Blog & Social

The key cyber security purchasing and deployment issues facing SMEs

SMEs generally have very small budgets when it comes to IT and for Cyber Security, any budget is wrapped into that small IT budget because it’s seen as an IT issue. That has long been a problem and only when it’s seen as a business issue, does it get the attention it deserves. For SMEs, the biggest risk is not necessarily failing to buy cyber security technology, but it is often buying the wrong technology, deploying it incorrectly, and assuming the business is protected when it isn’t.

For a small UK business, cyber security decisions need to balance risk, cost, complexity and available expertise. A product may have excellent capabilities, but if it is poorly configured, inadequately monitored or not maintained, it can create a false sense of security.

What are the main issues SMEs should be concerned about?

Buying technology without understanding the risks

SMEs may purchase antivirus, endpoint detection, email security or backup solutions because they are familiar brands or recommended by a supplier or their IT support company, rather than because they address their specific risks. This often leaves them with the impact that money is spend, without addressing many of the vulnerabilities they face.

Overlapping products and security gaps

Different tools may offer similar features while leaving other areas uncovered. Endpoint protection, email security, identity protection and cloud monitoring need to work together. The impact is again expenditure leaving blind spots in protection.

Poor deployment and configuration

Configuration of these technologies can be complex, requiring an understanding of the risks being faced. Security features may be disabled, policies may be too permissive, devices may be excluded, or alerts may not be configured correctly. A product appears to be installed but fails to prevent or detect an attack effectively.

Who monitors and responds to alerts?

It is rare to find an SME that has the ability to monitor and respond to alerts. This is becoming more and more of an issue, especially now that Cyber Essentials requires a board level person to certify that the organisation will maintain the standard throughout the 12-month life of the certification. How are they going to do that without some form of monitoring. Detection software can generate alerts around the clock, but someone still needs to investigate them, establish whether they are genuine threats and take appropriate action. Attacks can be going on whilst staff continue with normal business activities.

Hidden costs and ongoing commitments

Licence fees are only part of the total cost. Implementation, integration, staff training, ongoing monitoring, support and renewals can add considerably to the expense, with the danger that a solution becomes unaffordable, or becomes underused and neglected.

No clear evidence that protection is working

Purchasing a product does not prove that security controls are effective. SMEs need to verify coverage, test important controls and review whether identified weaknesses have been addressed. You may believe the business is secure without having any evidence to support that belief.

Other important purchasing and deployment risks

Issue	What the SME should ask
Supplier reliability	Is the supplier established, responsive and able to provide support when something goes wrong?
Compatibility	Will the product work with our existing computers, Microsoft 365, cloud services and other security tools?
Identity and access	Does it protect user accounts, administrator privileges, multi-factor authentication and suspicious sign-ins?
Updates and maintenance	Who ensures the software, operating systems and security policies remain up to date?
Business disruption	Could aggressive security settings block legitimate applications, email or business processes?
Data privacy	What information does the product collect, where is it processed, and how is it protected?
Supplier access	What access does the provider have to our systems, and how is that access controlled?
Incident response	If an attack occurs, who investigates, who makes decisions, and who is responsible for recovery?
Exit strategy	Can we change suppliers or cancel the service without losing important data, visibility or protection?
Compliance	Does the solution help meet relevant contractual, regulatory or Cyber Essentials requirements, and can we demonstrate that the controls work?

The particular challenge for small businesses

SMEs often face three constraints simultaneously:

Limited budgets: They cannot buy every available security product.
- Limited technical expertise: They may not have an in-house security specialist to configure and maintain their tools.
- Limited time: Directors and employees have other responsibilities, so security tasks can be neglected.

This means the objective should not be to accumulate the largest number of security products. It should be to achieve an appropriate level of protection and maintain it consistently.

For example, a business with 15 employees using Microsoft 365 might already have some useful security features included in its subscriptions. Before purchasing additional products, it should establish which features are licensed, enabled, correctly configured and actively monitored. It may then need additional endpoint protection, managed detection and response (MDR), backup or other controls to address the remaining risks.

A practical purchasing and deployment framework

Assess the risks first

Identify important business systems, sensitive data, likely threats and the consequences of an incident. A Cyber Maturity Assessment (CMA) can provide a structured baseline.

Define the required outcomes

Specify what the business needs to prevent, detect, respond to and recover from. Avoid selecting a product before defining the problem.

Evaluate the whole cost

Compare licence costs, implementation, configuration, monitoring, support, training and renewal costs over the expected life of the solution.

Verify deployment

Confirm that every relevant device, account and service is covered; settings are appropriate; and alerts reach someone who can act on them.

Test effectiveness

Check security configurations, simulate appropriate scenarios, test backups and recovery, and confirm that alerts and escalation procedures work.

Monitor and review continuously

Review alerts, patching, access rights, device coverage and outstanding risks. Reassess the controls when the business or its technology changes.

Questions directors should ask before approving a purchase

SME cyber security buying checklist

Have we identified the business risks this product is intended to address?
Do we know what security capabilities we already own?
Is the product compatible with our existing systems?
Who is responsible for installation, configuration and maintenance?
Who monitors alerts and responds outside normal working hours?
Have we confirmed all relevant devices, users and cloud services are covered?
Have we tested detection, incident response and backup recovery?
Can we demonstrate that relevant security controls are operating effectively?
Is the total ongoing cost affordable, including support and renewals?
Will the supplier provide clear reporting and evidence of protection?

How can a Cyber Maturity Assessment and MDR help an SME:

Understand its current security posture before committing to additional expenditure.
Identify gaps and prioritise improvements according to risk, cost and effort.
Make better use of existing licences and technology.
Establish whether MDR is justified and which level of service is appropriate.
Develop a practical improvement roadmap and evidence progress towards Cyber Essentials.

MDR can then be used to address the ongoing challenge of monitoring and responding to threats, rather than leaving the SME dependent on software alone.

Finally

Our message to SME owners and directors is:

Don’t just ask, “What cyber security technology should we buy?” Ask, “What risks are we trying to reduce, how will we know the controls work, and who will make sure they continue to work?”

How a worldwide PHP issue could affect UK SMEs

Lots and lots about this PHP issue on both the mainstream media and social media, but what is it all about and how does it effect SMEs? Most people just want a straight description of the issue, a discussion on who it effects and who needs t be worried, and how to fix it. Perhaps just as importantly for SMEs, who is responsible for fixing it? I say that because the vast majority of SMEs will have outsourced their website, not just its design but also its hosting. The argument there, in regard to who needs to do the fixing, will probably come down to Ts and Cs.

So, what’s it all about? The security flaw has been dubbed PHP2Shell, and was discovered in PHP, a programming language used by around 70% of the world’s websites, including many built using WordPress.

The flaw could, and note the word could, allow hackers to break into a vulnerable website’s server remotely, without needing a password. Once inside, they could potentially steal customer information, install malicious software, change website content or use the server to launch further attacks.

Why is it in the news now? Frankly anything with the acronym AI will get an immediate hype, which is not to say there isn’t a danger, just that it will get more attention than most other, somewhat boring, security flaws which crop up all the time. So, what we’re sayi8ng is that AI techniques have been used to help identify and demonstrate the vulnerabilities. Emergency security updates were released on 21 October 2026, and reports of attempts to exploit the flaws have already surfaced. Website owners are being urged to update urgently.

A widespread PHP issue could have a significant impact on SMEs, but the level of risk depends on how the website is built, what it connects to, and how the business uses it.

