News

Photo of a laptop and padlock showing security of device.

10 Jun

Do SMEs Need Penetration Testing?

What is Penetration Testing?

Penetration testing (also called a pen test) is a controlled security assessment where specialists attempt to access your systems in the same way a real attacker would. The goal is to find weaknesses before criminals do. The resulting report shows what was discovered, how serious each risk is, and what should be fixed first.

A pen test might examine your Microsoft 365 environment, internet-facing systems, remote access tools, cloud infrastructure, internal networks, or user privilege controls - depending on where your business is exposed.

Start With the Fundamentals before Advanced Testing

Before investing in more advanced testing, it is important to have your core security controls in place. The National Cyber Security Centre (NCSC) recommends this approach. For most UK SMEs, that means aligning with Cyber Essentials, the government-backed certification scheme designed to reduce common cyber risks.

Cyber Essentials covers five areas:

Firewalls
Secure configuration
User access control
Malware protection
Patch management

These controls are effective because most attacks still exploit basic weaknesses: unpatched systems, weak passwords, poorly secured remote access. Fixing those fundamentals typically reduces risk faster and more cost-effectively than commissioning advanced security testing.

Once those basics are in place, some organisations move on to Cyber Essentials Plus. This is not a penetration test. It uses the same five Cyber Essentials controls, but adds an independent technical audit of in-scope systems. This includes internal and external vulnerability scanning, along with technical checks on a sample of devices and systems within scope. Others may go further still and commission penetration testing to understand how weaknesses could be exploited in practice.

When Does Penetration Testing Become Relevant for SMEs?

Common triggers for starting to look at testing include:

Client security questionnaires asking for evidence of independent testing
Cyber insurance renewals with stricter requirements than previous years
Supplier due diligence checks from larger organisations in your supply chain
Significant growth in remote working or cloud-based systems
Handling sensitive customer data or operating in a regulated sector

A good penetration test should do more than produce a list of vulnerabilities. It should explain what was found, how it could be exploited, how serious the risk is, and what should be fixed first.

What Happens During a Penetration Test?

A penetration test is more than an automated scan. Experienced testers combine automated tools with manual investigation to identify weaknesses that automated scanning alone may miss.

A typical penetration test involves:

1. Scoping

The objectives and systems to be tested are agreed in advance. This may include internet-facing systems, cloud platforms, Microsoft 365, remote access services, or internal networks.

2. Reconnaissance

The tester gathers information about the environment in the same way a potential attacker would. This helps identify possible entry points.

3. Vulnerability Assessment

Systems are examined for known weaknesses, configuration issues, outdated software, and other security gaps.

4. Controlled Exploitation

Where appropriate, the tester attempts to exploit identified weaknesses to determine whether they could be used to gain unauthorised access, escalate privileges, or expose sensitive information.

5. Reporting and Remediation

The findings are documented in a report that explains the risks, potential business impact, and recommended actions. The focus should always be on helping organisations prioritise improvements rather than producing a long list of technical issues.

Why SME Attack Risk Has Grown

The UK Government Cyber Security Breaches Survey consistently shows that cyber attacks against small businesses are common. Most are opportunistic rather than targeted, for example criminals scanning for accessible weaknesses rather than picking a specific victim.

The most frequently exploited weaknesses are:

Old or inactive user accounts that were never properly closed
Missing security updates on internet-facing systems
Exposed remote access services without adequate controls
Weak password policies or reused credentials
Microsoft 365 environments that have not been securely configured beyond the default settings.

As businesses add cloud services, remote access tools, and third-party platforms, there are simply more places where security weaknesses can appear.

Frequently Asked Questions

Do small businesses need penetration testing?

Not always, and not immediately. Most SMEs should first ensure that MFA, patching, endpoint protection, and Microsoft 365 security configuration are properly managed. Once those fundamentals are in place, a pen test can help answer the next question: can an attacker identify and exploit weaknesses despite those controls being in place?

Is penetration testing required for Cyber Essentials?

No. Standard Cyber Essentials certification does not require a penetration test, and neither does Cyber Essentials Plus. Some organisations choose to commission penetration testing alongside these certifications to gain additional assurance or satisfy client security requirements.

How often should SMEs carry out penetration testing?

Annual testing is common for businesses that handle sensitive information, operate internet-facing systems, or sit within larger supply chains. After significant changes to infrastructure, new cloud platforms, expanded remote access, or major system updates, earlier retesting is sensible.

Does cyber insurance require penetration testing?

Requirements vary by insurer, sector, and risk profile. Some insurers increasingly request evidence of vulnerability management, MFA deployment, and broader security assurance. If your renewal is approaching, it is worth checking the specific requirements rather than assuming last year's documentation will still suffice.

The real value of testing

The value of penetration testing allows businesses to understand where weaknesses exist and to make informed decisions, focus investment where it matters most and improve security with confidence.

12 May

Passkeys vs Passwords: Is World Password Day Finished?

World Password Day has traditionally focused on creating stronger passwords and improving password security. But this year felt different.

The National Cyber Security Centre (NCSC) has started using the phrase “World Passkey Day” as the focus shifts towards passwordless authentication.

The NCSC is now recommending passkeys over passwords where they are available because passkeys are designed to be both more secure and easier for people to use.

For SMEs, charities, and professional services firms, this matters because most cyber attacks still begin with compromised credentials.

Why businesses are moving beyond passwords

For years, organisations have focused on improving password security:

longer passwords
more complex passwords
password expiry policies
different passwords for every account

Those controls still matter but passwords continue to create security problems because passwords can still be:

stolen through phishing
reused across accounts
exposed in previous data breaches
shared between staff
guessed from public information
captured by malware

This is one of the main reasons account compromise remains one of the most common causes of cyber incidents affecting businesses.

