided proactive business IT support since 2015 from offices in Arundel and Chichester, and look after more than 100 businesses. Monitoring runs 24/7, our helpdesk is open from 9am to 5.30pm on working days with urgent out-of-hours support when you need it, our average response time is under 15 minutes and 98% of issues are resolved at first contact. We are Cyber Essentials certified, and our Complete package includes regular IT strategy reviews.

When Repaircraft, a defence supplier with two sites and 13 users, moved to us from a provider that was slow to respond, we modernised its systems and put proactive managed IT and security in place. As the Repaircraft case study records, downtime has effectively disappeared, there have been no successful attacks or breaches, and the business holds Cyber Essentials Plus.

If you want to know how proactive your current setup really is, book a free IT review. A senior engineer will look at your devices, security, backups and Microsoft 365 and tell you plainly what is worth fixing first. Most of the work can be done remotely through our remote IT support, with engineers on site when a job needs hands on. Our guide to onsite vs remote IT support explains which jobs need a visit.

Frequently asked questions

What is proactive IT support?

IT support that prevents problems rather than only fixing them, through continuous monitoring, scheduled security updates, tested backups, planned hardware replacement and regular reviews, alongside a helpdesk for day-to-day requests.

What is reactive IT support?

Reactive, or break-fix, IT support only acts when you report a problem, and is usually charged by the hour or by the job. Nobody does preventive work in between, so faults are found by your staff when something stops working.

Is proactive IT support more expensive than reactive support?

The monthly fee is higher than doing nothing, but the total can be lower once lost working time, emergency call-outs and unplanned replacements are counted. Ours is £30 to £48 per user per month on Core and £55 to £90 on Complete, plus VAT.

What does proactive monitoring check?

Typically device health such as disk and memory warnings, free storage, whether backups completed, whether security software is running and up to date, missing updates, and devices or network equipment going offline. Problems raise an alert for the support team.

How quickly should security updates be installed?

High-risk and critical security updates should be installed within 14 days of release. That is NCSC guidance, and for Cyber Essentials assessment accounts created after 26 April 2026 missing the 14-day window is an automatic fail.

Can a small business have proactive IT support?

Yes. Proactive support is priced per user, so it scales down to small teams. It makes most sense once several people rely on shared systems, customer data or Microsoft 365 every day.

Sources

Do You Need Cyber Insurance? What UK Insurers Ask About Your IT (2026)

Posted on 6 October 202613 October 2026 by Jake Boase

The short answer: No UK law makes a business buy cyber insurance, but most businesses that rely on email, cloud systems or customer data should seriously consider it. Almost half of UK businesses (47%) have some cover, yet only 10% hold a specific cyber policy, according to the government’s Cyber Security Breaches Survey. Before insurers quote, they will ask about your IT: multi-factor authentication, backups, endpoint protection, patching and admin access come up again and again, and wrong answers on the proposal form can reduce a claim or let the insurer refuse it.

Last updated: 6 October 2026. Checked against the Cyber Security Breaches Survey 2025/2026, NCSC guidance, IASME, the ABI and the Insurance Act 2015 on that date. We are an IT provider, not an insurer or broker: for advice on a specific policy, speak to a regulated insurance broker.

In this guide

Do you need cyber insurance?
What does cyber insurance cover?
What will insurers ask about your IT?
What does cyber insurance not cover?
Why your answers on the proposal form matter
Does Cyber Essentials help with cyber insurance?
How much are insurers paying out?
Will insurance pay a ransom?
Before you buy or renew: a checklist
Frequently asked questions

Do you need cyber insurance?

You are not legally required to have cyber insurance, but it is worth having if a cyber incident would cost you money you could not easily absorb: lost trading days, an IT specialist working through the weekend, legal advice, notifying customers, or a claim from a client whose data was exposed. Some larger clients and contracts also ask suppliers to hold it, so check your contracts.

Many businesses already have some cover without realising, because it is often bundled into a wider business policy. The Cyber Security Breaches Survey 2025/2026 found that 47% of businesses and 35% of charities were insured against cyber risks in some way, but “only 10% of businesses and 5% of charities had a specific cyber security insurance policy”. Bundled cover is often narrower than a standalone policy, so it is worth checking what yours actually includes.

Business size	Covered as part of a wider policy	Specific cyber policy
Micro (1 to 9 staff)	37%	8%
Small (10 to 49 staff)	40%	15%
Medium (50 to 249 staff)	36%	24%
Large (250+ staff)	22%	32%
All businesses	37%	10%

Source: Cyber Security Breaches Survey 2025/2026 (DSIT, published 30 April 2026), Figure 3.4.

In total, 55% of small and 61% of medium businesses had some form of cover, and 22% of businesses did not know whether they were covered at all. The survey describes take-up as broadly consistent over recent years (43% in 2023/2024, 45% in 2024/2025 and 47% in 2025/2026). The smallest firms, which are least likely to have IT staff or spare cash to recover from an incident, are also the least likely to hold a dedicated policy.

