CyberSolace / Leadership
Small business cyber risk.
Too small to be targeted?
If your team lost access to email or customer records tomorrow, how long could the business keep its promises? Small business cyber risk becomes a leadership concern when an interrupted system threatens payments, delivery, or customer trust.
THE EXECUTIVE VIEW
Key takeaways
- Business size alone is a poor basis for deciding how much protection you need.
- Prioritise the accounts and services whose loss would interrupt trading or expose customer information.
- Ask for evidence that safeguards and recovery arrangements work, including where suppliers provide them.
- Give each improvement an owner, a deadline, and a clear test of completion.
01
What the evidence says about small business cyber risk
Hiscox Cyber Readiness Report 2026
What respondents reported
Respondents reporting at least one successful cyberattack in the previous 12 months.
38%
UK respondents
29%
All markets surveyed
Wakefield Research surveyed 6,800 cybersecurity decision-makers in organisations with fewer than 250 employees, between 5 and 17 June 2026.
These are reported experiences within a survey, not the probability that your company will be attacked.
A separate government study provides another perspective. The Cyber Security Breaches Survey 2025/2026 found that 46% of small businesses, defined as those with 10–49 employees, identified a breach or attack in the preceding year. Its interviews took place between August and December 2025. This broader measure is not equivalent to Hiscox’s successful-attack measure, and the samples differ; the percentages should not be combined or treated as a trend. Read the government findings.
Neither study establishes that every incident causes substantial loss. The government survey explicitly reports many incidents with little or no perceived financial cost. The management task is to understand which plausible events would hurt your business, then decide what protection and recovery capability those consequences justify.
02
Translate a technology failure into a business decision
Consider an illustrative scenario: someone gains access to a company mailbox and sends a customer altered payment instructions within an existing conversation. The customer recognises the sender and pays. The legitimate invoice remains unpaid.
This is a hypothetical example, not a CyberSolace client incident. The underlying risk is documented by the NCSC: access to business email can enable impersonation, expose private information, and allow password resets for other accounts. NCSC email guidance.
The business would need to establish what happened, check other transactions, and decide how to communicate with customers. That takes management attention as well as technical support. Responsibility for those decisions should be clear before an incident.
Start with one important activity: collecting payments, fulfilling orders, or delivering a contracted service. Identify the systems and suppliers it depends on. Agree how long interruption could be tolerated and what temporary workaround would be acceptable. A short disruption during payroll or a delivery deadline may have a different impact from the same outage on a quieter day.
A focused cybersecurity assessment can turn those dependencies into a prioritised improvement plan. The useful output is a set of decisions about exposure, ownership, and investment.
ILLUSTRATIVE SCENARIO / BUSINESS CONSEQUENCES
One mailbox. Several business decisions.
STAGE 01
A mailbox is compromised
An attacker gains access to a familiar business conversation.
Containment decision Who can secure the account?
STAGE 02
A payment is redirected
A customer acts on altered payment instructions. The invoice remains unpaid.
Verification decision Who verifies the transaction?
STAGE 03
The business must respond
Transactions need checking, customers need answers, and recovery needs an owner.
Coordination decision Who coordinates the response?
A point to interrupt the sequence
Verify changed payment instructions through a separate, trusted channel before money moves.
A hypothetical sequence, not a client case study or an estimate of incident likelihood. Independent payment checks can interrupt the sequence.
03
Five decisions to put on the management agenda
01
Decide which accounts need the strongest protection
Ask who can access email, finance, customer records, and system administration, and why they need that access. Request confirmation that leavers and unused accounts have been removed. The NCSC recommends passkeys where supported; where passwords remain, use strong, unique passwords with two-step verification, an additional sign-in check. Ask your provider to demonstrate coverage of critical accounts. NCSC sign-in recommendations.
02
Make unusual requests subject to independent checks
Agree a verification process for changed bank details, urgent payments, and requests for sensitive information. Staff need permission to pause, including when a request appears to come from a director. Verify through a separate, trusted channel. The NCSC advises using independently obtained contact details rather than numbers or links in a suspicious message. NCSC advice on suspicious requests.
03
Establish what your suppliers actually cover
Ask your IT provider who owns security updates, who receives alerts, and what support is available outside normal hours. Record any exclusions. If a supplier manages backups, establish who authorises restoration and how quickly work can begin. These questions clarify the service you have purchased and expose responsibilities that otherwise sit between organisations. The NCSC recommends documenting suppliers’ contact details, contractual support, and when to engage them. NCSC incident preparation guidance.
04
Set a recovery target and test it
Decide how much lost work and downtime the business could tolerate. Then ask for a recovery test against those requirements. A successful backup notification does not establish that an essential process can resume. The NCSC recommends checking that backups contain important information and that you know how to restore them. Test a representative recovery and record missing data, delays, and dependencies. NCSC backup guidance.
05
Rehearse who makes the difficult decisions
Run a short discussion around a compromised mailbox or unavailable customer system. Identify who can authorise urgent spending, suspend a service, and approve customer communications. Include the people who would make those decisions and record what remains unresolved. The NCSC recommends exercising incident plans; CyberSolace’s cyber response support includes preparation through realistic scenarios. NCSC guidance on rehearsing responsibilities.
A manageable commitment for the next 30 days
Choose one essential business process and ask its owner to bring the following evidence to the next management meeting:
- A map of the systems, information, and suppliers needed to keep it running.
- Confirmation of who can access its critical accounts and how those accounts are protected.
- A recovery test result, with any gap between the target and what was achieved.
- A contact list and agreed decision-makers for an incident.
- A short action list with named owners, completion dates, and any risks requiring management acceptance.
If the answers are incomplete, use the gaps to set the next spending priorities. A clear recovery responsibility or a verified payment process may deserve attention before another tool is purchased. Review progress at a named meeting so unresolved issues remain visible.
These are starting points for a management review; appropriate safeguards and recovery targets depend on your operations, information, contracts, and risk exposure.
For an independent discussion of your priorities, arrange a discovery conversation with CyberSolace.
References
Sources checked on 16 September 2026.
- Hiscox — Cyber Readiness Report 2026.
- DSIT and Home Office — Cyber Security Breaches Survey 2025/2026.
- NCSC — Secure your email.
- NCSC — Spotting cyber attacks.
- NCSC — Backing up your data.
- NCSC — Prepare for incidents.