Most attackers do not need to “hack” their way into a business network. They simply log in using valid credentials.

What are passkeys?

Passkeys are a passwordless authentication method designed to replace traditional passwords. Instead of relying on something a user remembers, passkeys use secure cryptographic authentication tied to a trusted device. In practice, this often means users log in using:

fingerprint recognition
Face ID
device PINs
biometric authentication

According to the NCSC, passkeys are resistant to phishing attacks and cannot be guessed or reused in the same way as passwords. That makes them significantly harder for attackers to steal.

Passkeys also remove many of the usability problems associated with traditional password policies. Staff do not need to remember long complex passwords or repeatedly reset forgotten credentials. The combination of stronger security and simpler access is one of the reasons passkeys are gaining momentum so quickly.

Passwords are not disappearing overnight

Most organisations will still rely on passwords for many systems for years to come. Many business applications and legacy systems do not yet support passkeys or passwordless authentication. That means password security fundamentals still matter.

Businesses should still be using:

multi-factor authentication (MFA)
password managers
unique passwords for every account
individual user accounts
strong access controls
phishing awareness training

Passkeys are not a replacement for good cyber hygiene, they are part of reducing reliance on passwords over time.

What good authentication security looks like for SMEs

For most SMEs, charities, and professional services firms, a practical approach now looks like this.

Use passkeys where supported

Enable passkeys on supported platforms such as Microsoft, Google, and Apple services where practical.

Keep MFA enabled

MFA remains one of the most effective ways to reduce the risk of account compromise.

Use a password manager

Password managers help staff use strong unique passwords without relying on memory or unsafe workarounds.

Remove shared accounts

Shared logins reduce accountability and make incident investigations far more difficult.

Review access regularly

Many organisations still have dormant accounts, excessive permissions, and outdated MFA settings sitting unnoticed in the background.

Is this the last real World Password Day?

Passwords are not disappearing tomorrow but the direction of travel is becoming increasingly clear. The NCSC recommending passkeys over passwords reflects a wider recognition across the cyber security industry that passwords alone are no longer enough to deal with modern attacks.

For organisations, the practical takeaway is simple: Reduce reliance on passwords where better alternatives already exist.

Digital key illustration with circuit pattern and text ‘Old passwords still unlock systems’, representing cyber security risk

17 Apr

MFA for SMEs: Why Stolen Passwords Still Cause Breaches

Stolen passwords remain one of the most common ways attackers access business systems. Recent investigations into data theft campaigns have identified a common issue – attackers are not breaking in, they are logging in using valid credentials. In many cases, those credentials were stolen years earlier by infostealer malware. They remain usable because they were never reset or protected with additional controls.

The UK National Cyber Security Centre (NCSC) confirms this is a common attack method. Credential based attacks continue to be a primary cause of compromise.

How these attacks actually work

Attackers buy and sell stolen login details in bulk. These are then tested automatically against common business platforms such as Microsoft 365, email systems, and remote access portals.

If a login works, access is immediate. There is no need for technical exploitation or visible intrusion. Because the login is valid, the activity often appears normal. This makes early detection difficult without additional controls.

Where your business is exposed

Any organisation using cloud services is exposed to this type of attack. This includes:

Microsoft 365
Business email systems
Cloud-based platforms

Most SMEs now rely on cloud systems for daily operations. This makes identity the primary attack surface.

How MFA helps to prevent these attacks

Multi-factor authentication (MFA) reduces this risk by adding a second verification step at login.

This could be:

a mobile app approval
a one-time code
a security key

Even if a password has been stolen, it cannot be used on its own.

This is why MFA is a core requirement of Cyber Essentials and Cyber Essentials Plus, particularly for administrator accounts, remote access, and cloud services such as Microsoft 365.

Why breaches happen without it

Without MFA, access depends entirely on the strength and secrecy of a password.

If a password has been exposed at any point – through malware, phishing, or reuse across systems – it may still be valid today.

Stolen credentials are often reused months or years later, without triggering alerts. The result is a breach that looks like normal account activity until damage has already been done.

Why insurers and clients expect MFA

MFA is no longer just a technical recommendation.

It is now:

required for Cyber Essentials
expected by cyber insurers
commonly requested in client security assessments

Organisations without MFA increasingly face:

failed compliance checks
higher insurance risk
reduced trust from customers

What to review

If you are assessing your current position, focus on:

where MFA is enabled
which accounts are not protected
how administrator access is secured

Partial coverage is a common issue. One unprotected account is enough for access.

Why this risk does not go away

Stolen passwords do not expire on their own. If they have been compromised once, they can be used at any time unless additional controls are in place.

MFA is one of the simplest and most effective ways to help prevent that access.

FAQs: MFA and stolen passwords

Do small businesses really need MFA?

Yes. Most credential based attacks are automated and target any valid login, regardless of company size. If your systems rely on passwords alone, your business can be accessed using stolen credentials.

Can stolen passwords still work years later?

Yes. If a password has not been changed, it can remain valid indefinitely. Stolen credentials are often reused months or years after the initial breach.

Does MFA stop phishing attacks?

MFA significantly reduces the risk. If a password is captured through phishing, the attacker still needs the second factor to gain access. This blocks most basic credential based attacks.

Is MFA required for Cyber Essentials?

Yes. Cyber Essentials requires MFA for administrator accounts, remote access, and cloud services such as Microsoft 365. Without it, certification cannot be achieved.

What happens if MFA is not enabled?

Attackers can log in using stolen credentials without triggering obvious alerts. This often leads to unauthorised access to email, files, and other business systems.