Insurance is a backstop, not protection. The NCSC puts it plainly: “Cyber insurance will not instantly solve all of your cyber security issues, and it will not prevent a cyber breach/attack” (NCSC cyber insurance guidance). The controls that make you insurable are the same ones that protect against the most common attacks, which is why the rest of this guide focuses on them.

What does cyber insurance cover?

A cyber policy typically pays for the cost of responding to an incident, the income you lose while systems are down, and claims made against you by others. Wording varies a lot between insurers, so treat this as a guide to what to look for rather than a promise of what any policy includes. As a real example, the policy included at no extra cost with Cyber Essentials certification (described by IASME) includes these sections:

Section	What it pays for
Incident response and event management	Specialist IT forensics, data recovery, legal advice, notifying affected people, credit monitoring and reputation management
Business and network interruption	Lost income while your systems are down, usually after a waiting period (a six-hour network interruption retention on the Cyber Essentials policy)
Extortion	Costs of dealing with a threat, such as ransomware
Liability	Claims against you, for example from customers whose data was exposed, and media liability
Regulatory investigations	Defence costs, and fines where they are insurable by law

Based on the Cyber Essentials cyber liability policy summary published by IASME. Other policies differ.

The NCSC suggests seven questions to ask before you buy, including “What does the cyber insurance policy cover (or not cover)?”, “Does the policy include support during (or after) a cyber security incident?” and “What must be in place to claim against (or renew) your cyber insurance policy?” The last one is the question most businesses skip, and the one that matters most if you ever claim.

What will insurers ask about your IT?

Insurers ask whether you have the basic security controls that protect against the most common attacks, and insurance broker Marsh warns that businesses which do not meet insurers’ expectations often face non-renewal or cannot get their preferred cover, with limits on ransomware cover becoming more common. Marsh lists twelve key controls and in its UK guidance notes that insurers “consistently scrutinise privileged account management”, alongside patching and endpoint detection and response. These are the twelve, with what each means for a small business:

Control (as Marsh names it)	What it means in practice	What to have ready
Multifactor authentication (MFA) for remote access and privileged or administrator access	A code or app approval as well as a password, on email, Microsoft 365, remote access and every admin account	A report showing MFA is enforced for all users, not just available
Email filtering and web security	Scanning of incoming email and blocking of malicious links and websites	Which email security service you use and what it covers
Secured, encrypted, and tested backups	Backups that ransomware cannot reach or delete, including Microsoft 365 data, restored as a test	Where backups are kept, how often they run, and the date of your last test restore
Privileged access management (PAM)	Separate admin accounts used only for admin work, kept to as few people as possible	A list of who has admin rights, and why
Endpoint detection and response (EDR)	Security software on every laptop, PC and server that detects and contains suspicious behaviour, not just known viruses	The product name and confirmation it is on every device
Patch and vulnerability management	Security updates installed promptly on computers, servers, firewalls and apps	Patching reports, and how quickly critical updates are applied
Incident response plans	A written plan for who does what if you are attacked, including who to phone	The plan, and when it was last reviewed
Cybersecurity awareness training and phishing testing	Regular short training so staff recognise phishing and payment fraud	Training records
Remote desktop protocol (RDP) mitigation and other hardening techniques	No remote desktop open to the internet, default passwords changed, unnecessary services switched off	Confirmation that RDP is not exposed
Logging and monitoring	Sign-ins and security events recorded and watched, so problems are spotted	Who monitors alerts, and when
Replacement or protection of end-of-life (EOL) systems	No unsupported software, such as Windows 10 without extended updates, or isolated if it must stay	A device list showing operating system versions
Digital supply chain cyber risk management	Knowing which suppliers can access your systems or data, and checking they are secure	A supplier list, including your IT provider

Control names from Marsh’s “Cyber resilience: twelve key controls”. The practice and evidence columns are our own summary, not Marsh’s.

Questionnaires differ between insurers, and smaller policies may ask only a handful of these. MFA, backups and endpoint protection are the ones to have in place first. If your Microsoft 365 licence already includes the tools (Business Premium does), our guide to Microsoft 365 Business Premium explains what to switch on.

What does cyber insurance not cover?

Most policies have exclusions, limits and conditions that catch businesses out. These are the ones to look for in the wording before you sign:

Money stolen through payment fraud. Losses from invoice fraud and fake bank detail changes are not always covered. The Cyber Essentials policy, for example, excludes “money stolen by electronic means or cyber fraud”. If this matters to you, ask specifically whether social engineering or funds transfer fraud is covered and at what limit. Our guide to invoice fraud and business email compromise explains how these scams work.
State-backed attacks. Since 31 March 2023, Lloyd’s has required standalone cyber policies written in its market to exclude losses from state-backed cyber attacks that significantly impair a state’s ability to function or its security capabilities (Lloyd’s Market Bulletin Y5381). Policies outside Lloyd’s may have their own war or state-backed exclusions, so check the wording.
The excess and waiting period. The Cyber Essentials policy has a £1,000 excess and a six-hour network interruption retention (a waiting period before that cover applies). Other policies will differ, so check both.
Controls you said you had but did not. If you told the insurer MFA was on for everyone and it was not, the claim may be reduced or refused. See the next section.
Limits that are too low. A £25,000 limit can be used up quickly by forensic investigators and lost income. Ask your broker how the limit compares with what a week of downtime would cost you.
Improvements. Ask whether the policy pays to replace old systems with better ones after an incident, or only to restore what you had.

