There’s a common assumption among small business owners that hackers only target big companies. Banks. Retailers. Multinationals with thousands of employees and millions of customer records. Why would anyone bother with a 15-person accountancy firm in Wakefield or a 30-person engineering company in Castleford?
The answer is that small and medium businesses are actually the primary target. They hold valuable data, they process payments, and they almost always have weaker defences than large organisations. Criminals know this. The five attack methods below account for the vast majority of successful breaches against UK SMBs — and every single one of them is preventable.
1. Ransomware
Ransomware is malicious software that sneaks onto your systems — usually through a dodgy email attachment or an unpatched piece of software — and then quietly encrypts all of your files. Documents, spreadsheets, databases, emails. Everything. When you try to open anything, you get a message demanding payment (usually in cryptocurrency) in exchange for the key to unlock your data.
The average ransomware demand against a UK SMB is now over £30,000, and there’s no guarantee you get your data back even if you pay. In 2024, nearly half of UK small businesses that paid a ransom reported that some or all of their data was still unrecoverable. The criminals simply move on.
How to protect yourself: A layered defence works best. You need a proper endpoint protection product on every device (not just basic Windows Defender), automated patch management so software vulnerabilities get closed quickly, and — critically — a backup that is physically or logically separate from your main systems. If your backup is connected to the same network, ransomware can encrypt that too. We include all three layers in our managed support packages.
2. Phishing emails
Phishing is the single most common entry point for cyber attacks. A phishing email is designed to look like it came from someone you trust — your bank, HMRC, Microsoft, a supplier, even a colleague — and asks you to click a link, open an attachment, or hand over your login details.
Modern phishing emails are frighteningly convincing. They’re no longer the poorly-worded messages from a Nigerian prince with a spelling mistake in every sentence. Today they use your company name, reference real events, and mimic the exact layout and branding of legitimate organisations. Some are targeted specifically at you — using information gathered from your website and LinkedIn to make the message feel personal.
Phishing attacks were responsible for 84% of reported cyber incidents in UK businesses in 2024, according to the NCSC. That figure has barely moved for five years. It’s the most successful attack method precisely because it targets people rather than technology.
Enable multi-factor authentication (MFA) on every email account today. MFA means that even if someone gets hold of a password, they still can’t log in without a second check — usually a code sent to a phone. It takes about five minutes per user to set up in Microsoft 365 and stops the vast majority of phishing-based account takeovers cold.
3. Weak or reused passwords
Password theft is one of the most boring-sounding security topics and one of the most serious practical risks. When criminals breach large websites — and large-scale data breaches happen constantly — they get lists of email addresses and passwords. Those lists are then sold and used to try logging into other services, on the assumption that many people reuse the same password everywhere.
If an employee uses the same password for their personal Netflix account and their work Microsoft 365 account, and Netflix gets breached, your business email is now accessible to criminals. This is called credential stuffing, and it’s automated — attackers can try millions of combinations in minutes.
The solution isn’t asking staff to remember increasingly complicated passwords. It’s a password manager — a tool that generates and stores unique, strong passwords for every account, so staff only need to remember one master password. Combined with MFA, this combination closes almost all password-based attack routes.
4. Unpatched software
Software has bugs. Sometimes those bugs can be exploited by attackers to get into your systems. When software companies discover these vulnerabilities, they release patches — updates that fix the problem. The window between a vulnerability being discovered and a patch being released is when you’re most at risk.
But the bigger problem is businesses that don’t apply patches promptly. The WannaCry ransomware attack that caused chaos across NHS trusts in 2017 exploited a Windows vulnerability for which a patch had been available for two months. Most victims simply hadn’t applied it.
Windows Update keeps your operating system patched, but it doesn’t update third-party applications — browsers, Adobe Reader, Java, Zoom, VPN clients, and dozens of others that are commonly exploited. Our RMM platform monitors and patches all of these automatically across every device we manage, usually overnight so there’s no disruption to your working day.
5. Misconfigured Microsoft 365
Microsoft 365 is the backbone of how most Yorkshire businesses communicate and store information. Email, SharePoint, Teams, OneDrive — it all runs through 365. And because it’s so central to how businesses operate, it’s also a prime target.
The problem is that Microsoft 365 ships with default settings that prioritise ease of use over security. Without proper configuration, features like external file sharing are wide open, legacy authentication protocols that can be exploited are enabled, and the powerful security tools included in Business Premium licences — Defender for Office 365, Conditional Access, Intune — sit unused.
We see misconfigured 365 environments in almost every new client we onboard. It’s not that previous IT providers were negligent — it’s that properly securing Microsoft 365 requires deliberate, specific configuration that goes well beyond the default setup. Getting it right makes an enormous difference to your overall security posture.
If you’re not sure whether your business is exposed to any of these five attack types, our free Protection Check covers the key areas in about two minutes. Or give us a call on 03333 660 005 and one of our engineers will have a straightforward conversation about your current setup — no jargon, no sales pressure.