Topic guide
Cyber Security for UK Businesses
A plain-English guide to cyber security for UK businesses: the real threats, the essential controls that stop most attacks, and where to get help.
In short
Most attacks on small businesses are opportunistic and preventable. A handful of basics: multi-factor authentication, strong unique passwords, reliable backups, prompt updates, and staff who can spot a scam email: stop the vast majority. This hub explains those controls in plain English, points you to step-by-step guides, and shows how Cyber Essentials ties it all together.
Why small businesses are targets
It’s a common myth that criminals only go after big companies. In reality, most attacks are automated and opportunistic: software scans the internet for weak passwords, unpatched systems and people who’ll click the wrong link. Small businesses get caught precisely because they assume they’re too small to bother with. The good news is that the same handful of basics stops the overwhelming majority of these attacks, and none of them require you to be technical.
If you’re starting from scratch, our cyber security starter guide for UK small businesses is the gentlest place to begin.
The threats that actually affect you
Two threats do most of the damage. The first is phishing: convincing emails and texts designed to trick a member of staff into handing over a password or paying a fake invoice. Learning to recognise the tell-tale signs matters, so share our guide on how to spot a phishing email with your whole team. Email is the front door for most attacks, which is why email security deserves attention of its own.
The second is ransomware: malicious software that locks up your files and demands payment. For a small business it can mean days of downtime and lost customer data. Our guide on protecting your business from ransomware explains how these attacks unfold and, more importantly, how to make sure one can’t cripple you.
The essential controls
You don’t need dozens of products. A short list of well-implemented basics does the heavy lifting.
Turn on multi-factor authentication
Multi-factor authentication (MFA) means a password alone isn’t enough to get into an account: a stolen password becomes far less useful to an attacker. It’s the single highest-value change most businesses can make, and our guide on multi-factor authentication explained walks through it without jargon.
Use strong, unique passwords
Reusing the same password across accounts means one leak unlocks everything. A password manager generates and remembers a strong, different password for every login, so your team don’t have to. See our pick of the best password manager for a small business.
Back up properly
Backups are your safety net when everything else fails: but only if they actually work when you need them. The proven approach is the 3-2-1 rule, explained in our guide to business backups and disaster recovery. If you handle customer information, backups also tie into your wider data protection responsibilities.
Keep everything updated
Most successful attacks exploit known weaknesses that a software update would have fixed. Turning on automatic updates for your computers, phones and business apps closes those gaps quietly in the background.
Train your people
Your staff are your strongest defence, not your weakest link: once they know what to watch for. A short, regular conversation about scam emails and unexpected payment requests pays for itself many times over.
Wondering whether you need extra tools like a VPN? Our honest take on whether your business needs a VPN cuts through the marketing.
Cyber Essentials: a clear standard to aim for
Cyber Essentials is a UK government-backed scheme that sets out five basic controls every business should have in place: roughly the ones above. Certifying against it is a straightforward way to prove you take security seriously, and it’s increasingly required to win contracts and qualify for some insurance. Our guide to Cyber Essentials explained for small businesses covers what’s involved and whether it’s worth it for you.
Putting it into action
If all this feels like a lot at once, it doesn’t have to happen overnight. Our 30-day security hardening playbook breaks the work into small daily steps you can follow without stopping the day job. And if the worst does happen, keep our guide on what to do after a cyber attack to hand so you can respond calmly and limit the damage.
Cyber security also overlaps with keeping your systems running day to day: you’ll find related help in our managed IT hub, and a fuller picture of how we protect businesses on our cyber security service page.
Get a second opinion
Not sure where the gaps are? We’ll take a look for you. Book a free IT and security review and we’ll give you an honest, jargon-free picture of where you stand and what’s worth doing first: no pressure, no hard sell.