Why your answers on the proposal form matter

Under the Insurance Act 2015, a business buying insurance must make “a fair presentation of the risk” before the contract starts, and every material statement of fact must be “substantially correct” (section 3). Ticking “yes” to MFA or tested backups when that is not true is the kind of statement that can come back to bite you.

What happens if an answer turns out to be wrong depends on how serious it was. Under Schedule 1 of the Act, the insurer has remedies where it would not have offered the same terms had it been told the truth. If the misstatement was deliberate or reckless the insurer can avoid the policy, refuse all claims and keep the premium. If it was an honest mistake, the remedy depends on what the insurer would have done had it known: refuse cover altogether (returning the premium), apply different terms, or pay only a proportion of the claim if it would have charged more.

Policies also contain ongoing conditions, such as keeping MFA switched on or backing up regularly. These are separate from your answers on the form. Section 11 stops an insurer relying on a breach of this kind of condition if you can show the breach could not have increased the risk of the loss that actually happened. It does not help if the missing control is relevant to how the incident happened, and business policies can vary some of these default rules, so the wording of your policy matters.

The practical lesson: answer the IT questions with whoever runs your IT, and fix the gaps before you sign rather than after. Your IT provider should be able to tell you, with evidence, which answers are true today.

Does Cyber Essentials help with cyber insurance?

Yes. Insurance data reported by the government shows that “organisations with Cyber Essentials are 92% less likely to make a claim on their insurance than those without it” (the then cyber security minister Feryal Clark, 23 October 2024). The NCSC Annual Review 2025 attributes the figure to data from the Cyber Essentials insurance provider. It shows that certified organisations claim less, not that the certificate alone caused the difference. The five Cyber Essentials controls (firewalls, secure configuration, user access control, malware protection and security updates) also overlap heavily with what insurers ask, and since 27 April 2026 missing MFA on cloud services, or not installing high-risk or critical updates within 14 days, is an automatic fail.

Certification also includes cyber cover at no extra cost for eligible organisations who opt in. According to IASME:

Feature	Cyber Essentials cyber liability insurance
Limit	£25,000 total
Who is eligible	UK or Crown Dependency organisations with turnover under £20 million that certify the whole organisation
How you get it	Opt in when you complete the Cyber Essentials assessment
Insurer	AIG, administered by Sutcliffe & Co Insurance Brokers
Incident support	A 24-hour helpline for crisis management and incident response, within the £25,000 limit
Excess	£1,000 (£5,000 for claims in the USA or Canada)
Main exclusion to note	Money stolen by electronic means or cyber fraud
How long it lasts	12 months from certification; it renews only when you renew Cyber Essentials
Higher limits	£100,000 or £250,000 available at extra cost

Source: IASME, Cyber Essentials cyber liability insurance.

For a very small business, that may be a sensible starting point. For many businesses with more than a handful of staff, £25,000 is a floor rather than enough, and a standalone policy arranged through a broker is worth pricing. Our Cyber Essentials requirements guide explains the 2026 rules, and our Cyber Essentials cost guide sets out the fees.

How much are cyber insurers paying out?

Payouts are rising sharply. Data from insurers in the Association of British Insurers’ data collection shows that “£197 million was paid out to help businesses recover from cyber incidents in 2024”, a 230% increase on the amount paid in 2023 (ABI, November 2025). Malware and ransomware accounted for 51% of claims, up from 32% the year before, and 17% more policies were taken out than in the previous year.

With malware and ransomware now behind half of claims, it is no surprise that insurers focus so heavily on backups and MFA. An attacker who gets in through an account without MFA and then finds backups they can delete can turn a bad day into weeks of disruption.

Will cyber insurance pay a ransom?

Some policies include extortion cover, but whether a ransom can be paid is not just a question for the insurer. In July 2025 the government announced plans to ban public sector bodies and critical national infrastructure operators from paying ransoms, to require other businesses to notify the government before paying, and to introduce mandatory reporting of ransomware incidents. At the time of writing (October 2026) these measures have not yet become law, so check the current position, and your policy wording, before relying on extortion cover.

Either way, paying is no guarantee of getting your data back. The surest route to recovery is backups that the attackers cannot reach.

Before you buy or renew: a checklist

Find out what you already have. Check whether your existing business policy includes any cyber cover, and what it excludes.
Get the questionnaire early. Ask your broker for the insurer’s IT questions a month or two before renewal, not the week before.
Go through it with your IT provider. Answer each question with evidence, not memory.
Fix the gaps first. MFA everywhere, backups that are separate and tested, endpoint protection on every device, patching up to date and admin rights cut back.
Check the exclusions. Especially payment fraud, the excess, waiting periods and any conditions you must keep meeting.
Check the limit. Work out roughly what a week without your systems would cost, and compare it with the cover.
Know who to call. Keep the insurer’s incident helpline number somewhere you can reach it if your email and files are down.
Consider Cyber Essentials. It proves the basics are in place and, for eligible smaller businesses that opt in, includes £25,000 of cover.

