The short answer: Cyber security is how a business protects its accounts, devices, email, data and online services from being stolen, damaged or disrupted. The National Cyber Security Centre puts it simply: cyber security “helps individuals and organisations reduce the risk and impact of cyber attacks”. For most UK businesses it comes down to a handful of basics done consistently: multi-factor authentication, up-to-date devices, malware protection, tested backups and staff who can spot a phishing email. It matters because 43% of UK businesses reported a cyber security breach or attack in the last year, according to the government’s latest Cyber Security Breaches Survey.
Last updated: 30 September 2026. Figures checked against the government’s Cyber Security Breaches Survey 2025/2026, NCSC guidance and ICO guidance on that date.
In this guide
- What is cyber security?
- Why is cyber security important for businesses?
- The main areas of cyber security
- The most common threats to UK businesses
- What good cyber security looks like for a small business
- Cyber Essentials: the UK baseline
- UK rules on cyber security and data
- What to do if you are attacked
- Should you outsource cyber security?
- Frequently asked questions
What is cyber security?
The NCSC defines cyber security as something that “helps individuals and organisations reduce the risk and impact of cyber attacks”. It adds that its core function is to defend the digital services and devices we rely on from online threats, including the data and personal information stored on them or in the cloud.
In a business, that means three things:
- Keeping information private. Only the right people can see client files, financial records and email.
- Keeping information accurate. Nobody can quietly change bank details on an invoice or tamper with records.
- Keeping systems available. Email, files and line-of-business systems keep working, and you can recover quickly if they do not.
Cyber security is not only a technology problem. Many successful attacks on small businesses start with a person being tricked, an account without multi-factor authentication or a device that has not been updated. Good cyber security is as much about habits and process as it is about software.
Why is cyber security important for businesses?
Cyber security is important because attacks on UK businesses are common, most of them involve phishing, and the fallout reaches money, clients and legal obligations. These are the headline figures from the government’s Cyber Security Breaches Survey 2025/2026, published in April 2026:
| Measure | UK businesses | UK charities |
|---|---|---|
| Reported a cyber security breach or attack in the last 12 months | 43% | 28% |
| Experienced phishing attacks | 38% | 25% |
| Victims of at least one cyber crime in the last year | 19% | 14% |
| Have a formal incident response plan | 25% | 19% |
| Insured against cyber security risks in some way | 47% | 35% |
Size makes a difference. The same survey found that 42% of micro businesses, 46% of small businesses, 65% of medium businesses and 69% of large businesses reported a breach or attack. The survey only counts breaches that organisations spotted and chose to report, so smaller firms may be under-counting.
The threat at national level is rising too. The NCSC handled 204 nationally significant cyber attacks in the 12 months to August 2025, up from 89 the year before.
For an individual business, the damage usually shows up in four ways:
- Lost time. Staff locked out of email or files, systems rebuilt, and client work delayed.
- Lost money. Payment diversion fraud, where a criminal changes the bank details on a genuine-looking invoice, can take a large sum in one transfer.
- Legal duties. If personal data is involved, a notifiable breach must be reported to the ICO without undue delay and within 72 hours of becoming aware of it, and inadequate security can lead to an ICO fine.
- Client trust and contracts. More clients, insurers and tenders now ask how you protect data, often by asking for Cyber Essentials.
The survey also shows that most breaches are low cost in direct terms: the median perceived cost of the most disruptive breach was £0 for businesses. The risk sits in the minority of cases that are serious, which is exactly what the basics below are designed to prevent.
What are the main areas of cyber security?