In this topic
87 guides in this topic
Guide PHP2Shell: What to Do If Your Website Runs on PHP Two critical PHP flaws, fixed on 21 October 2026, can let an attacker take over a web server without logging in. What PHP2Shell is, who is affected, and what to do this week, in plain English. Article The backup password on the laptop you're backing up Recovery plans fail in the way audits miss: the control quietly depends on the very thing it is meant to recover you from. Here is the question that finds them. Guide IT and Cyber Security for Charities and Non-Profits in the UK A plain-English guide to IT and cyber security for UK charities: protecting donor and beneficiary data, controlling volunteer access, and Cyber Essentials on a tight budget. Guide IT & Cyber Security for Solicitors and Law Firms: A Plain-English Guide A practical guide to IT security for UK law firms: client confidentiality, SRA-aligned controls, secure email and documents, DMARC, backups and staying compliant. Guide IT Support for Recruitment Agencies in the UK A plain-English guide to IT and cyber security for UK recruitment agencies: protecting candidate data, securing your CRM/ATS, mobile working and stopping placement invoice fraud. Guide Cyber Essentials Explained: A Plain-English Guide for UK Small Businesses What Cyber Essentials is, the five controls, CE vs CE Plus, why it wins contracts and helps insurance, and how a small UK business gets certified. Guide IT & Cyber Security for Veterinary Practices in the UK A plain-English IT and cyber security guide for UK vets: protect client and pet data, keep practice software running, take payments safely, and stop phishing. Article Password Managers Compared: The Best Choice for a UK Small Business A plain-English guide to choosing a password manager for your UK small business: the key criteria that matter, the main options, and why we favour Proton Pass. Guide IT Support for Estate Agents in the UK Practical IT and cyber security for UK estate agents: protecting client money and AML data, working safely with Rightmove and portals, stopping deposit and completion fraud, and mobile working. Guide Windows 10 End of Support: What Your Business Should Do Now Windows 10 support ended on 14 October 2025. Here's what that really means for your business, your options, and how to plan the move without panic. Guide IT and Cyber Security for Financial Advisers in the UK A practical guide to IT and cyber security for UK financial advisers and IFAs: meeting FCA expectations, protecting client financial data, secure email, backups and Cyber Essentials. Guide IT Security for Dental and Healthcare Practices: A Practical Guide How UK dental and healthcare practices can protect patient data under UK GDPR and the NHS DSPT, keep clinical software running, back up safely and control access. Article Antivirus and Endpoint Protection for Small Businesses, Explained What endpoint protection really is, how built-in Defender compares with paid tools, whether small firms need EDR, and what actually matters when protecting your devices. Guide IT Support for Nurseries and Childcare Settings in the UK Plain-English IT and cyber security guidance for UK nurseries: protect children's and safeguarding data, control access, manage retention, and reassure parents. Article AI Tools at Work: The Real Security Risk Nobody Mentions Staff are already using ChatGPT and other AI tools at work. The real danger isn't the robots: it's confidential data being pasted into public tools. Here's a sensible approach. Guide IT for Manufacturing and Engineering Firms in the UK A plain-English IT and cyber security guide for UK manufacturers and engineers: keeping the shop floor running, protecting designs and IP, separating office and operational tech, and reliable backups. Guide IT Support for Care Homes in the UK: A Practical Security Guide A plain-English guide to IT for UK care homes: protecting resident and staff data, CQC-aware information governance, reliable Wi-Fi and devices, and business continuity. Guide IT Support for Marketing and Creative Agencies in the UK A plain-English IT and cyber security guide for UK marketing and creative agencies: protecting client data and assets, secure cloud collaboration, reliable backups and device security for a mobile team. Article How to Stop Invoice Fraud and Email Spoofing (SPF, DKIM and DMARC) How invoice and business email compromise fraud works, and how SPF, DKIM and DMARC stop criminals spoofing your domain. A plain-English guide for UK businesses. Guide IT Support for Gyms and Fitness Businesses in the UK Plain-English IT guidance for UK gyms and fitness studios: protect member data and payments, run online booking, secure door-entry systems, and get reliable Wi-Fi. Article Best Business VPN Compared: A Plain-English Guide for UK Firms What a business VPN is really for, the criteria that matter when choosing one, the main options, and why we favour Proton VPN for UK small businesses. Article Passwordless and Passkeys Explained (For Non-Techies) Passkeys let you sign in with your face, fingerprint or PIN instead of a password: and they're far harder to steal. Here's what they are and how