Cyber Security

Business growth shown by people shaking hands.
overlay
22 Jul

Why Cyber Resilience Matters for SME Growth

Cyber resilience is becoming a normal part of doing business. Larger clients, insurers and regulated organisations increasingly want to know that the businesses they work with can manage cyber risk, recover from disruption and show what protections they have in place.

The Cyber Security and Resilience Bill, which had its second reading in the House of Lords on 14th July 2026, reflects that wider shift. The Bill is aimed mainly at larger organisations and key service providers, but the expectations behind it are already reaching smaller businesses through contracts, insurance and supplier checks.

For SMEs, the issue is not just whether the Bill applies directly, it is whether they can answer the cyber security and resilience questions now being asked of suppliers.

That does not mean every SME needs enterprise-level security. It does mean knowing what protections are in place, who is looking after them, how the business would recover from an incident, and what evidence could be provided if a client or insurer asked.

Growth brings more questions

A small business can run for years with informal processes and a trusted IT provider in the background. That may work well enough with familiar clients and straightforward operations but growth changes that.

A tender may ask whether you have Cyber Essentials. An insurer may want to know if multi-factor authentication is active across all accounts. A larger customer may ask for evidence of staff training, endpoint protection, backups or incident response planning.

These requests often arrive at awkward moments: during a contract negotiation, renewal, insurance application or procurement deadline. The businesses that struggle are not always the ones with no protection in place. More often, they have tools in place but cannot easily show how they are configured, monitored or reviewed. That creates delays at exactly the point where the business is trying to move forward.

Supplier cyber security is under closer scrutiny

The National Cyber Security Centre has warned that weaknesses in suppliers can affect the security of wider supply chains. Larger organisations know this, which is why cyber security checks are becoming a routine part of approving, renewing or expanding supplier relationships.

This is where better cyber security can help an SME commercially.

A business with clear controls, regular reporting and recognised certification is easier to assess. It can answer security questionnaires faster and avoid the last-minute scramble that happens when evidence is requested but no one is sure where to find it.

Cyber Essentials is a useful starting point because it gives SMEs a recognised framework for common security controls. Cyber Essentials Plus adds a technical audit, which can help where clients want a higher level of assurance.

Better security makes the business easier to trust

Cyber security is often discussed in terms of threats and attacks. For growing SMEs, it also matters because it removes friction. It helps with tenders, insurance applications, due diligence and board reporting. It gives staff clearer guidance on what to do when something looks suspicious.

The Cyber Security and Resilience Bill shows that resilience, reporting and supplier risk are becoming standard business concerns. Many SMEs may sit outside the direct scope of the legislation, but they will still feel the effect through the expectations of clients, insurers and regulated organisations.

Radar chart showing Secure360’s cyber security services including email protection, endpoint security, secure browsing, cloud posture, and dark web monitoring, highlighting areas covered and issues identified.
overlay
29 Jun

How AI is changing Cyber Security for UK SMEs

The National Cyber Security Centre (NCSC) has published a series of reports and articles on Frontier AI and what it means for cyber security. The message is clear that organisations should understand both the risks and the opportunities presented by AI, especially if they rely on digital systems.

What is Frontier AI?

The NCSC uses the term Frontier AI to describe the most advanced artificial intelligence models currently available. These systems can analyse large amounts of information, write software, solve complex problems and assist with tasks that previously required significant technical expertise.

Businesses are already using these capabilities to improve productivity. Software developers use AI to write code, marketing teams use it to generate content and organisations use it to automate repetitive work. But the same technology can also support cyber attacks. AI can help criminals generate convincing phishing emails, analyse publicly exposed systems, identify vulnerabilities and automate parts of an attack that once required far more time and effort.

AI is making cyber attacks faster

Cyber criminals are still exploiting many of the same weaknesses they have targeted for years. Weak passwords, missing security updates, exposed remote access and poorly secured Microsoft 365 environments remain common entry points. And AI allows attackers to find those weaknesses more efficiently.

The NCSC is clear that AI cannot independently carry out every stage of a sophisticated cyber attack today. The immediate risk is that it makes skilled attackers faster, more efficient and able to scale their activity more easily.

Instead of manually researching potential targets, they can automate reconnaissance, analyse thousands of internet facing systems and prioritise organisations that appear vulnerable.

The NCSC also highlights the growing importance of vulnerability discovery and exploitation. As AI helps attackers find and exploit weaknesses more quickly, organisations will have less time to apply security updates once vulnerabilities become known.

For businesses, this means vulnerabilities are likely to be discovered sooner than they were in the past. Delays in patching systems, removing unused accounts or reviewing access permissions leave less margin for error.

AI is also changing cyber defence

The same type of AI capability can also be used to improve cyber security. Security platforms increasingly use AI to analyse activity across Microsoft 365, email, user identities, endpoints and cloud services.

AI is looking for behaviour that doesn't fit the normal pattern. For example, it can recognise:

  • A user logging in from two different countries within a short period.
  • An employee granting unexpected permissions to a Microsoft 365 application.
  • Unusual email activity that could indicate a compromised account.
  • Multiple low-level security events that are connected to the same incident.

Any one of those activities might have an innocent explanation. The point is that AI can spot when several of them are happening at once and flag it before anyone has had to go looking.

What this looks like in practice

This is the approach at the heart of the Secure360.io service. Many organisations are overwhelmed by the volume of security alerts they receive. By correlating activity across your environment, our platform filters out much of the noise, helping our team focus on the alerts that genuinely require investigation.

Rather than watching each part of your Microsoft 365 environment in isolation, the platform looks across email, identities, endpoints and cloud activity together because that's where the patterns emerge.