The important distinction is between a website that simply provides information and one that processes orders, payments or customer information. Both can suffer disruption, but the consequences can be very different.

Two types of SME website

The first can be described as an information website. That is a website that presents services, company details and contact information, with perhaps a contact form. A website of this kind has a lower direct network exposure and ff hosted separately and isolated from the SME’s internal network, then a compromise would not automatically mean the business network has been compromised. However, the site could still be unavailable, defaced, used for phishing or have contact data stolen.

An e-commerce-enabled website however is a different problem. This is a website that accepts orders, processes customer information, manages stock or integrates with payment and fulfilment systems. It will have a much higher business impact if compromised. In addition to downtime, an incident could affect transactions, customer data, order integrity, payment integrations and the business’s ability to fulfil orders.

The key point is that a website can be separate from the office network but still be an important business asset and an entry point for attacks against customers, suppliers or connected services.

The first thing and SME needs to decide then, is what type of website they have, before they can begin to assess the risk.

What is happening with the current PHP issue?

The current incident is more serious than a routine website outage. On 21 October 2026, PHP developers released urgent security fixes for two critical vulnerabilities that could allow attackers to execute malicious code remotely on vulnerable servers without logging in. The UK’s National Cyber Security Centre (NCSC) has advised organisations to identify PHP systems, prioritise internet-facing systems, apply updates and consider taking systems offline if they cannot be secured promptly.

This means there are two separate risks for an SME:

Availability risk: the hosting provider or website developer may temporarily take the website offline to protect it or install updates.
Security risk: if the website remains vulnerable and is successfully attacked, the consequences could extend beyond the website itself.

The fact that the website is small or only informational does not make the PHP vulnerability irrelevant. The flaw exists at the PHP server level, rather than necessarily in a particular website feature.

Scenario A — An informational website with a contact form

Consider a small UK accountancy practice, solicitor, manufacturer or financial adviser with a website hosted by an external provider. The website has no direct connection to its Microsoft 365 environment, office computers or internal systems.

Risk 1: Website unavailable

Visitors cannot find services, verify the business’s details or submit enquiries. The immediate impact is lost leads, reduced credibility and possible disruption to customer communications.

Risk 2: Website compromised

An attacker who successfully exploits a vulnerable server might alter pages, redirect visitors to fraudulent sites, host malware or use the website to distribute phishing messages.

Risk 3: Contact-form abuse or data exposure

A form could be abused to send spam or fraudulent messages. If submissions are stored on the server, or the website has access to customer information, that information could also be at risk.

Risk 4: Potential onward attack

If the compromised website shares a hosting account with other sites, contains reusable administrator credentials, or has access to other services, the attacker may have opportunities to go further.

Does isolation from the business network protect the SME?

It materially reduces the risk, but it does not eliminate it.

If the website is genuinely isolated, runs on separate hosting and holds no internal credentials, a successful attack against it does not automatically give an attacker access to the SME’s office network.

However, isolation needs to be real, not assumed. The SME should establish whether the website:

Uses separate hosting and administrator accounts.
Has any integration with Microsoft 365, CRM, email marketing or cloud storage.
Stores contact-form submissions or customer records.
Shares hosting, credentials or administrative access with other systems.

A static informational site with a third-party contact form and no sensitive, stored data may have a relatively limited direct business impact. A WordPress website with administrator access, stored submissions and multiple integrations could present a much larger risk, despite looking like an ordinary brochure website.

Scenario B — An e-commerce-enabled website

An e-commerce website presents a more substantial business risk because it processes transactions and usually has more extensive application functionality.

Lost revenue

If the shop is taken offline, customers cannot order. Even a short interruption can cause lost sales, abandoned baskets and additional customer-service work.

Customer and order information

Depending on the websites permissions and architecture, an attacker might access customer names, addresses, contact details, order histories or other stored information.

Payment and checkout integrity

A compromised site could potentially have checkout pages altered to capture payment details or redirect customers. The actual exposure depends on whether payment processing is handled entirely by a separate provider or partly by the SME’s website.

Operational disruption

Orders might be delayed, stock records altered or integrations with fulfilment, accounting and customer-management systems disrupted.

There is also a reputational and regulatory dimension. If personal data is compromised, the SME may need to investigate the incident, assess its UK GDPR obligations and notify the ICO or affected individuals where legally required. A payment-related incident may also trigger obligations under the business’s payment-provider or acquiring-bank arrangements.

One important distinction: using a third-party payment processor reduces the amount of payment data the SME’s website needs to handle, but it does not make a compromised website harmless. The site could still manipulate the checkout experience or mislead customers.

What should you do now?

The NCSC’s latest guidance is that businesses should contact their website developer, IT provider or hosting company, confirm that the security updates have been applied, and establish whether checks for compromise have been performed.

I would recommend the following actions for both types of website.

Questions to ask your website provider and/or hosting service.

Identify whether PHP is used
Ask the hosting provider or web developer if WordPress and many other content management systems use PHP.
Confirm the security patch is installed
Request confirmation of the PHP version, the relevant security fix and when it was applied.
Ask whether the site was checked for compromise
Patching alone does not establish that an attacker did not access the server beforehand.
Review access and connected services
Check administrator accounts, unexpected changes, integrations, stored data and shared hosting.
Verify backups and recovery
Ensure clean backups exist and the website can be restored if necessary.
Escalate suspicious findings
If there are unexplained changes, new accounts or other indicators of compromise, ask a qualified incident-response provider to investigate.
If the website provider cannot apply the fix promptly, ask what temporary protection is in place. Taking an exposed website offline may be appropriate until it can be secured. Do not assume that a web application firewall or other perimeter protection is a substitute for the required security update.

For an e-commerce business, I would add a specific review of payment-provider integrations, checkout-page integrity, customer data access and recent orders.

How this relates to H2 Cyber Risk Advisory Services

Well, I’m sure you’ll forgive me for highlighted our services, because they have a very real play here. It is a useful example of how a Cyber Maturity Assessment (CMA) and Managed Detection and Response (MDR) complement one another.

CMA: Establishes which externally hosted services the business depends on, who manages them, what data they hold, and whether supplier oversight, incident response and recovery arrangements are adequate.
MDR: Provides monitoring and investigation capabilities for the systems within its agreed scope. If the website or hosting environment is outside that scope, MDR should not be presented as automatically protecting it. The provider must confirm what telemetry and response capabilities are available.
Together: The CMA identifies gaps and prioritises improvements, while MDR can provide ongoing detection and response for the systems it covers.

The central lesson for SMEs is that a website does not need a direct connection to the office network to create a serious business risk.

Do SMEs need to be concerned about Nation State cyber-attacks?

When we talk about cyber scams and attacks on SMEs, we concentrate on threats from cyber criminals because, quite simply, they are not just the perceived threat, but often the actual threat. However, there is another category which we tend not to connect with SMEs, but rather with the corporate and government worlds, and that is the nation state threat. With what’s happening in the world today, maybe we should be keeping a weather eye on that potential threat.

Let’s take Iran for example, research suggests that they have been far more successful at espionage and disruption than at causing strategic damage. Since the conflict escalated (initial Israel-Iran fighting in June 2025, followed by direct US-Israeli operations against Iran in February 2026), Iran’s cyber organisations have launched thousands of attacks against Israel, the US and Western allies. However, most have been contained, short-lived, or psychological in effect rather than strategically decisive. Cyber defences have largely prevented catastrophic infrastructure failures. This suggests that there hasn’t been much to worry about, from an SME perspective. However, there is much more to it than that.