to start. Guide IT and Connectivity for Construction Trades: A Practical Guide A plain-English guide to IT for UK construction firms: multi-site connectivity, rugged devices, job software, VoIP on site and backing up your drawings. Article Payroll Diversion Fraud Explained: How Criminals Redirect Staff Salaries Payroll diversion fraud tricks your finance team into paying a staff salary to a criminal's bank account. Here's how it works and how to stop it. Guide Business Continuity Plan for a Small Business: A Plain-English Guide A jargon-free guide to writing a business continuity plan for your UK small business, covering key risks, RTO and RPO, backups and how to test it. Guide How to Set Up Multi-Factor Authentication (Step by Step) A plain-English, step-by-step guide to turning on multi-factor authentication across your email, Microsoft 365 and key business apps: without the jargon. Article Cloud Backup Services for Business Compared: How to Choose Well How to choose a cloud backup service for your small business: the criteria that matter, why Microsoft 365 still needs backing up, and how to test that restores actually work. Guide How to Set Up SPF, DKIM and DMARC: A Step-by-Step Guide A plain-English, step-by-step guide to setting up SPF, DKIM and DMARC for your UK business email, with a safe staged rollout and common mistakes to avoid. Article Ransomware and UK Small Businesses: How Firms Get Hit and How to Stop It How a small UK business really gets hit by ransomware, and the handful of controls, backups, MFA, patching and staff awareness, that actually prevent it. Article Account Takeover: How It Happens and How to Stop It Account takeover is when a criminal logs into your account as you. Learn how it happens, the warning signs to watch for, and how to lock attackers out. Article IT for Professional Services Firms: Secure, Reliable, Ready to Win Work How professional services firms can get IT right: secure Microsoft 365 and cloud working, Cyber Essentials to win contracts, plus support and monitoring. Article How to Securely Dispose of Old Computers and Data Selling or scrapping an old work computer? Here's how to wipe data properly, when to destroy the drive, and how to recycle old kit legally: in plain English. Playbook What to Do After a Cyber Attack: A First-Hours Playbook for Small Businesses A calm, step-by-step playbook for the first hours after a cyber attack on your UK small business: contain, assess, report, recover and learn. Article Why Do My Business Emails Go to Spam? Your important emails keep landing in spam? Here is why it happens: authentication, sender reputation, content and list hygiene: and the practical checks to fix it. Article GDPR Basics for UK Small Businesses: A Plain-English Guide A jargon-free guide to UK GDPR for small businesses: what personal data is, lawful basis, ICO registration and fee, your security duty, and handling breaches. Article Tech Support Scams and Fake IT Calls: How to Spot Them Fake 'Microsoft' calls and scary pop-ups pressure you into handing over access or money. Learn the tells, what to do, and how a real IT provider behaves. Article The Best Password Manager for a UK Small Business (And Why You Need One) Why every UK small business needs a password manager, what to look for, and the privacy-first pick we use at Dacros. Plain-English guide, no jargon. Article How to Check if Your Business Email Has Been Breached Worried your work email has turned up in a data breach? Here's how to check for free, what to do if it has, and how to keep an eye on it going forward. Article How to Report a Data Breach to the ICO: The 72-Hour Rule Explained When a data breach is reportable, how the ICO's 72-hour rule works, what to include in your report and when to tell affected individuals. Plain-English UK guide. Article Business Email Compromise (BEC) Explained Business email compromise costs UK firms dearly and slips past spam filters. Learn how CEO fraud and supplier impersonation work: and the layered defence that stops it. Article Smishing and Vishing: The SMS and Phone Scams Targeting Your Business Smishing (text) and vishing (phone) scams are hitting UK businesses hard. Learn the warning signs, the common tricks and exactly how your team should respond. Article Multi-Factor Authentication (MFA) Explained for Small Businesses Multi-factor authentication stops most account takeovers even when passwords leak. Learn app codes vs SMS vs passkeys, and how to roll MFA out. Article SIM Swapping Attacks Explained: Why Your Phone Number Isn't a Safe Login Learn how SIM swapping hijacks your mobile number to beat SMS security codes, why app-based MFA is safer, and how to lock down your phone account. Guide IT and Cyber Security for Retail Shops: A UK Owner's Guide A plain-English guide to IT and cyber security for UK retail shops: safer card payments, splitting till and guest Wi-Fi, staff logins and backups that actually work. Article QR Code Scams (Quishing) Explained: The Hidden Risk in a Square of Dots Quishing means QR code phishing. Fake QR codes now appear on car parks, invoices and posters. Learn where they hide, why they slip past filters and how to stay