Invisible threats to small businesses (and what to do about them)

Cyber crime is on the rise – and it isn’t reserved for the biggest businesses out there. New government research reveals half of small firms have reported a cyber threat in the last 12 months.

The Cyber Security Breaches Survey 2025 also found the average total cost of a breach or cyber attack for a small business in the UK is £7,960. 

Now small businesses are being urged by the government to step up their security protections as ‘no business is out of reach from cyber criminals’.  

Cyber threats – 5 key priorities 

A new campaign from the National Cyber Security Centre (NCSC) and the Department for Science, Innovation and Technology emphasises five key priorities for smaller firms. 

1. Firewalls
2. Secure configuration
3. Software updates
4. User access control
5. Malware protection

While this may sound alarming, there are things you can do to secure your business and protect it from invisible threats. In the same way you’d lock the front door of your business premises, it’s vital that the same vigilance is applied to online activity. 

Encouragingly, the Cyber Security Breaches Survey found 48 per cent of small businesses were doing cyber security risk assessments in 2025. This is an increase from 41 per cent in 2024. 

Quick checks you can do today 

Some security checks you can do might only take a few minutes and can help prevent cyber criminals getting access to your systems. 

The government’s Cyber Essentials checklist is designed for smaller firms to protect from the biggest online risks – and you don’t need specialist IT knowledge. 

Quick checks you can do include:

• securing your email accounts and with strong passwords and setting up two-factor authentication
• updating your devices to the latest version (as this often includes security updates)
• removing users from accounts if they don’t work for you anymore 

It’s also a good idea to take the time to learn how to spot a phishing scam or other forms of cyber attack. 

‘Lock the door on cyber criminals’ 

Cyber Security Minister Baroness Lloyd said: “No business is out of reach from cyber criminals. SMEs play a vital role in our economy, and business owners work incredibly hard to build something valuable, but too many still assume cyber criminals only go after big brands. The reality is criminals look for easy opportunities, and without basic protections in place, any business of any size can become a target.  

“I know smaller firms don’t have large IT teams, and that is exactly why Cyber Essentials matters. It provides a straightforward checklist to lock the door on cyber criminals, without needing specialist expertise. Cyber risk is business risk, just like fire or theft, and the protections are just as essential.”

‘Take practical steps today’

NCSC CEO Dr Richard Horne said: “Many small business owners assume their business is too small to be on cyber criminals’ radar, but in reality, we know most attackers don’t care about size, reputation or logos – they are looking for opportunity and weaknesses.  

“Small businesses do not need to go to the ends of the earth to put baseline cyber security measures in place as the Cyber Essentials scheme can help them take practical steps today. 

“I urge all businesses to implement the five key security controls to help protect themselves against the most common, damaging online threats.”

Related small business guides 

• A beginner’s guide to cyber security (and why it’s important) 
• Best accounting software for small businesses 
• 7 new ways to use WhatsApp for business