For UK SMEs, this is one of the biggest shifts in cybersecurity over the past 2–3 years. Nation-state actors are no longer just targeting governments and FTSE 100 companies. They’re increasingly targeting SMEs because SMEs are the easiest route into larger organisations, valuable data, and critical UK supply chains.

The UK National Cyber Security Centre (NCSC) has repeatedly warned that the most serious cyber threats facing the UK now come from Russia, China, Iran and North Korea, and that businesses of all sizes need to prepare for attacks linked to geopolitical conflict.

The Nation-State Cyber Threat Landscape for UK SMEs (2026)

A Board-level takeaway is that your business is probably collateral damage, not the primary target. You’re the route into your larger customers. SMEs are targeted because they are easier to compromise than large enterprises and often have trusted access into customers, suppliers, and public-sector organisations.

What SMEs worry about	What nation states actually do
Steal money with ransomware	Steal credentials, intelligence, disrupt supply chains, prepare infrastructure for future conflict, and sometimes use ransomware as cover
‘We’re too small’	‘You’re connected to someone bigger’
Only defence companies are targets	Law firms, accountants, manufacturers, MSPs, logistics, healthcare, charities, fintech and engineering SMEs are all regularly targeted.

The UK Government’s Cyber Security Breaches Survey 2025 found that 43% of UK businesses experienced a cyber breach or attack in the previous year, around 612,000 businesses. OK, but why would a nation state target a 25-person business?

The “supply chain attack” model

Think of your SME as a trusted key into someone else’s business.

SME Type	Why it’s attractive
Managed Service Providers	Access to hundreds of customers through remote management tools
Law firms	M&A documents, litigation, intellectual property, government contracts
Accountants	Financial records, payroll, tax credentials
Manufacturers	Defence supply chains, engineering drawings, OT systems
Financial Advisors	High-net-worth client information and payment systems
Healthcare SMEs	Sensitive patient information and NHS connectivity

This is exactly why Cyber Essentials and the upcoming Cyber Security & Resilience Bill place greater emphasis on supply-chain security.

So which nation states pose the biggest risk to UK SMEs?

Comparison at a glance

Actor	Primary Objective	SME Targets
China	Economic espionage	Manufacturing, legal, biotech, technology, universities, MSPs
Russia	Disruption, espionage, influence	Energy suppliers, logistics, transport, IT providers, defence supply chain
Iran	Retaliation, disruption, hacktivism	Utilities, local government suppliers, legal firms, critical infrastructure suppliers
North Korea	Financial theft	Cryptocurrency, fintech, software companies, payroll providers

Firstly China, regarded, by UK intelligence, as the most capable long-term cyber espionage threat against UK business. They typically look at SME targets involved in:

Aerospace.
Advanced manufacturing.
Robotics.
AI.
Pharmaceuticals.
Universities.
Defence subcontractors.
Typical techniques

Why SMEs are targeted and why it matters:

A 20-person precision engineering company supplying parts into aerospace may unknowingly possess intellectual property valuable to a foreign state. This is particularly relevant to manufacturing SMEs like CNC engineering suppliers.

Russia is known for Supply Chain attacks and Disruption, their objectives:

Intelligence gathering.
Political disruption.
Critical infrastructure preparation.
Supply-chain compromise.

They may target:

MSPs.
Logistics firms.
Energy suppliers.
Transport providers.
Engineering consultancies.

The war in Ukraine has shown Russia routinely targets organisations supporting infrastructure rather than infrastructure alone.

Back to Iran, an increasing threat to UK Businesses.

Following escalating conflict involving Iran, Israel and the US, UK authorities warned businesses to prepare for Iran-linked cyber activity, including attacks against smaller organisations connected to essential services. A recent UK example is a small UK gas-fired power plant that was temporarily shut down by suspected Iran-linked hackers, prompting government action to strengthen supply-chain cyber regulation.

They are known for:

Website defacement.
Credential theft.
Ransomware.
Industrial control system attacks.
Destructive malware.

Energy contractors, water suppliers, engineering companies, local authority suppliers and MSPs supporting infrastructure, are all targets.

North Korea is a little different as it is suspected that cybercrime funds the state, and unlike China and Russia, North Korea often attacks businesses primarily for money.

Fintech, cryptocurrency firms, payroll providers, software companies and defence contractors, are the main targets.

What do we need to on guard against and to look out for. It is assessed that the most likely Nation-State attack paths into an SME are often related to:

Microsoft 365 is a common battlefield for SMEs. Microsoft 365 identities are now the most commonly targeted asset because compromising M365 gives attackers:

Email.
OneDrive.
SharePoint.
Teams.
Contacts.
MFA reset opportunities.

Next comes AI which has changed Nation-State attacks. For example, AI-powered phishing is now industrialised. Before AI:

Poor grammar.
Obvious phishing.

But now:

Perfect English.
Company branding copied.
Deepfake voice messages.
Fake Teams meetings.
Fake invoices.

Attackers now impersonate CEOs, Solicitors, Bank staff, IT support and suppliers. NCSC has warned AI is increasing the sophistication and scale of attacks.

Nation state threats influence how Cyber Essentials maps to nation-state tactics and why v3.3 matters. The executive declaration requiring continuous assessment reflects the reality that attackers exploit newly introduced weaknesses throughout the year, not just during annual certification.

For UK SME Leaders the conversation has changed. Cybersecurity is no longer just about avoiding ransomware. Nation-state activity means SME directors should think about the NCSC’s message that hostile-state cyber activity is increasing alongside geopolitical tensions, and SMEs are increasingly part of that threat landscape rather than outside it. I hope this helps somewhat in understanding just how much the threat landscape has changed and how much it is affected by world events.

AI – truly intelligent or over hyped?

I have commented before on the AI discussions that appear periodically on social media and do so with some trepidation because there are so many opinions. And I must put my hands up and say I am not an expert although I do use AI in my everyday work. I’m not against it but it must be used intelligently and seen for what it is, not what the hype says it is. This is particularly true of generative AI, which is the type of AI that is most known about and discussed. Generative AI is a branch of AI that focuses on creating new content, such as text, images, audio etc, by learning patterns from vast datasets and generating output that resembles human-created work. Of course, to generate this content, you must define clearly what outcome you are looking for.

Over the years, I’ve seen change happening because of innovation within IT, much of which has forecast the end of the workforce. It has streamlined many processes and taken a lot of drudgery away. I’ve been involved in mapping out working practices and designing/implementing management processes using IT. I’ve seen the development of relational databases and search engines, both of which have done much to increase the speed and access to information that is required. Is AI doing anything different in the workplace? Or is it just the next somewhat inevitable step up?

I have to say though, that during the years when I was working with management information systems, whilst they did improve speed and efficiency, they never really achieved the manpower savings they were advertised to do. One claim about AI, that it will achieve those manpower reductions seem a little excessive, in fact one forecast I read by a CEO was that it would have a devastating effect. It makes me wonder who is going to buy these wonderful goods that are being so efficiently produced if the unemployment rate is through the roof and no one can afford to buy them? Just a thought.

But getting back to AI itself, is it truly intelligent? This is where a lot of misunderstanding and indeed, misinformation, can be found. What forms of AI are there? And what forms of AI are available now to business and the public. There are about 7 categories of AI, not types i.e. marketed under a trade name, but categories.