safe. Article Do I Need a Business VPN? An Honest Guide for UK Firms What a business VPN really is, what it is good for, what it is not, and when a UK small business actually needs one. Plain English, no scare tactics. Article How to Spot a Phishing Email (and What to Do About It) Learn to spot phishing emails fast: the classic tells, real-world patterns, and exactly what to do next: plus how to train your staff to catch them. Article How to Switch IT Support Providers Without the Chaos Leaving an underperforming IT company? A practical UK guide to getting your data, passwords and admin access back and running a clean, low-stress handover. Article BYOD for Small Businesses: The Risks of Personal Devices and a Sensible Policy Letting staff use their own phones and laptops for work saves money but creates real risks. Here's a plain-English BYOD policy UK small businesses can actually use. Article Insider Threats for Small Business: The Risk From People You Already Trust Understand accidental and malicious insider risk, and how least privilege, careful offboarding and sensible monitoring protect your small business. Article Deepfake and AI Voice Scams: When the Fake CEO Sounds Completely Real AI can now clone a voice from seconds of audio. Learn how deepfake calls supercharge CEO fraud and BEC: and the simple call-back and code-word defences that stop them. Guide IT for Hospitality: A Practical Guide for UK Restaurants and Cafes Practical IT for UK restaurants and cafes: cutting no-shows with online bookings, guest Wi-Fi done safely, taking card payments, and connectivity that keeps you trading. Guide Business Backups: The 3-2-1 Rule and Disaster Recovery The 3-2-1 backup rule explained for UK small businesses: what to back up (including Microsoft 365), how to test restores, and recovering from ransomware. Article How to Write a Password Policy for a Small Business (the Sensible Way) An NCSC-aligned password policy for UK small businesses: length over complexity, no pointless forced changes, MFA everywhere and a password manager. A plain template. Article Staff Onboarding and Offboarding: Getting IT Access Right as People Join and Leave Giving new staff the right access: and fully removing it when people leave: is a core security job. Here's how UK small businesses can do both cleanly. Article What Is Encryption? A Plain-English Guide for Business Owners Encryption explained without the jargon: at rest vs in transit, HTTPS, device and disk encryption, encrypted email and storage, and why it matters for your business. Article Cyber Security for a Small Ecommerce Business How to protect a small UK online store: securing your platform and plugins, safe payments, customer data under UK GDPR, spotting fraud, and backups that actually restore. Article Why You Should Move Your Business Off Free Gmail Free consumer email quietly costs you trust, control and security. Here is why UK small businesses should move to a proper custom-domain email, and how. Article ICO Fines and Enforcement: What Small Businesses Should Know A plain-English guide to ICO enforcement for UK small businesses: reprimands vs fines, the real maximum penalties, and what actually triggers action. Article How to Set Up Secure Business Wi-Fi: Guest and Staff Networks Done Right A plain-English guide to secure business Wi-Fi for UK small firms: guest vs staff networks, WPA encryption, segmentation and the common mistakes to avoid. Guide Microsoft 365 Security Settings Every Small Business Should Turn On A plain-English guide to the Microsoft 365 security settings UK small businesses should enable: MFA, anti-phishing, Safe Links, audit logging and sharing controls. Article Working From Home Securely: A Practical Guide for Small Businesses Remote and hybrid work is here to stay. Here's how a small business can keep devices, logins, files and home Wi-Fi secure without a big IT budget or jargon. Article Cloud vs On-Premise for Small Business: An Honest Comparison An honest, jargon-free comparison of cloud vs on-premise IT for UK small businesses: the real trade-offs in cost, security, control and when each approach makes sense. Article Lawful Basis for Processing Personal Data, Explained The six lawful bases under UK GDPR in plain English for small businesses: how to choose one, and when to use consent versus legitimate interests. Article What Is a Firewall? A Plain-English Guide for Small Businesses What a firewall actually does, the difference between router, software and next-gen firewalls, why it's a Cyber Essentials control, and how to set one up sensibly. Article CCTV and GDPR: Using Cameras Lawfully in Your Business How to use CCTV lawfully under UK GDPR: signage, a clear purpose, sensible retention, handling footage requests, and what the ICO expects of you. Article MDR and EDR Explained: Do Small Businesses Really Need Them? What managed detection and response (MDR) and EDR mean in plain English, why small firms are targeted too, whether you need 24/7 monitoring, and what to look for. Article Zero Trust Security Explained for Small Businesses Zero trust in plain English for UK small firms: what "never trust, always verify" means, and the practical