How ATS Connection helps

We do not sell insurance or advise on policies. What we do is run the IT that insurers ask about, so you can answer the questionnaire honestly and meet its requirements. Our Core support package (from £30 per user per month) includes patching, endpoint protection, 24/7 proactive monitoring and staff onboarding and offboarding. Complete IT and security (from £55 per user per month) adds managed cyber security, Microsoft 365 management, backup and disaster recovery, and Cyber Essentials guidance. See our IT support packages and pricing for the detail.

We are Cyber Essentials certified ourselves, and supported Cyber Essentials certification costs £510 plus VAT for businesses with up to 9 employees. If your renewal is coming up, book a free IT review and bring the insurer’s questions with you: we will tell you which answers are true today and what needs fixing. You can also read more about our cyber security services or our plain-English guide to what cyber security covers.

Frequently asked questions

Is cyber insurance a legal requirement in the UK?

No. No UK law requires businesses to hold cyber insurance. Some clients and contracts ask suppliers to have it, so check your contracts, and consider it if a cyber incident would cost more than you could comfortably absorb.

How many UK businesses have cyber insurance?

The Cyber Security Breaches Survey 2025/2026 found that 47% of UK businesses were insured against cyber risks in some way, but only 10% had a specific cyber security insurance policy. Among micro businesses, only 8% had a specific cyber policy.

What do cyber insurers ask about your IT?

Most ask about multi-factor authentication, backups, endpoint protection, patching, admin access, email security, staff training and incident response plans. Insurance broker Marsh lists twelve key controls that underwriters look for.

What does cyber insurance not cover?

Common gaps include money stolen through payment or invoice fraud, some state-backed attacks (Lloyd’s policies must exclude the most severe), losses during the waiting period, the excess, and claims where the business said it had security controls that were not actually in place. Policies differ, so read the exclusions before you buy.

Does Cyber Essentials include cyber insurance?

Yes, for eligible organisations. Organisations in the UK or Crown Dependencies with turnover under £20 million that certify the whole organisation can opt in to £25,000 of cyber liability insurance from AIG at no extra cost. It lasts 12 months and renews with the certificate.

Can an insurer refuse a cyber claim if my answers were wrong?

Yes. Under the Insurance Act 2015, where the insurer would not have offered the same terms had it known the truth: if a wrong answer was deliberate or reckless the insurer can refuse all claims and keep the premium. If it was an honest mistake, the insurer can refuse cover, change the terms or reduce the claim proportionately, depending on what it would have done had it known.

Does cyber insurance stop a cyber attack?

No. The NCSC says cyber insurance will not prevent a breach or attack. It helps pay for recovery. The security controls insurers ask about are what reduce the chance of an attack succeeding.

Sources

Invoice Fraud and Business Email Compromise: How It Works and How to Stop It

Posted on 1 October 202613 October 2026 by Jake Boase

The short answer: Invoice fraud, also called mandate fraud, payment diversion fraud or business email compromise (BEC), is when a criminal gets between you and a genuine supplier and persuades you to pay a real invoice into their account, often using a hacked or spoofed email account. UK Finance recorded £41.3 million lost to invoice and mandate scams across 2,305 cases in 2025. The defence is part process, always confirming a change of bank details by phone on a number you already hold, and part IT: MFA, DMARC and alerts on suspicious mailbox rules.

Last updated: 1 October 2026. Checked against the UK Finance Annual Fraud Report 2026, NCSC guidance, the Payment Systems Regulator and Report Fraud on that date.

In this guide

What is invoice fraud and business email compromise?
How do criminals pull it off?
How common is it?
Will the bank refund you?
How to stop it
What to do if you have paid a fraudster
Frequently asked questions

What is invoice fraud and business email compromise?

Invoice fraud and business email compromise are names for the same family of scams, in which a criminal uses email to redirect a payment your business meant to make to someone else. Report Fraud, which replaced Action Fraud, puts it this way: “Mandate Fraud, also known as Payment Diversion Fraud (PDF) and Business Email Compromise (BEC), tends to affect businesses and customers where electronic financial transactions are taking place.”

UK Finance defines the most common version: “In an invoice or mandate scam, the victim attempts to pay an invoice to a legitimate payee, but the criminal intervenes to convince the victim to redirect the payment to an account they control.” The NCSC describes business email compromise more broadly as “a form of phishing attack where a criminal attempts to trick a senior executive (or budget holder) into transferring funds, or revealing sensitive information.”

Type	What happens	Who it targets
Invoice or mandate fraud	A supplier’s invoice is real, but an email tells you their bank details have changed. The new account belongs to the criminal.	Accounts teams paying suppliers
CEO fraud	An email that appears to come from the managing director asks for an urgent payment, often while they are travelling or hard to reach.	Finance staff and PAs
Conveyancing fraud	Completion funds are redirected after a solicitor’s or buyer’s email is compromised. See our guide to Friday afternoon fraud.	Law firms, estate agents and home buyers

Common types of business email compromise. Definitions from UK Finance and Report Fraud.