Type	Exists today?	Purpose
Narrow AI	✅ Yes	Performs specific tasks
General AI (AGI)	❌ No	Human-level intelligence across many tasks
Superintelligent AI (ASI)	❌ No	Exceeds human intelligence
Reactive AI	✅ Yes	No memory, responds to inputs
Limited Memory AI	✅ Yes	Uses past information
Theory of Mind AI	❌ No	Understands emotions and intentions
Self-Aware AI	❌ No	Conscious, self-aware intelligence

Categories of AI

As we sit here today, virtually all AI systems, including the most well-known such as ChatGPT, are forms of Narrow AI. They can be highly capable within their domains, but they do not possess human-like general intelligence or consciousness. Narrow AI (and yes, I did use it to create the graphic above), is characterised by:

Designed for specific tasks.
Cannot think generally outside its training or purpose.
Examples:
- ChatGPT
- Siri and Alexa
- Google Translate
- Image generators
- Recommendation systems (Netflix, Spotify)
- Etc

I have said that I use AI, but I struggle to think of it as intelligent, but I do recognise that it is all about how you define that intelligence. I use it mostly in my managed service, to monitor clients’ systems and keep them as safe as is possible. Prior to moving into the SME space, I worked for some major clients, both public and private sectors and built several security operations centres. Back then most of these were centred on SIEM systems, which used correlation engines to correlate the results gathered from several other systems, such as anti-malware, firewalls, intrusion detection systems etc. The system would then produce results, and those results would be viewed by an analyst before pronouncing them real or a false positive, or whatever. That was always way too expensive for an SME. Using AI systems, that cost has now been reduced to a price point that can be attractive to an SME. So, this is one feature where AI can be of great benefit and is proving itself way more efficient than the correlation engines of old. Of course, this isn’t the only difference, but it is the one we’re talking about today.

One type of AI that we didn’t qualify above was what is known as Agentic AI. This is not a separate category but rather a description of how an AI behaves, rather than how capable it is. For example, whereas many systems that fit within Narrow AI, do so because they are designed for specific tasks. Agentic AI can plan and achieve a goal, providing it has the right information and instructions to act upon. This enables it to undertake research for example, so when it finds what it thinks is an issue, it can research that to produce a more definitive answer to an analyst to review. It might learn enough so that you will trust it with low level alerts and decisions, on its own. Whether you think that that is intelligence or not, I will leave to you.

Agentic AI allows us to use a layered model embedded in an application which we can use to support SMEs at a reasonable price point. That layered model includes:

Behavioural AI/ML → detects attacks.
Correlation engine → connects events across identities, endpoints, email, and cloud.
LLMs → explain incidents and assist administrators.
Human MDR analysts → validate and respond to serious threats.

Briefly:

Identity-based threat detection

Rather than looking at devices in isolation, we use a system which correlates activity around people (identities).

It continuously analyses signals from:

Microsoft 365 or Google Workspace accounts
Endpoints (Windows/macOS)
Email
Cloud storage
Dark web monitoring
External attack surface

The AI combines these signals to identify suspicious patterns, such as:

Impossible travel logins
Unusual login times
MFA changes
Credential leaks
Suspicious file access

Instead of generating dozens of alerts, it attempts to determine whether these events are part of the same attack.

Machine learning for detection

Machine learning is used to:

Learn normal user behaviour
Detect anomalies
Reduce false positives
Prioritise high-risk incidents

Generative AI (LLMs)

The system also uses large language models for tasks such as:

Summarising complex security incidents
Explaining alerts in plain English
Helping administrators understand why something was flagged
Generating phishing simulation emails for employee training

This is different from the AI used to detect threats, it’s focused on making security information easier to understand and act on.

Automated response

When the AI determines an attack is likely, it can recommend or automate actions such as:

Disabling compromised accounts
Isolating infected endpoints
Blocking phishing emails
Forcing password resets
Escalating incidents to a human analyst

The platform combines AI-driven automation with human security analysts for higher-confidence incidents.

So back to where I started before I got carried away. Is AI truly intelligent? I have my opinion which I hope came through here, but I leave you to make up your own mind. One thing though is for sure, AI is here to stay, and it will continue to get developed and will get better, or worse, depending upon your point of view.

CYBER SECURITY IS COMMON SENSE, ISN’T IT?

Well, yes and no. Whilst cybersecurity is often described as “common sense,” that statement is only partly true. Common sense does help avoid some online threats, but modern cybersecurity also requires awareness of evolving risks, organisational safeguards and some technical knowledge. Cybersecurity is best understood as a combination of common sense, education, and technology. Or as we in cybersecurity, like to say, ‘People, Process and Technology.

On one hand, many cybersecurity practices are based on common-sense principles. People are advised not to share passwords, not to click on suspicious links, and to be cautious when receiving unexpected emails or messages. These actions are like everyday safety habits, such as locking doors or being careful when speaking to strangers. As is shows in the graphic above, you don’t go out in the morning, locking your doors, but leaving your windows open. In cyber the use of strong passwords, enabling multi-factor authentication, and keeping software up to date are practical measures that reduce the likelihood of cyberattacks.

However, cybersecurity extends far beyond everyday judgment. Cybercriminals use sophisticated techniques such as phishing, ransomware, malware, and social engineering that can deceive even experienced users. Attackers often create convincing fake websites, emails, or phone calls that appear legitimate. As technology evolves, new vulnerabilities emerge that are not obvious to the average person. Without proper training, users may not recognise these threats, regardless of how cautious they are.

In addition, organisations cannot rely solely on employees’ common sense to protect their systems. Small to medium businesses need to implement security policies, use firewalls, anti-malware as a minimum, whilst considering encryption, intrusion detection systems, and regular security audits to defend against attacks. Employees should also be receiving regular cybersecurity awareness training to help them identify threats and respond appropriately. These technical and organisational measures complement individual responsibility.

Another reason cybersecurity is not simply common sense is that many attacks exploit software vulnerabilities rather than human mistakes. Even careful users can become victims if systems are not patched or if security controls are inadequate. This highlights the importance of skilled cybersecurity professionals who continuously monitor networks, manage risks, and respond to incidents. The issue here is that many SMEs simply don’t have the knowledge to fully understand what is, and what is not, happening on their systems.

I going to show some examples now, not to showcase my managed service so much, but to demonstrate what most people simply don’t think about. I could have chosen any of a dozen or so, but I’ve alighted on these. In the example below, we are showing client services that are exposed to the internet. This is something that an SME simply wouldn’t know about or perhaps understand the significance.

Figure 1 – Issue Types

What this shows is the varied types of issues that can arise and that need constant monitoring to stay on top of. These types of issues tend to fly under the radar of most SMEs, and for that matter many bigger companies, and can be exploited by hackers and scammers, with the aim of stealing your hard earned cash.

This next example shows an account compromise as it occurs. Most organisations will not know this is happening until it’s too late. If you can get an early heads up then you stand a chance of stopping it from occurring. All the common sense in the world won’t help you detect a breach as it’s happening, that takes monitoring or an absolute ton of luck.

Figure 1 – Potential account compromise

What we’ve seen here are just two examples of where common sense will only take you so far. It’s a horrible expression, but you really don’t know what you don’t know.

In conclusion, cybersecurity involves an element of common sense, particularly in practicing safe online behaviour. However, common sense alone is insufficient in today’s complex digital environment. Effective cybersecurity depends on a combination of informed users, ongoing education, robust technology, and well-designed security policies. Only by integrating these elements can individuals and organisations effectively protect themselves against increasingly sophisticated cyber threats.

We’d be happy to provide more information via a demonstration of our managed capability, including the offer of a fully functional and totally free 14-day trial.