But that doesn't remove people from the process - alerts still require judgement. Our team reviews incidents, investigates unusual activity and provides practical advice on the most appropriate response. AI gives us greater visibility and faster detection. and human expertise provides the context needed to protect your business.

The fundamentals still apply

The NCSC's guidance doesn't suggest organisations need to abandon existing security practices in favour of AI. The controls that reduce risk today will continue to reduce risk tomorrow. Multi-factor authentication, patch management, secure Microsoft 365 configuration, endpoint protection and effective identity management remain the foundation of good cyber security.

What should SMEs think about?

Most SMEs don't need to understand the technical detail behind Frontier AI. They do need confidence that someone is continuously monitoring their environment, identifying unusual behaviour and responding before a small security issue develops into a business disruption.

The businesses that manage this well won't necessarily be the biggest or the best resourced. They'll be the ones that have the basics in place and someone watching what's happening while it's happening and not after the fact.

Photo of a laptop and padlock showing security of device.
overlay
10 Jun

Do SMEs Need Penetration Testing?

What is Penetration Testing?

Penetration testing (also called a pen test) is a controlled security assessment where specialists attempt to access your systems in the same way a real attacker would. The goal is to find weaknesses before criminals do. The resulting report shows what was discovered, how serious each risk is, and what should be fixed first.

A pen test might examine your Microsoft 365 environment, internet-facing systems, remote access tools, cloud infrastructure, internal networks, or user privilege controls - depending on where your business is exposed.

Start With the Fundamentals before Advanced Testing

Before investing in more advanced testing, it is important to have your core security controls in place. The National Cyber Security Centre (NCSC) recommends this approach. For most UK SMEs, that means aligning with Cyber Essentials, the government-backed certification scheme designed to reduce common cyber risks.

Cyber Essentials covers five areas:

  • Firewalls
  • Secure configuration
  • User access control
  • Malware protection
  • Patch management

These controls are effective because most attacks still exploit basic weaknesses: unpatched systems, weak passwords, poorly secured remote access. Fixing those fundamentals typically reduces risk faster and more cost-effectively than commissioning advanced security testing.

Once those basics are in place, some organisations move on to Cyber Essentials Plus. This is not a penetration test. It uses the same five Cyber Essentials controls, but adds an independent technical audit of in-scope systems. This includes internal and external vulnerability scanning, along with technical checks on a sample of devices and systems within scope. Others may go further still and commission penetration testing to understand how weaknesses could be exploited in practice.

When Does Penetration Testing Become Relevant for SMEs?

Common triggers for starting to look at testing include:

  • Client security questionnaires asking for evidence of independent testing
  • Cyber insurance renewals with stricter requirements than previous years
  • Supplier due diligence checks from larger organisations in your supply chain
  • Significant growth in remote working or cloud-based systems
  • Handling sensitive customer data or operating in a regulated sector

A good penetration test should do more than produce a list of vulnerabilities. It should explain what was found, how it could be exploited, how serious the risk is, and what should be fixed first.

What Happens During a Penetration Test?

A penetration test is more than an automated scan. Experienced testers combine automated tools with manual investigation to identify weaknesses that automated scanning alone may miss.

A typical penetration test involves:

1. Scoping

The objectives and systems to be tested are agreed in advance. This may include internet-facing systems, cloud platforms, Microsoft 365, remote access services, or internal networks.

2. Reconnaissance

The tester gathers information about the environment in the same way a potential attacker would. This helps identify possible entry points.

3. Vulnerability Assessment

Systems are examined for known weaknesses, configuration issues, outdated software, and other security gaps.

4. Controlled Exploitation

Where appropriate, the tester attempts to exploit identified weaknesses to determine whether they could be used to gain unauthorised access, escalate privileges, or expose sensitive information.

5. Reporting and Remediation

The findings are documented in a report that explains the risks, potential business impact, and recommended actions. The focus should always be on helping organisations prioritise improvements rather than producing a long list of technical issues.

Why SME Attack Risk Has Grown

The UK Government Cyber Security Breaches Survey consistently shows that cyber attacks against small businesses are common. Most are opportunistic rather than targeted, for example criminals scanning for accessible weaknesses rather than picking a specific victim.

The most frequently exploited weaknesses are:

  • Old or inactive user accounts that were never properly closed
  • Missing security updates on internet-facing systems
  • Exposed remote access services without adequate controls
  • Weak password policies or reused credentials
  • Microsoft 365 environments that have not been securely configured beyond the default settings.

As businesses add cloud services, remote access tools, and third-party platforms, there are simply more places where security weaknesses can appear.

Frequently Asked Questions

Do small businesses need penetration testing?

Not always, and not immediately. Most SMEs should first ensure that MFA, patching, endpoint protection, and Microsoft 365 security configuration are properly managed. Once those fundamentals are in place, a pen test can help answer the next question: can an attacker identify and exploit weaknesses despite those controls being in place?

Is penetration testing required for Cyber Essentials?

No. Standard Cyber Essentials certification does not require a penetration test, and neither does Cyber Essentials Plus. Some organisations choose to commission penetration testing alongside these certifications to gain additional assurance or satisfy client security requirements.

How often should SMEs carry out penetration testing?

Annual testing is common for businesses that handle sensitive information, operate internet-facing systems, or sit within larger supply chains. After significant changes to infrastructure, new cloud platforms, expanded remote access, or major system updates, earlier retesting is sensible.

Does cyber insurance require penetration testing?

Requirements vary by insurer, sector, and risk profile. Some insurers increasingly request evidence of vulnerability management, MFA deployment, and broader security assurance. If your renewal is approaching, it is worth checking the specific requirements rather than assuming last year's documentation will still suffice.

The real value of testing

The value of penetration testing allows businesses to understand where weaknesses exist and to make informed decisions, focus investment where it matters most and improve security with confidence.

Secret Link