How do criminals pull off business email compromise?

Most attacks follow the same pattern, and most steps leave something you can catch:

They get into a mailbox. Often by phishing someone’s Microsoft 365 password, either yours or your supplier’s. See how to spot a phishing email.
They read and wait. They learn who pays whom, how invoices are worded and when large payments are due.
They hide their tracks. Microsoft says “Malicious inbox rules are common during business email compromise (BEC) and phishing campaigns and it’s important to monitor for them consistently.” Attackers set rules to delete, move or forward messages so the real person never sees the replies. Microsoft gives a typical example: “They create an inbox rule to forward all emails that contain keywords, such as ‘finance’ and ‘invoice’ in the subject or message body, to their mailbox.”
They send the request. Either from the compromised mailbox itself, so it looks completely genuine, or from a lookalike domain one letter different from the real one.
The money moves fast. Once a payment lands in the criminal’s account it is usually moved on quickly, which is why speed matters when you report it.

Here is what that request often looks like. Everything in this example is invented, but each warning sign is real. To test yourself on a similar email, try our free phishing test.

Example: illustrative mock-upFictional companies

Inbox · accounts@ashcombeinteriors.co.uk

2RE: Invoice QT-4821 and updated bank details

Karen Holt, Quillfield Timber 1<accounts@quillfie1dtimber.co.uk>

To: Sam Turner · Today 15:42

Hi Sam,

Thanks for confirming the order. Just to let you know, 3our bank details have changed following an audit and our old account is now closed. Please make the payment for invoice QT-4821 (£18,450.00) to the account below.

Account nameQuillfield Timber LtdSort code12-34-56Account number87654321

4Could this go in today’s payment run? We are holding your delivery until it clears.

5I’m on site all afternoon with no signal, so email is best. Just reply here once it has been sent.

Many thanks,
Karen

Five warning signs in this email

A lookalike address“quillfie1d” uses the number 1 in place of the letter l. The display name looks perfect.

It replies to a real threadThe invoice number is genuine because the criminal has been reading the emails.

New bank detailsGenuine suppliers rarely change accounts, and almost never by email.

Pressure to pay todayUrgency is there to stop you checking.

“Please don’t call”They need the conversation to stay in email, where they control it.

What to do: do not reply. Phone the supplier on a number you already hold and ask them to confirm their bank details.

All names, addresses and account details are invented for illustration.

And this is how the criminal stops anyone noticing: rules quietly set up inside the victim’s own mailbox, of the kind Microsoft warns about.

Example: illustrative mock-upFictional mailbox

Mail settings · Rules

Inbox rules

Rules run automatically on every message that arrives.

Newsletters

IfFrom contains newsletter

ThenMove to Newsletters

IfSubject or body includes invoicebankpaymentremittanceQuillfield

Then2Move to RSS Subscriptions and mark as read

3..

IfSubject or body includes invoicefinance

ThenForward to k.holt.accounts@freemail.example

What the criminal set up

A rule with no real nameA dot or two is easy to miss in a list of rules.

Replies are hiddenWhen the real supplier writes “we never changed our bank details”, it lands in a folder nobody opens, already marked as read.

Copies go outsideFinance emails are forwarded to an outside address, so the criminal keeps watching even after a password reset.

What to do: check your mailbox rules today, and ask your IT provider to alert you whenever a new rule or forward is created.

Based on the patterns Microsoft describes in its guidance on malicious inbox rules. All names are invented.

How common is invoice fraud in the UK?

UK Finance’s Annual Fraud Report 2026 recorded these losses for 2025:

Scam type (2025)	Cases	Value lost	Returned to victims
Invoice and mandate fraud	2,305	£41.3m	£20.0m
CEO fraud	197	£5.6m	£1.1m
All authorised push payment fraud	248,070	£576.4m	Not shown here

Source: UK Finance Annual Fraud Report 2026. Of the £576.4m total, £75.6m was lost by businesses.

These figures only count cases reported to banks. The Government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses had a cyber security breach or attack in the last 12 months, that phishing was by far the most common, experienced by 38% of businesses, and that 12% reported others impersonating their organisation in emails or online.

Will the bank refund invoice fraud?

Possibly, but most businesses should not count on it. Since 7 October 2024, payment firms have generally had to reimburse eligible victims of authorised push payment scams, but the Payment Systems Regulator says the protections apply to individuals, microenterprises and charities. Claims are capped at £85,000, must be made within 13 months of the payment, and firms can apply an optional £100 excess. Businesses that are not microenterprises are outside that scheme, so prevention matters far more than recovery.

Confirmation of Payee helps. It is an account name-checking service that lets your bank check the name on the account before you pay. Treat a “close match” or “no, the name is wrong” result, or a failed check, as a reason to stop and phone the supplier, never as a box to click through.