HOW CAN SMEs MONITOR COMPLIANCE TO CYBER ESSENTIALS EASILY

I put up a post earlier this week about cyber essentials, how effective it is and how it should be viewed. There have been some interesting posts recently on this subject and the main argument was that it should be viewed as a base line standard, not a total panacea. Adherence to it provides a good platform on which to stand your protections and provides a basic understanding of the issues involved, which many SMEs don’t fully grasp.

Cyber threats don’t just target enterprises anymore and SMEs are increasingly in the crosshairs, often without the resources to defend themselves effectively. But it remains important to keep in mind that for many UK SMEs, cybersecurity is no longer just about protection, it’s about winning business. It’s important to think in terms of simplicity rather than complexity. Cyber security doesn’t have to be complicated or expensive.

My post talked about what happens after a company has achieved compliance to CE? The requirement now is to certify that they will maintain that compliance throughout the 12-month period of the certification. That is why H2 has researched a service that can be provided to SMEs at a reasonable cost, that helps simplify that journey by providing an all-in-one cybersecurity platform with continuous monitoring aligned to Cyber Essentials requirements. It helps identify security gaps, strengthen your cyber posture, and keep your business on track for compliance, while protecting your users, devices, email, and cloud environment.

We did think however that perhaps a more detailed view might be worth publishing, and here it is.

NCSC has published v3.3 (Danzell) requirements effective from April 2026, which further tighten areas such as MFA and cloud-service requirements. Organisations that have only just adapted to last years changes (Willow) should already be reviewing the next revision to avoid another compliance scramble when renewal comes around.

What changed in the Danzell question set?

The five Cyber Essentials control areas remain the same:

Firewalls
Secure Configuration
User Access Control
Malware Protection
Security Update Management

However, Danzell asks more detailed and specific questions about how these controls are implemented and evidenced.

Key themes covered by the Danzell questions

Multi-Factor Authentication (MFA)

The questionnaire now requires organisations to identify all cloud services in use and confirm MFA is enabled where available. Missing MFA on supported cloud services can result in an automatic failure.

Typical questions include:

What cloud services are used?
Is MFA enabled for all users?
Are administrator accounts protected by MFA?
What authentication methods are used?

Cloud Service Scope

Danzell explicitly brings cloud services into scope, including:

Microsoft 365
Google Workspace
Salesforce
Slack
Zoom
Cloud storage platforms

Organisations must declare these services and demonstrate appropriate security controls.

Typical questions include:

Which cloud services store or process business data?
How are accounts managed?
How is access removed when users leave?

User Access Control

The questionnaire places greater emphasis on:

Administrative accounts
Privileged access management
Account lifecycle management

Typically, questions include:

Are administrator accounts separate from standard user accounts?
How are privileged accounts controlled?
How are unused accounts identified and removed?

Industry discussions indicate auditors are applying the separate-admin-account requirement strictly.

Security Update Management

Danzell asks for clearer evidence regarding:

Operating system patching
Application patching
Firmware updates
Patch deployment timescales

Applicants need to be able to identify:

How are vulnerabilities identified?
Are high-risk vulnerabilities patched within 14 days?
How is firmware kept up to date?

The 14-day patching requirement is now a critical assessment point.

Password and Authentication Controls

Questions now focus on:

Minimum password length
Password managers
Common-password blocking
Password less technologies and passkeys when used

Cyber Essentials v3.3 introduced a minimum 12-character password requirement in many scenarios.

The effects of these changes will differ from company to company of course, many will already have much of this covered and some won’t. Many will require guidance and assistance in making sure that they are prepared to what is now required, and that guidance will need to focus on how they need to change to meet the requirement.

But arguably the biggest operational issue is that CE now requires Owners/CEOs/Boards to certify that they will maintain the standard through its 12-month lifecycle, and not just at the point of certification. That means monitoring their estate to maintain compliance, constantly, which in turn means having the means and resource to do it. Not easy for many SMEs and they will be worried about cost.

The obvious answer though is a managed service. SMEs often outsource their IT environment and see benefits in terms of cost and operational efficiency. The same can be said for Cyber Security and monitoring, but the mindset tends to be different. There is still the thought that their IT outsourcing company has this covered, or that cyber is a bit of black art and it will be expensive.

How does the H2 Service Help?

So, what does this service do that is so special? Well, it will audit the 5 Cyber Essentials control areas, in some detail but it goes further. Managing cyber security internally is a challenge. With one out of two SMEs experiencing attacks, it’s clear that modern security requires continuous attention, as does cyber essentials compliance. Threats can change daily and software needs continual updates. Users need protection without friction and policies need to be enforced consistently. Alerts need to be monitored, recognised and acted upon in real time.

Trying to manage all this internally means adding complexity, workload and risk. Security should not compete with running a business and that is where a managed services makes a difference; by taking full operational ownership of cybersecurity, not just offering advice or tools.

Example of Multi Factor Authentication Detection

The service manages:

Protecting user accounts and access, identifying who has admin privilege so that it can be revoked where it isn’t needed.
Secure end points and devices, identifies operating system versions, anti-malware configurations, updates and alerts.
Enforces security policies.
Identifies cloud configurations and connections.
Reduces risk from 3^rd parties and shadow IT apps, identifying where 2FA is missing.
Monitors threats and suspicious activity.
It can monitor email boxes looking for phishing and ransomware, although that element is not strictly necessary for CE compliance.

An added bonus is that it comes with phishing simulations to help train staff, and a comprehensive, automated, cyber awareness training package.

The system is powered by Agentic AI, although it has a human element, with the AI taking away the number crunching and hard work, leaving the human to identify what is, and what is not, real. Using AI in this way enables us to keep the costs low, something very important to SMEs.

Small to Medium Businesses – Scammed or Hacked?

This is something that I’ve alluded to in the past, in other articles and blogs. What is the likelihood of an SME suffering and Scam as opposed to a more technical hack. There is a lot of evidence to suggest that, for most SMEs, the probability of suffering a scam/social engineering attack is significantly higher than experiencing a sophisticated technical hacking attack.

A useful rule of thumb from cyber insurance claims, law enforcement reporting, and incident response firms is:

70–90% of financially damaging incidents affecting SMEs involve people being manipulated (phishing, invoice fraud, CEO fraud, business email compromise, fake suppliers, fake tech support, payment diversion, etc.).
10–30% involve primarily technical exploitation (ransomware through unpatched systems, web application attacks, malware exploiting vulnerabilities, credential stuffing, etc.).

But you can argue that ransomware is often a hybrid of the two, starting often with phishing for credentials, obtaining a login, and then inserting malware.

The exact percentages vary by industry and geography, but the pattern is remarkably consistent.

Why scams are more common

Humans are easier to compromise than systems

A criminal can send 10,000 phishing emails in minutes at almost no cost.

Convincing one employee to:

Click a link
Approve a payment
Share credentials
Change bank account details

is often easier than discovering and exploiting a software vulnerability.

SMEs usually have weaker business processes than technology

Many SMEs now use cloud services from companies like Microsoft⁠, Google Workspace⁠, and Amazon Web Services⁠, which has improved their security.

However, they often lack:

Payment verification procedures
Supplier validation processes
Security awareness training
Segregation of financial duties
Generally inadequate security policies

Criminals exploit these business-process weaknesses.

Criminals follow the money

A fake invoice scam may generate £20,000–£100,000 with little technical effort, whereas a sophisticated network intrusion might require:

Research
Malware development
Vulnerability exploitation
Persistence mechanisms

From an attacker’s perspective, scams often provide a better return on investment.