Cyber security is usually split into a few areas, each protecting a different part of the business. For a small business, these are the ones that matter:
| Area | What it protects | Typical measures for a small business |
|---|---|---|
| Identity and access | User accounts and admin rights | Multi-factor authentication, strong unique passwords, separate admin accounts |
| Email security | The inbox, where phishing arrives | Filtering of links and attachments, impersonation protection, staff awareness |
| Device (endpoint) security | Laptops, desktops and phones | Malware protection, encryption, automatic updates, device management |
| Network security | Office internet, Wi-Fi and remote access | A configured firewall, secure Wi-Fi, changed default passwords |
| Cloud and data security | Microsoft 365, files and client data | Sharing controls, data loss prevention, access reviews |
| Backup and recovery | Your ability to get back up and running | Separate, tested backups and a written recovery plan |
| People and process | Everyone who uses your systems | Phishing awareness, clear payment-checking rules, an incident plan |
What are the most common cyber threats to UK businesses?
Phishing is by far the most common attack on UK businesses. The Cyber Security Breaches Survey found phishing was the most prevalent type of breach or attack and was seen as the most disruptive by 69% of businesses and charities that had a breach. The threats worth knowing are:
- Phishing. Fake emails or texts that trick someone into clicking a link, entering a password or opening an attachment. See our guide to how to spot a phishing email.
- Business email compromise and payment diversion fraud. A criminal gets into, or imitates, a mailbox and redirects a payment. Our article on how conveyancing firms get caught shows how it works.
- Account takeover. Stolen or guessed passwords used to sign in to Microsoft 365 or other cloud services. Multi-factor authentication is one of the most effective defences, because a stolen password alone is no longer enough.
- Ransomware. Malicious software that encrypts files and demands payment to unlock them, often after the attackers have copied data out.
- Malware. Software that steals data or gives attackers remote access, usually arriving by email or a compromised website.
- Unpatched software. Known weaknesses in out-of-date systems, which attackers scan for automatically.
- Mistakes. Files shared with the wrong person, lost laptops without encryption and emails sent to the wrong address.
What does good cyber security look like for a small business?
Good cyber security for a small business is a short list of basics, done on every device and every account, and checked regularly. The NCSC’s small organisations guide to cyber security groups them into five areas: securing your email, securing your important online accounts, protecting your devices, backing up your data and spotting cyber attacks.
In practice, that means:
- Turn on multi-factor authentication for Microsoft 365, banking, accounting software and anything else that holds business data.
- Keep devices and software updated, with automatic updates switched on and anything unsupported replaced.
- Run malware protection on every laptop and desktop, and make sure it is reporting in.
- Back up important data to a separate location, and test that you can restore it.
- Limit admin rights so everyday accounts cannot install software or change security settings.
- Configure the firewall and Wi-Fi, and change default passwords on routers and other equipment.
- Train staff to spot phishing and to check any change of bank details by phone, using a number you already hold.
- Write down what you would do in an attack: who to call, how to isolate a device and how to restore from backup.
Our cyber security best practices guide covers each of these in more detail. The NCSC also offers a free Cyber Action Toolkit for sole traders, micro businesses and small organisations.
What is Cyber Essentials?
Cyber Essentials is the UK government-backed certification that shows a business has the basics in place. The NCSC describes it as “the minimum standard of cyber security recommended by the Government for organisations of all sizes”. It checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
It is worth having. Only 5% of businesses hold it, according to the breaches survey, yet the NCSC reported in 2024 that data from the insurer that provides cover with the scheme shows certified organisations are 92% less likely to make a cyber insurance claim. Central government and NHS contracts that involve personal data or certain IT services require it, and a growing number of other buyers ask suppliers for it.
See our Cyber Essentials requirements and checklist and our guide to what Cyber Essentials costs. For a real example, read how we helped Repaircraft achieve Cyber Essentials Plus.
What are the UK rules on cyber security?
There is no single cyber security law for small businesses, but several rules require you to protect data and report serious incidents:
- UK GDPR and the Data Protection Act 2018. Any business holding personal data must keep it secure. A notifiable personal data breach must be reported to the ICO without undue delay and within 72 hours of becoming aware of it. UK GDPR fines can reach £17.5 million or 4% of worldwide turnover, whichever is higher, for the most serious infringements, and £8.7 million or 2% for failures such as inadequate security or not reporting a breach.