If a payment does get as far as your banking app, this is the warning to look for:

Example: illustrative mock-upGeneric banking app

15:515G

‹ New payee

Name on the account

Quillfield Timber Ltd

Sort code

12-34-56

Account number

87654321

1The name is a close match

The account is held in a slightly different name. Check with the person you are paying before you continue.

Name on the account: QUILLFIELD TRADING LTD

Edit payee details

2Continue anyway

Confirmation of Payee is your last warning

Banks check the name you type against the name on the account before you pay. A criminal’s account may be held in a name close to the real supplier’s.

“Close match” or “the name is wrong”Treat either result as a reason to stop, not a box to tick.

“Continue anyway” is where the money goesIf you carry on after a warning, getting the money back may be harder.

What to do: stop, and phone the supplier on a number you already hold to confirm the account name and number.

Generic banking app. Wording varies between banks. All names and account details are invented.

How do you stop invoice fraud and business email compromise?

You stop it with two layers: a payment process that does not trust email, and IT controls that make mailboxes hard to take over. Report Fraud’s advice on mandate fraud is to contact the supplier directly “using their official and verifiable contact details to corroborate the payment request”, to “Establish robust internal processes for handling changes to payment details”, and to keep invoices and payment documents accessible only to the staff who need them.

Process controls

Call back on a number you already hold before acting on any change of bank details, never the number in the email asking for the change.
Limit who can change payee details and require a second person to approve the change.
Send a small test payment to new bank details and confirm it arrived by phone before sending the full amount.
Slow down urgent requests. Pressure to pay today, secrecy and “I can’t talk, just do it” are warning signs, especially from senior staff.

Put together, the process is simple enough to pin up next to every desk that pays invoices:

A simple process that stops itATS Connection

The call-back check

Use it every time a supplier, colleague or client asks you to pay to new or changed bank details.

PauseDo not reply to the email or use any phone number or link in it.

Call a number you already holdFrom your records, a past invoice or the supplier’s own website.

Confirm the detailsRead back the account name, sort code and number you were sent.

Second approvalA different person signs off the change before anyone pays.

Test, then paySend a small amount, confirm it arrived by phone, then send the rest.

STOPIf anyone pushes you to skip a step because it is urgent, treat that as the warning sign.

IT controls

Control	What it stops
MFA on every mailbox. The NCSC calls two-step verification “one of the most effective ways to protect online accounts when passwords are still in use”.	Criminals logging in with a phished password
SPF, DKIM and DMARC on your domain. DMARC “allows you to set a policy for how receiving email servers should handle email which doesn’t pass either SPF or DKIM checks.”	Criminals sending email that pretends to come from your exact domain
Alerts on new inbox and forwarding rules	Attackers hiding replies or copying your finance emails to themselves
Impersonation and lookalike-domain protection	Emails from domains one letter different from your suppliers or your directors
Staff phishing awareness	Password theft, a common starting point

IT controls against business email compromise.

Lookalike addresses are the easiest of these to miss at a glance:

Example: illustrative mock-upFictional companies

Spot the fake sender

Criminals register addresses that look almost identical to a supplier’s. Read the part after the @ slowly.

✓

The real supplier

accounts@quillfieldtimber.co.uk

accounts@quillfie1dtimber.co.uk

The number 1 in place of the letter l

accounts@quillfieldtirnber.co.uk

“r” and “n” together look like an “m”

accounts@quillfieldtimbers.co.uk

One extra letter

accounts@quillfield–timber.co.uk

A hyphen added

accounts@quillfieldtimber.com

A different ending

Quillfield Timber <qt.accounts@freemail.example>

The right display name on a free webmail address

Impersonation protection in Microsoft 365 can flag lookalike domains, but a careful eye still matters. All names are invented.

Several of these need configuring in Microsoft 365, and some depend on your licence. Our Microsoft 365 Business Premium guide explains which plan includes what, and our managed cyber security service can help set them up.

What should you do if you have paid a fraudster?

Call your bank immediately, on the number on its website or your card, and ask it to try to recall the payment. Minutes count.
Report it to Report Fraud, the national reporting service for fraud and cyber crime in England, Wales and Northern Ireland, which replaced Action Fraud.
Secure the mailbox. Reset the password, sign out all sessions, remove any inbox or forwarding rules you did not create and check which other accounts use the same password.
Warn the supplier and your customers. If your mailbox was compromised, the criminal may try the same trick on people who trust your email address.
Check whether it is a data breach. If personal data was exposed and the breach is notifiable, it must be reported to the ICO without undue delay and no later than 72 hours after becoming aware of it (ICO).

Frequently asked questions

What is the difference between invoice fraud and business email compromise?

They overlap. Business email compromise is the method, using a hacked or spoofed email account to trick someone, and invoice or mandate fraud is the most common result, a genuine invoice paid into the criminal’s account. Report Fraud uses mandate fraud, payment diversion fraud and business email compromise as alternative names for the same scam (Report Fraud).

Will my bank refund invoice fraud?