Business Email Compromise (BEC) is extremely effective

One of the largest causes of SME losses is BEC:

Attacker gains access to an email account (often through phishing)
Watches conversations
Sends realistic payment instructions
Diverts funds

Technically, the breach may be simple, but the financial loss comes from deception rather than hacking.

Why technical attacks still matter

Technical attacks tend to receive more media attention because they can be highly disruptive.

Some examples are:

Ransomware
Server compromise
Website defacement
Data theft
Supply-chain attacks

Although less frequent than scams, a successful technical attack can have larger operational consequences:

Business downtime
Regulatory penalties
Customer notification costs
Recovery expenses

What an SME should prioritise

Most, if not all SMEs, will have a limited security budget, and therefore they need to identify the highest-return controls to mitigate their risk. These can include:

Multi-factor authentication (MFA) on all email and cloud accounts.
Staff training on phishing and payment fraud.
Verification procedures for bank account changes and large payments.
Strong backups and ransomware recovery testing.
Endpoint protection and automatic patching.
Monitoring for suspicious login activity.

These measures reduce both scam risk and many technical attack paths. It’s aways worth remembering that scammers and hacker alike will take the path of least resistance. The more difficult you make it for them, the more likely they are to look elsewhere.

A practical estimate

For a typical 20–250 person SME and for illustrative purposes, the distribution of financially damaging incidents based on common industry observations is 80 to 20 in favour of scams.

This is not a universal statistic, but it reflects what many cyber insurers, incident responders, and fraud investigators observe in practice, that is that SMEs are generally more likely to lose money because someone was tricked than because a hacker defeated sophisticated technical defences. The most damaging incidents often combine both, such as a phishing email that steals credentials and then enables fraud or ransomware.

Cyber Essentials – How has it changed?

I think these days, pretty much everyone is aware of the UK government-backed Cyber Essentials scheme and those who have undertaken certification or are considering it, will, in the last 12 months, have been subject to the introduction of the “Willow” question set (v3.2), which became the standard for certifications from 28 April 2025. It didn’t fundamentally change the five Cyber Essentials controls, but it did make several requirements more explicit and raised expectations around asset management, authentication, remote working, and vulnerability remediation.

For most organisations, the Willow update was not a complete overhaul. The real shift is that Cyber Essentials is becoming:

More focused on asset visibility
More aligned with modern cloud environments
More accepting of passwordless security
More rigorous about vulnerability management
More realistic about hybrid and remote working

If your organisation already has mature inventory management, MFA, vulnerability remediation, and cloud governance processes, the changes are relatively straightforward. If not, these areas are where most compliance effort will now be concentrated.

Key implications for organisations

Asset management is now much harder to ignore

A significant practical change was a stronger emphasis on maintaining a complete inventory of:

Devices
Software
Cloud services
Network equipment
BYOD assets used for work

Organisations now need a much better visibility of what is connected to their environment. For many SMEs, this means formalising asset registers rather than relying on informal spreadsheets or staff knowledge.

The Implication being that certification becomes more difficult if you cannot prove what systems are in scope. This may mean investing in discovery and asset-management processes.

Firmware is now explicitly in scope

The definition of software has been expanded to include firmware on devices such as:

Firewalls
Routers
Network appliances

Previously, some organisations focused almost entirely on operating systems and applications. Now, neglected network-device firmware can become a compliance issue. The implication being that patch management programmes need to include infrastructure devices, not just laptops and servers.

“Patches” became broader “vulnerability fixes”

Cyber Essentials no longer focuses only on installing vendor patches.

The new language recognises that vulnerabilities may be fixed through:

Configuration changes
Registry edits
Vendor scripts
Other remediation methods

The expectation is that vulnerabilities rated CVSS 7.0+ are addressed regardless of how the vendor delivers the fix. Again, there is an implication that organisations need a vulnerability-management mindset rather than a simple patching mindset.

Passwordless authentication is now recognised

The Willow update formally acknowledges modern authentication methods such as:

Passkeys
Biometrics
Security keys
Authenticator push notifications

These can satisfy MFA requirements where implemented correctly.

This is good news for organisations moving away from passwords. It aligns Cyber Essentials more closely with modern identity-security strategies and NCSC guidance on passkeys. Frustratingly though, I worked with a client recently to obtain CE and the assessor didn’t know what a passphrase was and it had to be explained to him.

Remote working is treated more broadly

The terminology changed from “home working” to “home and remote working.”

That sounds minor, but it reflects a wider scope including:

Hotels
Cafés
Shared workspaces
Other untrusted networks

I’ve blogged about this quite a bit and security controls need to work wherever employees connect from, not just from a home office. Does a VPN suffice, maybe but maybe not.

Greater scrutiny of Bring Your Own Device (BYOD)

Now organisations are expected to have:

Clear BYOD policies
Device security controls
User responsibilities documented
Appropriate protection such as encryption and screen locking

Informal BYOD arrangements can be riskier from both a compliance and security perspective.

V3.3 (“Danzell”)

As if that wasn’t enough NCSC has published v3.3 (“Danzell”) requirements effective from April 2026, which further tighten areas such as MFA and cloud-service requirements. Organisations that have only just adapted to Willow should already be reviewing the next revision to avoid another compliance scramble next renewal cycle.

What changed in the Danzell question set?

The five Cyber Essentials control areas remain the same:

Firewalls
Secure Configuration
User Access Control
Malware Protection
Security Update Management

However, Danzell asks more detailed and specific questions about how these controls are implemented and evidenced.

Key themes covered by the Danzell questions

Multi-Factor Authentication (MFA)

Typical questions include:

What cloud services are used?
Is MFA enabled for all users?
Are administrator accounts protected by MFA?
What authentication methods are used?

Cloud Service Scope

Danzell explicitly brings cloud services into scope, including:

Microsoft 365
Google Workspace
Salesforce
Slack
Zoom
Cloud storage platforms

Organisations must declare these services and demonstrate appropriate security controls.

Typical questions include:

Which cloud services store or process business data?
How are accounts managed?
How is access removed when users leave?

User Access Control

The questionnaire places greater emphasis on:

Administrative accounts
Privileged access management
Account lifecycle management

Typically questions include:

Are administrator accounts separate from standard user accounts?
How are privileged accounts controlled?
How are unused accounts identified and removed?

Industry discussions indicate auditors are applying the separate-admin-account requirement strictly.

Security Update Management

Danzell asks for clearer evidence regarding:

Operating system patching
Application patching
Firmware updates
Patch deployment timescales

Applicants need to be able to identify:

How are vulnerabilities are identified?
Are high-risk vulnerabilities patched within 14 days?
How is firmware kept up to date?

The 14-day patching requirement is now a critical assessment point.

Password and Authentication Controls

Questions now focus on:

Minimum password length
Password managers
Common-password blocking
Passwordless technologies and passkeys where used

Cyber Essentials v3.3 introduced a minimum 12-character password requirement in many scenarios.

Structure of the questionnaire

The Danzell question set generally requires organisations to provide:

Asset inventories
Cloud service inventories
User account information
Details of security policies
Evidence of patch management processes
Details of MFA deployment
Administrative account controls

Assessors may ask follow-up questions if answers are unclear or inconsistent.

What, typically, is the effect on SMEs?

This will change from company to company of course, many will already have much of this covered and some won’t. Many will require guidance and assistance in making sure that they are prepared to what is now required, and that guidance will need to focus on how they need to change to meet the requirement.

