It is easy to feel overwhelmed by cybersecurity news. Zero day exploits, nation state groups, headline breaches at global companies. For a small or mid sized business, the picture is simpler and, in a way, more encouraging: a short list of ordinary threats accounts for most losses, and ordinary controls stop most of them.
1. Ransomware
Ransomware locks your files and demands payment to unlock them. Many groups now also steal data first and threaten to publish it, so restoring from backup does not end the problem on its own. Attackers usually get in through a stolen password, a phishing email or an unpatched system, then spend time exploring before they strike.
Ransomware protection works in layers:
- Patch operating systems and software promptly
- Use endpoint security that blocks suspicious behaviour, not just known viruses
- Limit admin rights so one compromised account cannot reach everything
- Keep backups that are tested and separated from your main network
- Monitor around the clock, for example with managed detection and response
2. Business email compromise
An attacker takes over or imitates a mailbox and asks for a payment, a gift card or changed bank details. No malware is involved, so many tools miss it. The best defences are strong email security, spoofing protection on your domain, and a firm rule to confirm payment changes by phone. See our guide to email protection.
3. Credential theft
Passwords leak through breaches at other websites, phishing pages and malware. Because many people reuse passwords, one leak can unlock several accounts. Multi-factor authentication is the single most effective answer. Pair it with a password manager and monitoring for exposed credentials, as explained in our dark web monitoring article.
4. Supply chain and vendor risk
Your data is only as safe as the weakest supplier with access to it. An accountant, a software vendor or a managed service provider with poor security can become the way in. Review which vendors have access, ask for evidence of their controls, and remove access you no longer need. Our article on third party vendor management shows how.
5. Unpatched systems and misconfiguration
Attackers scan the internet constantly for known weaknesses. A server missing a critical patch, or a cloud storage setting left open, is found quickly. Automated patching and regular reviews close most of these.
| Threat | Typical way in | Strongest first defence |
|---|---|---|
| Ransomware | Phishing, stolen logins, unpatched systems | Tested backups and endpoint security |
| Email compromise | Impersonation or hijacked mailbox | Phone confirmation and email security |
| Credential theft | Breaches, phishing, reuse | Multi-factor authentication |
| Vendor risk | A supplier with access | Access review and vendor questions |
| Unpatched systems | Known vulnerabilities | Automated patching |
Prepare before an incident
Write a short incident response plan that says who decides, who calls your IT provider and insurer, and how to isolate affected devices. Practice it once. In a real incident, minutes matter and nobody has time to invent a process.
Our team can assess your defences against these threats and give you a prioritised plan.
Talk to our security teamFrequently asked questions
What is the most common cause of ransomware?
Stolen or weak credentials and phishing emails are leading entry points, along with unpatched internet facing systems.
Should we pay a ransom?
Our advice is to prepare so you never face that decision. If it happens, involve your insurer, legal counsel and law enforcement before deciding.
Are backups enough?
Backups are essential but not sufficient, because data theft and downtime still hurt. Combine them with prevention and monitoring.
Related service: Cyber Security Assessment
Last updated