The mandatory reimbursement rules that started on 7 October 2024 apply to individuals, microenterprises and charities, with claims capped at £85,000 and made within 13 months (Payment Systems Regulator). Businesses that are not microenterprises are outside that scheme, so speak to your bank immediately and focus on prevention.

How much do UK businesses lose to invoice fraud?

UK Finance recorded £41.3 million lost to invoice and mandate scams across 2,305 cases in 2025, £28.0 million of it from business accounts, with £20.0 million returned to victims overall (UK Finance Annual Fraud Report 2026).

Can Microsoft 365 stop business email compromise?

It can block many of these attacks if it is configured properly: MFA on every account, DMARC on your domain, impersonation protection and alerts on suspicious inbox and forwarding rules. Several need configuring, and none of them replaces a call-back check before you change a supplier’s bank details. Our free DMARC checker shows in seconds whether your own domain is protected.

Where do I report invoice fraud?

Call your bank first, then report it to Report Fraud at reportfraud.police.uk, which replaced Action Fraud for England, Wales and Northern Ireland (City of London Police).

Sources

Cyber Security for Accountants: What UK Practices Need in Place in 2026

Posted on 1 October 202613 October 2026 by Jake Boase

The short answer: Accountancy practices hold exactly what criminals want: client financial data, identity documents and access to HMRC agent accounts. The essentials are multi-factor authentication on every account (HMRC is switching it on for all remaining agent accounts between 28 September and 15 October 2026), protected and patched devices, defences against email impersonation, tested backups, and a breach plan that meets the UK GDPR 72-hour reporting deadline. Cyber Essentials is the usual way to prove the basics are in place.

Last updated: 1 October 2026. Checked against HMRC’s Tax Agents Handbook and Agent Update, ICO guidance, the Money Laundering Regulations and ICAEW’s 2026 Practice Assurance monitoring report on that date.

In this guide

Why are accountancy firms targeted?
What is changing with HMRC agent accounts?
What do the rules require?
Which controls should a practice have?
Does a practice need Cyber Essentials?
What to do if you are breached
Frequently asked questions

Why are accountancy firms targeted?

Accountancy firms are targeted because one compromised mailbox or login can unlock many clients at once. As ACCA puts it, “Cybercriminals know that accounting firms hold the kind of high value data that they can sell, use to commit crimes or use as a springboard to launch further attacks.” A practice typically holds bank details, payroll data, passports and utility bills from client due diligence, and the credentials to file on behalf of hundreds of taxpayers.

HMRC has warned agents directly. Its Agent Update of September 2025 said: “Criminals are using increasingly sophisticated methods to target tax agents, including phishing emails claiming to be from realistic companies, clients and HMRC.” An earlier update described criminals “often tricking tax agents into downloading legitimate commercial software that gives them remote access to their devices”, and warned that HMRC may suspend a compromised account without notice. For a practice, a suspended agent account in January is a serious problem in its own right.

Phishing is still the most common attack UK businesses report. The Government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses had a cyber security breach or attack in the last 12 months, and that phishing was by far the most common type, experienced by 38% of businesses.

What is changing with HMRC agent accounts?

HMRC is adding multi-factor authentication (MFA) to agent online services accounts. After entering your Government Gateway user ID and password, you are asked for a one-time access code, and HMRC says “This extra step helps protect your account, even if your sign in details have been compromised.” According to the Tax Agents Handbook, “All remaining accounts will automatically be activated between 28 September 2026 and 15 October 2026”, and HMRC cannot give a specific date for each account.

Three practical points for practices:

Decide where the codes go. Shared logins and a single partner’s phone become a bottleneck the first week MFA is live. Each person who files should have their own access.
Remove leavers. HMRC’s guidance is that “you should remove access for any staff who leave your organisation or no longer need access to your HMRC online services.” The same applies to Microsoft 365 and your practice software.
Use the security console. HMRC says agents can now report suspicious activity using the security console in their agent online account, as long as MFA is activated. Suspected phishing that mentions HMRC can be forwarded to phishing@hmrc.gov.uk.

HMRC’s Standard for Agents already expects agents to keep “online access and HMRC account credentials safe from unauthorised use at all times” and to “maintain the security of client information they hold”. MFA makes that much easier to show.

What do the rules require of an accountancy practice?

No single rule sets out an IT standard for accountants, but several obligations land on your systems. The main ones are:

Obligation	What it means for your IT	Source
UK GDPR breach reporting	A notifiable breach must be reported to the ICO “without undue delay, but not later than 72 hours after becoming aware of it”. You need logging and alerting good enough to know what happened, fast.	ICO
Money Laundering Regulations record keeping	Customer due diligence records must be kept for at least five years after the business relationship ends. That means secure, backed-up storage for ID documents with access limited to the people who need it.	MLR 2017, reg 40
HMRC Standard for Agents	Keep HMRC credentials safe from unauthorised use and keep client information secure.	HMRC
Professional body monitoring	ICAEW’s Practice Assurance reviews now cover cyber security and data protection. Its 2025 report found 34 firms that had not registered with the ICO.	ICAEW 2025, ICAEW 2026
Making Tax Digital for Income Tax	Sole traders and landlords with qualifying income over £50,000 should have started from 6 April 2026, with £30,000 from April 2027 and £20,000 from April 2028. More clients, more software connections and more data to protect.	HMRC

Obligations that affect IT in a UK accountancy practice.