- Sector rules. Regulators set their own expectations, for example the SRA for law firms (see does the SRA require Cyber Essentials) and the Data Security and Protection Toolkit for care providers (see our DSPT guide for care homes).
- The Cyber Security and Resilience Bill. This bill would update the UK’s rules for essential and digital services and would bring medium and large managed service providers into scope, with an initial incident notification to the regulator within 24 hours and a fuller report within 72 hours. It is still going through the House of Lords and is not yet law.
What should you do if your business is attacked?
If you think your business is under attack, act quickly and in this order:
- Contain it. Disconnect affected devices from the network rather than switching them off, and do not wipe them until your IT provider has checked them, as that can destroy evidence.
- Call your IT provider so they can lock compromised accounts, reset passwords and check how far the attacker got.
- Report it. Report Fraud (the national service that replaced Action Fraud in December 2025) asks businesses suffering a live cyber attack to call 0300 123 2040, 24 hours a day. In Scotland, call Police Scotland on 101.
- Tell the ICO within 72 hours if personal data may have been affected and the breach is notifiable.
- Warn clients and suppliers if your email was used to send fraudulent messages, and call your bank at once if money has been sent.
- Restore from backup and learn from it, fixing the weakness that let the attacker in.
Should you outsource cyber security?
Most small businesses do not have a security specialist on the payroll, so outsourcing is common. The breaches survey found that 44% of micro businesses now use an external cyber security provider, up from 39% the year before. Our article on reasons to outsource cyber security sets out the case.
At ATS Connection, cyber security is part of how we run managed IT services for clients, for a fixed monthly price. Our Complete IT and security package runs from £55 to £90 per user per month; see our IT support pricing or our cyber security services. If you want to know where you stand today, take our free IT security review.
Frequently asked questions
What is cyber security in simple terms?
Cyber security is protecting your accounts, devices, email, data and online services from being stolen, damaged or disrupted. The NCSC describes it as helping individuals and organisations reduce the risk and impact of cyber attacks.
Why is cyber security important for a business?
Because attacks are common and costly when they succeed. The Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses reported a breach or attack in the last 12 months. A serious incident can stop work, lead to payment fraud, trigger a duty to report to the ICO within 72 hours and damage client trust.
What are the main types of cyber security?
For a small business the main areas are identity and access, email security, device security, network security, cloud and data security, backup and recovery, and people and process.
What is the most common cyber attack on UK businesses?
Phishing. The Cyber Security Breaches Survey found phishing was experienced by 38% of UK businesses in the last year and was the most prevalent and most disruptive type of attack.
Is Cyber Essentials a legal requirement?
No, Cyber Essentials is not a legal requirement for most businesses. The government recommends it as the minimum standard for organisations of all sizes. Central government and NHS contracts involving personal data or certain IT services require it, and a growing number of other buyers ask for it.
How do I report a cyber attack in the UK?
Businesses suffering a live cyber attack should call Report Fraud, which replaced Action Fraud, on 0300 123 2040 at any time of day. In Scotland, call Police Scotland on 101. If personal data is affected and the breach is notifiable, report it to the ICO within 72 hours.
How much does cyber security cost for a small business?
It depends on size and needs. Many of the basics come with the right Microsoft 365 plan and good IT management. At ATS Connection, our Complete IT and security package costs £55 to £90 per user per month, and Cyber Essentials certification fees start at £320 plus VAT for micro businesses.
Sources
- NCSC: what is cyber security?
- DSIT: Cyber Security Breaches Survey 2025/2026
- NCSC: UK experiencing four nationally significant cyber attacks every week (Annual Review 2025)
- NCSC: small organisations guide to cyber security
- NCSC: Cyber Action Toolkit for small businesses
- NCSC: Cyber Essentials overview
- NCSC: Cyber Essentials, a decade of protection
- ICO: personal data breaches, a guide
- ICO: maximum fines under UK GDPR and the DPA 2018
- UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill stages
- GOV.UK: Cyber Security and Resilience Bill summary
- Report Fraud: guide to reporting