Let’s face it, the majority of SMEs aren’t going to try and hire cyber expertise full time, it would be expensive and unnecessary. Having a managed service spreads cost and makes it affordable. If you have a service that offers:

Continuous monitoring of endpoints, servers, and some cloud environments
Monitoring patching, including CVEs issued by vendors and comparing them against your estate
Vulnerability assessment
Rapid detection of ransomware, malware, insider threats, and advanced attacks
Expert-led response
Phishing simulations
Cyber awareness training programme
Dark web monitoring

Then you are a long way towards meeting the requirement for continuous monitoring and assessment, and if you can do this for £15-£18 per user per month, then it can be very affordable.

Stop Treating Cyber Security as an Overhead – Calculate the Cost of Doing Nothing

Cyber security is often seen as a cost centre, not a value driver. That’s not just a problem for SMEs but that attitude is still often sound at a corporate level. Within SMEs it’s not too rate to find it positioned as an insurance or compliance spend, not as something that enables trust, customer retention or business continuity. Often there is no ownership at the top, no board pressure until something goes wrong. If no one owns the risk, it stays floating below the surface.

We need to flip the mindset. Cyber security needs to feel like it’s part of the core business and should be framed as:

Protecting revenue not systems.
Protecting customers not servers.
Protecting the ability to operate.

Cyber incidents must be seen as business stopping events, not just technical inconveniences. Once that is recognised at the top, it tends to be moved into core business territory very quickly.

Measuring ROI (Return on Investment) in cyber security solutions is tricky because unlike traditional investments, the “return” often comes in the form of avoided losses, reduced risk, and improved resilience rather than direct revenue, and is often seen as proving a negative which produces a circular argument. In the blue corner we have the bean counters saying we don’t need to spend much because we’ve never been attacked, and in the red corner we have the techies telling management that you haven’t been attacked because we have spent on protections. There is often no meeting of minds until we frame it in business terms. There are well-established approaches.

Here’s how ROI in cybersecurity is typically measured:

Define the Investment (Costs)

This includes all direct and indirect costs of the cybersecurity solution:

Technology costs: licenses, hardware, software, cloud services.
Implementation costs: setup, integration, migration.
Operational costs: monitoring, maintenance, upgrades.
Personnel costs: training, staff time, additional headcount.
Third-party services: managed security providers, audits, compliance checks.

Estimate the Return (Benefits)

Returns are usually risk reductions and operational gains, such as:

Avoided breach costs:
- Average cost of a data breach (detection, remediation, legal fees, fines, customer churn, downtime).
- Likelihood (probability) of an attack succeeding without the solution.
Operational efficiency:
- Fewer false positives, reduced downtime, less staff time spent on manual tasks.
Regulatory compliance:
- Avoidance of fines and penalties.
Business continuity & reputation:
- Reduced likelihood of lost customers and brand damage.

Cybersecurity ROI Calculator Template

This can get quite complex very quickly, so SMEs need to take from it what they need and discard the rest. Be wary though that you understand what you need and what you don’t. The best way of doing this is to carry out a risk assessment on the assets you are trying to protect. Until you’ve done that the ROI will be almost impossible to predict.

If you need to understand the risk assessment procedure, then this short video will guide you:

Link Cyber Resilience for SMEs: Navigating the Digital Wild West synthesia.io A short video describing cyber risk management and how SMEs should consider approaching this subject.

Once you have a good grasp of cyber risk management and you understand the threats and what you may need to do to protect yourself from those threats, then you can use this framework in Excel, Google Sheets, or whatever you use. The formulas are structured so you can plug in your own assumptions and automatically calculate:

Annualised cyber risk exposure
Risk reduction from controls
Expected financial savings
Total security investment
ROI %

Step 1 — Define Your Baseline Risk

Annual Expected Loss (AEL):

\text{Annual Expected Loss} = \text{Probability} \times \text{Financial Impact}

Example:

20% × £500,000 = £100,000 expected annual loss

At the bottom:

| Total Baseline Risk Exposure | =SUM(D2:D5) |

Now clearly you need an understanding of the threat to assess the annual probability, and you need an understanding of how long it would take you to recover from that threat becoming a reality. You may need advice or you may feel that you have sufficient information to make that calculation yourself.

Step 2 — Add Security Controls

Now estimate how much each cybersecurity investment reduces

Step 3 — Calculate Residual Risk

For each risk scenario:

Formula

Residual Risk:

\text{Residual Risk} = \text{Baseline Risk} \times (1 – \text{Risk Reduction})

Then total:

| Total Residual Risk | =SUM(D2:D5) |

In summary

Producing an ROI in cyber security is not easy and to do it you must pull together several different but related issues, starting with a good grasp of cyber risk management. I know that when I suggest that you should get some help and guidance, I am often accused of just trying to drum up business, and OK, maybe that has a play, but by showing the calculations and what is required to identify those calculations, what I am actually trying to do is to show you that this isn’t easy and needs thought and a bit of work to achieve a good end result, which is to give leadership a financially justifiable reason for a cyber security spend. ROI in cyber security is less about “profit” and more about quantifying avoided losses, improved efficiency, and reduced risk relative to the cost of controls.

Cyber Security as Business Protection – Protect, Detect and Recover

This is another foray into cyber risk management and strategy for SMEs. I make no apologies for covering it again because it should be a vital part of any SMEs business planning. In a nutshell it’s the business process of identifying and addressing digital threats to protect operations, revenue, and reputation. Rather than just a technical IT task, it is a strategic function focused on ensuring business continuity and managing potential financial losses.

A strong cybersecurity risk management strategy for SMEs should focus on reducing the highest risks first while staying practical and affordable. Most SMEs do not need enterprise-scale security programs, they need disciplined fundamentals, clear ownership, and resilience.

Core Principles

Protect what matters most
Customer data
Financial systems
Email accounts
Intellectual property
Operational systems

Assume attacks will happen
Focus on prevention and recovery.
Design for resilience, not perfect security.

Keep it simple and repeatable
Overly complex controls fail in SMEs due to limited staff and budget.

Recommended Cybersecurity Risk Management Framework

A practical SME strategy can follow five pillars inspired by the National Institute of Standards and Technology Cybersecurity Framework:

Identify
Protect
Detect
Respond
Recover

Alternatively, for those attempting or having achieved Cyber Essentials, one of the most effective ways to secure a business is to follow the UK government’s National Cyber Security Centre (NCSC) recommendations. These five steps are designed to be cost-effective and provide protection against the majority of common cyber-attacks.

Secure your data with back-ups.
Protect with strong authentication (MFA).
Keep devices and software up to date.
Guard against malware.
Train staff on cyber awareness, phishing in particular.

But beware, the latest iteration of CE requires CEOs/MDs to sign a certification that they will ensure that the standard is maintained throughout the year and not just at point of achieving the standard. That is a game changer which requires some form of monitoring to be put in place to ensure that the standard continues to be met.

No two businesses are the same. They all have certain threats and vulnerabilities in common, and adherence to the NCSC guidelines and/or Cyber Essentials will set you on the right path, many of you will either have gone down that route or will be actively discussing it internally. But there will still be differences, perhaps only nuances, that can drive a hole through your defences, and that is why you need a risk management strategy to ensure you have built robust defences.

Identify Your Risks

The first stop is to create an Asset Inventory:

Document:

Devices
Servers
Cloud services
SaaS platforms
User accounts
Critical data
Vendors

Even a spreadsheet is enough initially.

Classify Critical Assets

Rank systems by business impact:

High: payroll, CRM, finance, production
Medium: internal collaboration
Low: public marketing systems

Identify Likely Threats

For SMEs, the biggest risks are usually:

Phishing
Business email compromise
Ransomware
Weak passwords
Insider mistakes
Third-party/vendor compromise
Unpatched software
Cloud misconfiguration

Protect the Business

Multi-Factor Authentication (MFA)

This is one of the highest-value controls and you need MFA for:

Email
VPN
Admin accounts
Cloud apps
Banking systems

Use authenticator apps or hardware keys where possible.