steps (MFA, least privilege, device checks) you can take. Article Microsoft 365 Backup: Why Microsoft Won't Save Your Data Microsoft 365 doesn't back your data up the way most business owners assume. Here's the shared responsibility gap, and why you still need a proper backup. Article Public Wi-Fi Risks for Business Travellers (and How to Stay Safe) The real risks of hotel, cafe and airport Wi-Fi for UK small businesses, plus simple ways to protect your data on the road: mobile hotspot, VPN and HTTPS. Playbook Cyber Essentials Self-Assessment Checklist: A Practical Pre-Assessment Guide A plain-English Cyber Essentials checklist for UK small businesses. Work through all five controls before you apply so you pass first time, not on the retry. Article Security Awareness Training for Staff: Turning Your Team Into Your Best Defence Why your staff are the front line against cyber attacks, and how short, regular, practical security awareness training builds a strong reporting culture. Article Third-Party and Supply-Chain Risk for Small Businesses The suppliers and software you rely on can become your security problem. A plain-English guide to supply-chain risk for UK small firms, plus what to ask vendors. Article Remote Desktop (RDP) Security for Small Businesses Exposed Remote Desktop is one of the top ways UK businesses get hit by ransomware. Here's why open RDP is dangerous and how to secure remote access properly. Article Secure File Sharing for Small Business: A Plain-English Guide Emailing attachments and using consumer cloud apps quietly leaks business data. Here's what secure file sharing looks like, and how to get it right. Article Cloud Storage for Business Compared: OneDrive, Google Drive, Dropbox and Privacy-First Options Compare business cloud storage: OneDrive, Google Drive, Dropbox and privacy-first Proton Drive: on security, sharing, UK/EU data and the backup vs sync trap. Article How Much Should a Small Business Spend on IT and Security? A plain-English guide to setting an IT budget for your UK small business: what to spend, the categories that matter, and how to weigh value against cost. Guide How to Secure Your Business Website: A Practical Guide A plain-English guide to website security for UK small businesses: HTTPS, updates, strong logins with MFA, backups, a firewall/WAF, and getting a security review. Article Scaling IT as Your Business Grows: From 5 to 50 People Without the Mess How your IT needs change as you grow from a handful of staff to fifty, how to avoid the 'it just grew' mess, and when to bring in managed IT support. Article What Is 'the Cloud'? A Plain-English Guide for Small Businesses A jargon-free explainer of what 'the cloud' actually means, the real benefits for small businesses, and the shared-responsibility catch you need to understand. Article Zoom vs Teams vs Google Meet: Video Conferencing for Business Compared Zoom, Microsoft Teams or Google Meet for your small business? Compare cost, call quality, security and privacy in plain English, and see which one to choose. Article Domain Names and DNS Basics for Business: A Plain-English Guide A jargon-free guide to domain names and DNS for business owners: what A, MX and TXT records do, why they matter for your website and email security. Article Cyber Insurance for UK Small Businesses: What It Covers and How to Avoid a Denied Claim What cyber insurance actually covers, why UK insurers now check for MFA and DMARC, what to put in place first, and the common reasons small-business claims get denied. Article Cyber Essentials vs Cyber Essentials Plus: Which One Does Your Business Need? The plain-English difference between Cyber Essentials and Cyber Essentials Plus, which one you need, what the audit involves, the cost and effort, and the 2026 MFA change. Playbook The 30-Day Small Business Security Hardening Playbook A plain-English, week-by-week 30-day plan any UK small-business owner can follow to lock down MFA, backups, email, passwords and updates. Guide The UK Small Business Cyber Security Starter Guide A complete beginner's guide to cyber security for UK small businesses: the real threats, the controls that matter, Cyber Essentials, and where to get help. Article The IT Support Checklist for UK Accountancy Practices A practical IT and cyber-security checklist for UK accountants: protecting client data, staying online through tax season, and meeting Cyber Essentials.
More topics
Other guide hubs
Email Security & Fraud Protection for UK Businesses Protect your business from invoice fraud, phishing and email scams. A plain-English guide to SPF, DKIM, DMARC, BEC and secure email for UK firms. Managed IT & Cloud Support for UK Businesses A plain-English guide to managed IT, Microsoft 365, cloud, VoIP and scaling technology for UK businesses. Start here, then explore the detail. Data Protection & UK GDPR for Businesses A plain-English guide to UK GDPR for businesses: ICO registration, lawful basis, SARs, DPIAs, privacy notices, cookies and international data transfers.
Want this handled for you?
Dacros runs IT and security for UK businesses. Book a free review: no jargon, no pressure, and the written picture is yours either way.