Recent reporting in The Times highlights a clear message from ministers: no business is out of reach from cyber criminals. The article draws on the latest government survey data showing that around half of UK small businesses reported a cyber breach or attack in the past year. At the same time, the Department for Science, Innovation and Technology and the National Cyber Security Centre have reinforced that cyber threats are increasing in frequency and impact.
This is not new. But the framing has shifted. Cyber risk is now described as a business issue, not simply an IT concern.
Are small businesses really targeted by cyber criminals?
Yes. Most attacks affecting UK SMEs are not advanced, targeted operations. They are:
- Phishing emails
- Compromised passwords
- Stolen Microsoft 365 credentials
- Malware delivered through ordinary user activity
These attacks are automated and opportunistic. Criminals do not screen for company profile. They scan for exposed systems, weak passwords, and inconsistent controls.
If your defences are basic but unmanaged, you are visible.
Why cyber security is now an operational risk for SMEs
For a large enterprise, an incident may be absorbed by specialist teams. For a small or medium-sized business, the impact is often immediate:
- Email access lost
- Invoices delayed
- Customer data inaccessible
- Staff unable to work
- Reputational damage within local networks
The financial cost is frequently cited. The operational disruption is often worse. Cyber security for small businesses in the UK is therefore about continuity, not just compliance.
Why supply-chain expectations are rising
There is another shift taking place. Large organisations are under increasing pressure to understand cyber risk within their supply chains. That includes professional services firms, contractors, third sector organisations, manufacturers and local partners.
If you:
- Handle client data
- Access a larger organisation’s systems
- Provide outsourced services
- Process payments
- Connect to shared platforms
You are already part of a supply chain.
As ministers publicly state that no business is out of reach, expectations extend beyond defending against attackers. They extend to demonstrating responsible controls.
SMEs are increasingly being asked:
- Do you enforce multi-factor authentication?
- How do you manage administrator access?
- How quickly are security updates applied?
- Are backups documented and tested?
These questions now appear in procurement documentation, contract clauses and insurer renewals. For many organisations, the pressure to strengthen cyber security does not begin with an attack. It begins with a client request. Ignoring that shift introduces commercial risk. Addressing it builds trust. Cyber resilience is becoming a condition of doing business.
What practical steps should SMEs prioritise?
You do not need complexity. You need consistency.
Start with:
- Multi-factor authentication across all key systems
- Controlled and limited administrator access
- Reliable patching of devices and servers
- Tested, segregated backups
- Ongoing phishing awareness for staff
These measures prevent the majority of opportunistic attacks affecting UK SMEs.
Cyber risk is business risk
The recent coverage in The Times also reflects a broader change in tone. Ministers are positioning cyber security as part of economic resilience. That has implications for SME leaders.
The question is no longer: “Are we likely to be attacked?” It is:
“If our cloud systems, email or client data were compromised tomorrow, how quickly could we recover?”
In practice, most SMEs do not struggle because they lack sophisticated tooling. They struggle because baseline controls are inconsistently applied, reviewed once and forgotten, or delegated without oversight.
Resilience is not built through dramatic projects. It is built through steady, informed leadership decisions.
If no business is out of reach, then cyber security belongs in routine business conversations alongside finance, staffing and growth. Not as noise. Not as fear. As governance.
Frequently Asked Questions
Are small businesses in the UK really targeted by cyber criminals?
Yes. Government survey data shows that around half of UK small businesses report experiencing a cyber breach or attack each year. Most incidents are not highly sophisticated. They involve phishing emails, stolen credentials or unpatched systems. Criminals typically target weak controls rather than company size.
What is cyber security for SMEs?
Cyber security for SMEs refers to the practical controls and processes that protect small and medium-sized businesses from digital threats. This includes securing email and cloud platforms such as Microsoft 365, managing access permissions, applying security updates, backing up data and training staff to recognise phishing.
Why is cyber security now a supply-chain issue?
Larger organisations are increasingly required to assess the cyber risk within their supply chains. If your business handles client data, connects to external systems or provides outsourced services, you may be asked to demonstrate basic security controls. Cyber resilience is now part of procurement and contract discussions.
How can an SME reduce cyber risk quickly?
The most effective immediate steps are:
- Enable multi-factor authentication across all critical systems
- Limit and monitor administrator access
- Apply security updates promptly
- Test backups regularly
- Provide staff phishing awareness training
Consistent application of these baseline controls prevents the majority of opportunistic attacks affecting UK SMEs.
A practical starting point
For many SMEs the challenge is not understanding cyber risk, it is knowing where the current gaps exist.
If you would like a short review of your current cyber security posture, we can help identify:
- where your biggest risks may sit
- whether baseline controls are consistently applied
- where improvements could strengthen resilience
This is usually a 30-minute conversation focused on practical steps rather than technology jargon.
👉 Contact Secure360 to start the discussion.