Strong Identity & Access Management

You need to apply:

Least privilege access
Separate admin accounts
Role-based permissions
Immediate removal of leavers

Review access at least quarterly.

Endpoint Protection

Deploy modern endpoint security on all company devices:

Antivirus/EDR
Device encryption
Automatic updates
Screen lock policies

Focus first on laptops because they are commonly targeted.

Patch Management

Set strict update timelines:

Critical vulnerabilities: 24–72 hours
High-risk patches: within 1 week
Routine updates: monthly

Automate updates whenever possible but you will still need some form of monitoring patch management to ensure that you have this under control.

Email Security

Since email is the number one attack vector:

Anti-phishing filters
DMARC, DKIM, SPF (these require DNS entries and will need to be monitored)
Attachment sandboxing if affordable
User reporting button for suspicious emails

Backup Strategy

Use the 3-2-1 rule:

3 copies of data
2 different storage types
1 offline/immutable copy – don’t rely on on-line backups, they may make restoring quicker, but they can be encrypted in a ransomware scenario, just like the rest of your systems.

Test restores regularly. Recovery in a disaster or ransomware situation depends on this.

Secure Cloud Usage

For cloud platforms like Microsoft 365 or Google Workspace:

Disable legacy authentication
Enforce MFA
Monitor sharing permissions
Limit external access
Audit administrator activity

Detect Threats Early

Centralised Logging

This is often a particularly difficult thing for SMEs because they don’t have any on staff cyber security personnel and often their IT support company doesn’t offer this service. However, it is still important to collect logs from:

Email systems
Firewalls
Endpoints
Cloud platforms

A managed service is often the way forward.

Monitoring & Alerts

This is another issue that is very hard for SMEs, for the same reasons as log collection. You need to receive alerts on:

Failed login spikes
Impossible travel logins
Admin privilege changes
Large file downloads
Suspicious mailbox rules

A managed service is often the only way to achieve this.

Vulnerability Scanning

You should aim to run monthly scans internally and externally.

Prioritise:

Internet-facing systems
Critical vulnerabilities
Unsupported software

There are a variety of scanning tools available to purchase however you need to have someone who can interpret the results, identify critical issues and eliminate false positives. Once again, a managed service maybe the answer for many SMEs.

Incident Response Plan

Every SME should have a documented response process which includes:

Who makes decisions
Who contacts customers
Legal/compliance steps
Cyber insurance contacts
IT recovery procedures

Create Playbooks For:

Ransomware
Phishing compromise
Lost/stolen device
Data breach
Vendor compromise

Run tabletop exercises twice yearly.

Recovery & Business Continuity

Define Recovery Objectives

Set:

RTO (Recovery Time Objective)
RPO (Recovery Point Objective)

Examples are below and show the amount of time the business can survive with the loss of each system, but this will be determined by business priorities:

System	Max Downtime	Max Data Loss
Email	4 hours	1 hour
Payroll	24 hours	4 hours
CRM	8 hours	2 hours

Business Continuity Planning

Prepare for:

Cloud outages
Cyberattacks
Staff unavailability
Power/network failures

Document manual fallback procedures to keep the business running whilst you recover from the crisis.⸻

Governance & Leadership

Assign Ownership

Even small companies need accountability:

Security lead
Executive sponsor
Incident coordinator

Security without ownership fails.

Establish Policies

Minimum essential policies:

Acceptable use
Password policy
Data handling
Remote work
Vendor management
Incident reporting

Keep them concise and enforceable and importantly, rolled out so that staff know where to find them and what they contain.

Human Risk Management

Most SME breaches involve human error.

Security Awareness Training

Train employees on:

Phishing
Social engineering
Password hygiene
Safe file sharing
AI/deepfake scams
Reporting suspicious activity

Short monthly sessions work better than annual training.

Phishing Simulations

Measure:

Click rates
Reporting rates
Repeat offenders

Use results for coaching, not punishment.

Third-Party & Supply Chain Risk

SMEs increasingly rely on vendors.

Vet Critical Suppliers

Review:

Security certifications
MFA usage
Breach history
Data protection controls

Prioritise vendors with access to:

Financial data
Customer data
Internal systems

Compliance Considerations

Depending on industry/location, SMEs may need alignment with:

International Organisation for Standardization ISO 27001
National Cyber Security Centre Cyber Essentials
GDPR/Data Protection Laws
PCI DSS

For UK SMEs, Cyber Essentials is an excellent baseline.

Recommended SME Security Stack

A practical modern stack often includes:

MFA platform
Endpoint detection & response (EDR)
Password manager
Secure email gateway
Cloud backup
Mobile device management (MDM)
Firewall with IDS/IPS
Security awareness platform

For those considering Cyber Essentials for the first time, or for renewal, some form of monitoring is required to ensure that that standard is maintained throughout the life cycle.

Budget Prioritisation (Highest ROI First)

For SMEs budget is always limited and must be prioritised. This is a general guide and may change dependent upon business priorities:

MFA everywhere
Backups
Endpoint protection
Email security
Patch management
Security awareness training
Logging/monitoring
Vulnerability scanning
Managed security services
Advanced zero-trust controls

In order to decide your budget, you need to work out your priorities and again, this will depend on what the company does. A suggested 12 month roadmap, for someone starting from scratch, is:

Months 1–3

Asset inventory
MFA rollout
Backup improvements
Patch automation
Security policies

Months 4–6

Endpoint protection
Vulnerability scanning
Staff awareness training
Incident response planning

Months 7–9

Logging and monitoring
Vendor risk reviews
Phishing simulations
Access reviews

Months 10–12

Tabletop exercises
Business continuity testing
External security assessment
Cyber insurance review

Metrics SMEs Should Track

I talked about measuring your security stance and your compliance. Some useful KPIs might be:

MFA adoption %
Patch compliance %
Phishing click rate
Mean time to detect/respond
Backup recovery success
Number of critical vulnerabilities
Security training completion

Common SME Mistakes

Turning now to some common mistakes. I don’t want to dwell on these too much as they are self-evident, but you should avoid:

Treating cybersecurity as only an IT problem
Buying too many disconnected tools
Ignoring backups
Giving staff admin rights
Failing to test recovery
Depending entirely on one IT provider
No incident response process

I hope that this provides some guidance but I’m fully aware that it contains issues that will appear as a bit of a ‘black art’ to some people. Get advice from cyber security professionals, don’t think that because someone knows about IT, they have the nuances of security covered, they often don’t. Remember that some cyber security solutions are procedural not technical.

Policy, Process and then Technology

The latest cyber security news for UK Businesses

The key cyber security purchasing and deployment issues facing SMEs

How a worldwide PHP issue could affect UK SMEs

Do SMEs need to be concerned about Nation State cyber-attacks?

AI – truly intelligent or over hyped?

CYBER SECURITY IS COMMON SENSE, ISN’T IT?

HOW CAN SMEs MONITOR COMPLIANCE TO CYBER ESSENTIALS EASILY

Small to Medium Businesses – Scammed or Hacked?

Cyber Essentials – How has it changed?

Stop Treating Cyber Security as an Overhead – Calculate the Cost of Doing Nothing

Cyber Security as Business Protection – Protect, Detect and Recover

Search

Recent Comments

Recent Posts

Archives