Why your SME needs a cybersecurity plan (even if you think you're too small)
There's a persistent myth among small business owners that cybercriminals only target large companies. It's understandable — the headlines focus on big breaches at banks, hospitals, and multinationals. But the reality is very different. Small and mid-sized businesses are the primary target for the vast majority of cyber attacks, precisely because they're easier to breach and less likely to have robust defences.
The uncomfortable statistics
Government data from the 2025 Cyber Security Breaches Survey found that:
- 50% of UK businesses reported a cyber breach or attack in the past 12 months.
- 32% of businesses reported having experienced a breach or attack at least once a week.
- The average cost of a cyber incident for a small business was £1,100 — but that figure includes only direct costs, and hides enormous variability. Some incidents cost tens of thousands.
- Two-thirds of businesses that experienced a breach never reported it — meaning the real numbers are likely far higher.
- Over 90% of successful cyber attacks start with a phishing email.
What those numbers don't show: the businesses that never recover. Industry estimates suggest that around 60% of small businesses close within 6 months of a significant cyber attack. That's not because the attack was sophisticated — it's because they weren't prepared to respond.
Why "too small to target" is wrong
There are three reasons SMEs are targeted more, not less:
1. Automation
Most cyber attacks are not targeted. They're automated. A single botnet can send millions of phishing emails a day. Your business isn't being individually selected — you're being scanned, along with thousands of others, and you're hit if you happen to be vulnerable. A small business with no email filtering, no MFA, and no patching programme is far more likely to be a successful hit than a large company with an entire security team.
2. Supply chain access
If an attacker wants to breach a large company, one of the easiest routes is through its smaller suppliers. If you're an SME that works with a larger client, you may be targeted specifically because you're seen as a weaker link into their systems. This is called "island hopping", and it's increasingly common.
3. Lower expectations of defence
Attackers know that many SMEs don't have dedicated IT staff, don't have proper backups, and don't have incident response plans. They know that small businesses are more likely to pay a ransom quickly, because the alternative — losing everything — feels catastrophic. That makes you a more attractive target, not less.
The question is never "am I a target?" — you are. The question is "am I prepared for when something happens?" Right now, most SMEs aren't.
What a cybersecurity plan actually is
When we talk about a "cybersecurity plan", we don't mean a document that sits in a drawer. We mean an operational approach that covers the things that actually matter. Here are the four pillars we recommend every SME have in place:
Prevent
Reduce the likelihood of an attack succeeding. This means:
- Multi-factor authentication (MFA) on all email, cloud, and remote access accounts. This is the single highest-impact control you can implement.
- Email filtering with advanced phishing detection, not just basic spam filtering.
- Endpoint detection and response (EDR) on all devices — not just antivirus.
- Patching of operating systems, applications, and firmware, applied promptly.
- DMARC, DKIM, and SPF on your domain to prevent spoofing.
- Firewall and network security — properly configured, not just "on".
Detect
Assume something will eventually get through, and build detection to catch it quickly:
- Log monitoring for unusual activity — failed logins, access from new locations, mass file access.
- User behaviour analytics to flag accounts behaving differently.
- Email security alerts for suspicious rules being created, unusual forwarding, or large outbound sends.
- Endpoint alerts for suspicious process activity, ransomware behaviour, or lateral movement.
- Vulnerability scanning to catch unpatched systems before an attacker does.
Respond
Have a plan for when something goes wrong — because it will:
- Documented incident response plan — who does what, in what order, with contact details for key personnel, insurer, and legal counsel.
- Tested backups — with quarterly restore tests, not just "we have backups".
- Communication plan — who speaks to staff, clients, and regulators, and what they say.
- Cyber insurance — with clear understanding of what it covers and doesn't.
- Regular tabletop exercises — walking through a simulated incident once a year.
Recover
Get back to normal as quickly as possible, with as little data loss as possible:
- Air-gapped or immutable backups — not on the same network as production systems.
- Tested restore procedures — with defined RTO (Recovery Time Objective) and RPO (Recovery Point Objective).
- Documented recovery runbooks — so anyone can execute the plan, not just the IT lead.
- Communication plan for the recovery period — how staff, clients, and suppliers are kept informed.
- Post-incident review — what happened, what could have been done better, what changes now.
What this looks like in practice
A realistic cybersecurity plan for a 20-person SME isn't a massive exercise. It's about three focused areas:
- Technical controls — MFA, email filtering, EDR, patching, backups. Most of these are delivered as part of a managed IT service, and cost roughly £10–£20 per user per month on top of standard support.
- Process controls — documented incident response, clear roles and responsibilities, tested procedures. This is largely a one-time exercise that gets reviewed annually.
- People controls — phishing simulations, awareness training, clear reporting processes. Ongoing, but lightweight — a few minutes a month per employee.
None of this is exotic. All of it is achievable. The reason most SMEs don't have it in place isn't cost — it's that nobody's been given the responsibility to make it happen.
Cyber Essentials and why it matters
If you're not sure where to start, Cyber Essentials is the UK government's certification that covers the fundamentals. It's not the most rigorous certification (that's ISO 27001), but it's:
- Practical — it covers the basics that actually stop most attacks.
- Achievable — most SMEs can certify within 4–6 weeks.
- Recognised — it's increasingly required for public sector contracts, and often requested in private-sector tenders too.
- Affordable — certification itself is a few hundred pounds; the investment is mostly in getting the fundamentals right.
Cyber Essentials Plus is the next level — it requires independent verification of your controls, and is more commonly required for larger or higher-risk engagements.
The honest cost of doing nothing
We're not here to fearmonger, but the arithmetic matters:
- The average cost of a serious cyber incident for an SME is around £15,000–£50,000 when you include downtime, recovery, legal costs, and reputational damage.
- The most common incident — BEC fraud — often results in direct financial loss of £20,000–£150,000.
- Recovery can take weeks or months, during which revenue is affected and clients may leave.
- GDPR fines for data breaches can reach £8.7m or 2% of global turnover, whichever is higher — though most SME-level fines are much lower.
- Even if you never have an incident, a proper plan opens up opportunities (public sector tenders, insurance benefits, client security requirements) that you can't pursue without it.
Against those numbers, a realistic cybersecurity investment of £2,000–£5,000 per year is not expensive — it's a rounding error.
Where to start
If you don't have a cybersecurity plan, the right first step is a proper audit. Not a sales call — a real review of where you stand. That audit should cover:
- Your current security controls (MFA, filtering, endpoint, patching, backup).
- Your access controls (who has access to what, how that's reviewed).
- Your incident response readiness (documented plan? Tested? Who's in charge?).
- Your compliance posture (Cyber Essentials, GDPR, any sector-specific requirements).
- Your people (training, phishing simulations, reporting culture).
We offer a free 60-minute audit that covers exactly this. At the end you'll get a written report with a clear picture of where you stand and what the priority fixes are. No obligation, no sales pitch.