On anti-money laundering supervision: accountancy service providers are currently supervised by their professional body or, if they have none, by HMRC. The government decided in October 2025 that the FCA will take over supervision of the professional services sector, with the start date “heavily dependent on the availability of parliamentary time”. The record-keeping duty does not change either way.

Which cyber security controls should an accountancy practice have?

Most of the risk is covered by a short list of controls, applied consistently to every account and device. ICAEW’s 2026 monitoring report recommends firms develop an incident response plan and test it at least annually, sign up to the NCSC’s Early Warning service and run staff training and awareness. In practice, a well-run practice has:

MFA everywhere. Microsoft 365, HMRC agent services, practice management and cloud accounting software, banking and remote access. The NCSC says turning on two-step verification “is one of the most effective ways to protect online accounts when passwords are still in use”.
Email that resists impersonation. SPF, DKIM and DMARC on your domain, impersonation protection for partners’ names, and alerts when someone creates a mailbox forwarding rule.
Managed, encrypted devices. Every laptop encrypted, patched and running endpoint protection, including home-working machines. No client data on unmanaged personal devices.
Controlled remote access. Remote access software only where you have chosen it, given HMRC’s warning about criminals persuading agents to install it.
Least-privilege access and a leaver process. Staff see the client files and systems their role needs. Leavers lose access on their last day, across every system.
A secure way to receive documents. A client portal or secure upload rather than passports and bank statements arriving as email attachments.
Independent, tested backup. Microsoft 365 and practice data backed up outside Microsoft’s own retention, with restores tested, not assumed.
A written incident plan. Who to call, how to contain an incident, and how you would meet the ICO’s 72-hour deadline. Tested once a year.

These map closely onto the five Cyber Essentials controls, which is why most practices start there. Our IT support for accountants service puts these controls in place and keeps them running.

Does an accountancy practice need Cyber Essentials?

Cyber Essentials is not a regulatory requirement for accountants, but it is the recognised baseline and the easiest way to show clients, insurers and your professional body that the basics are in place. ICAEW’s 2026 report describes certificates like it as helpful but often only a starting point, to be underpinned by strong cyber governance. Of the 121 larger firms ICAEW discussed cyber security with during its 2025 monitoring, 99% were aware of the scheme, 54% had completed the basic Cyber Essentials self-assessment and 29% had completed Cyber Essentials Plus (ICAEW Practice Assurance monitoring report 2026).

Our guide to Cyber Essentials cost sets out the fees, and the Cyber Essentials requirements checklist explains what you need in place first. ATS is Cyber Essentials certified and helps practices prepare for it.

What should a practice do if it is breached?

Act quickly, and in this order:

Contain it. Call your IT provider, reset the affected passwords, revoke sessions and remove any forwarding rules or unknown remote access software.
Protect your HMRC access. HMRC says that if you notice suspicious activity on your agent account you should not try to correct anything yourself and report it to its online services team straight away.
Assess whether the ICO needs to know. A notifiable breach must be reported without undue delay and no later than 72 hours after becoming aware of it, and affected individuals must be told directly and without undue delay if it is likely to result in a high risk to them (ICO).
Report fraud. Fraud and cyber crime in England, Wales and Northern Ireland is reported to Report Fraud, which replaced Action Fraud.
Tell your insurer straight away if you have cyber cover. Many policies require notice before you incur recovery costs.
Learn from it. Record what happened and what changed, which is what your professional body will want to see.

Frequently asked questions

Do accountants need Cyber Essentials?

No regulator requires it, but it is the recognised baseline and some clients and insurers ask for it. ICAEW’s 2026 Practice Assurance report found that 54% of the larger firms it discussed cyber security with had completed the basic Cyber Essentials self-assessment, and 29% Cyber Essentials Plus. See our guide to Cyber Essentials cost.

Is MFA mandatory for HMRC agent accounts?

HMRC is adding multi-factor authentication to agent online services accounts, and says all remaining accounts will be activated automatically between 28 September 2026 and 15 October 2026 (Tax Agents Handbook).

How long must accountants keep anti-money laundering records?

Under regulation 40 of the Money Laundering Regulations 2017, customer due diligence records must be kept for five years from the end of the business relationship, or from completion of an occasional transaction (legislation.gov.uk).

Do accountancy firms have to report a data breach?

If a personal data breach is notifiable, it must be reported to the ICO without undue delay and within 72 hours of becoming aware of it. If it is likely to result in a high risk to the people whose data is involved, they must be told directly and without undue delay too (ICO).

How much does cyber security cost for a small accountancy practice?

With ATS, practices handling client financial data typically sit on Complete IT and security at £55 to £90 per user per month, excluding VAT, which includes managed cyber security, Microsoft 365 management and independent backup. The full breakdown is on our IT support pricing page.