Think your business is too small to interest a cybercriminal? That assumption may be part of the problem.
Attackers care less about a company’s size than about what they can gain from it. A small business may hold valuable customer data, control financial accounts, run on cloud systems or have trusted links with larger organisations, often with fewer people and tools to spot and stop an attack. That combination makes it attractive.
The UK government’s Cyber Security Breaches Survey 2025/2026 found that 46% of small businesses and 42% of micro businesses identified a cyber breach or attack in the previous 12 months. Because the survey only counts incidents organisations noticed and chose to report, the real figure is likely to be higher.
Why Are Small UK Businesses Attractive to Cybercriminals?
Attackers can target businesses at scale
Scanning for exposed systems, sending phishing emails and testing stolen passwords can all be automated. A business does not need to be well known or wealthy to attract attention; it only needs to be reachable. If an attack can be launched against thousands of organisations at low cost, even a small success rate is profitable.
Small does not mean low-value
A small company might hold customer information, employee records, payment details or intellectual property, and its email accounts often open the door to invoices and supplier conversations.
Sometimes the most valuable asset is not data at all, but access. A compromised account lets an attacker impersonate an employee, redirect payments or reach another organisation.
Smaller Security Teams Can Create More Opportunities
Size alone does not determine how secure a business is. A small company with well-managed controls can be better protected than a larger organisation with poor ones.
In practice, though, the same person often looks after IT, operations and security, leaving little time for monitoring or risk assessment. The same survey found that only 41% of small businesses carried out a cyber risk assessment in the past year, down from 48% the year before, and only a third ran any staff training.
The resulting gaps are usually practical: delayed updates, loose access controls, reused passwords and incidents that go unnoticed. The problem is rarely a total absence of security, but a lack of visibility to find weaknesses before criminals do.
The Main Ways Attackers Get Into Small Businesses
Most attacks do not start with an elaborate technical exploit. They start with a stolen password, a convincing message or an unprotected system.
Phishing and stolen credentials
Phishing is by far the most common attack UK businesses report, affecting 38% in the latest government survey, and the one most often described as the most disruptive. An employee who enters their login details on a convincing fake page hands the attacker a genuine business account.
Ransomware and malware
Malicious software can encrypt files, disrupt operations or give attackers a foothold in business systems. For an organisation that relies on a handful of computers or cloud services, even a short outage can be serious.
Business email compromise and impersonation
A compromised mailbox lets an attacker step into a real conversation. They might alter payment instructions on a genuine invoice thread, request sensitive information or pose as a supplier with “updated” bank details.
Exploited software and exposed systems
Outdated software, poorly secured remote access and unnecessary internet-facing services offer another way in. Prompt patching and removing unused access close many of these gaps.
Your Business May Be Valuable Because of Who You Work With
Accountants, agencies, IT providers and contractors often hold customer data or can access customer systems. If one of them is compromised, attackers can use that trusted relationship to reach someone else.
Imagine a small agency whose staff can log in to a client’s online platform. One compromised account gives an attacker legitimate access, with no need to break into the larger organisation directly.
Supply-chain risk runs in both directions, yet few businesses examine it: only 15% of UK businesses review the cyber risks posed by their immediate suppliers, falling to 12% among micro businesses. Know which third parties can reach your systems, and what larger customers expect of you.
Cloud Services and Remote Work Have Widened the Attack Surface
Cloud accounting, email platforms and collaboration tools make small businesses more flexible, but every account and device is another access point. With staff working from home networks and personal devices, security now extends wherever your people, applications and data are connected, which makes strong authentication and sensible access controls essential.
AI Is Making Some Attacks Harder to Recognise
Generative AI makes convincing emails and impersonation attempts easier to produce at scale, so spelling mistakes and awkward wording are no longer reliable warning signs. The better defence is process rather than instinct: confirm any request to change bank details, move money or share sensitive information through a separate, known channel, such as a phone number you already hold, especially when it feels urgent.
What Does a Cyberattack Actually Cost a Small Business?
The financial impact is rarely limited to the immediate loss.
Immediate costs
- Downtime, interrupted services and lost sales
- Investigation, recovery and emergency technical support
- Data recovery
Longer-term consequences
- Loss of customer confidence and reputational damage
- Contractual or regulatory consequences
- Lost opportunities and disruption to suppliers and customers
If a breach involves personal data and is likely to put people’s rights at risk, UK GDPR generally requires the business to notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it. Understanding how UK GDPR obligations work in practice before an incident makes that deadline far easier to meet.
Most incidents cause limited direct cost, but a serious one is harder for a small business to absorb, with fewer spare people, systems and reserves to fall back on.
Are Small Businesses Actually More Vulnerable?
Not every small business is poorly protected, and larger organisations face persistent threats too. In the government survey, medium (65%) and large (69%) businesses were more likely than small ones to report a breach or attack, which may partly reflect bigger digital footprints and better detection.
A more useful measure of risk looks beyond headcount to the data you hold, what you expose online, the strength of your controls and who you connect to. Being targeted is also not the same as being compromised: strong basic controls stop many automated attacks from ever becoming incidents.
What Should a Small UK Business Protect First?
You do not need every advanced security tool at once. Start with strong fundamentals and build on them as the business grows.
Start with the essentials
- Turn on multi-factor authentication for email, banking, cloud and admin accounts. Fewer than half of UK businesses (47%) currently require it.
- Use strong, unique passwords stored in a password manager.
- Keep operating systems, applications and devices updated.
- Maintain backups and regularly test that they can be restored.
- Limit admin rights to the people who genuinely need them.
- Train staff to recognise phishing, impersonation and unusual payment requests.
Use UK frameworks rather than starting from scratch
The government-backed Cyber Essentials scheme certifies five basic controls: firewalls, secure configuration, user access control, malware protection and security updates. It is required for some government contracts and often requested by larger customers, and the share of small businesses holding it rose from 5% to 12% in the latest survey. The National Cyber Security Centre’s free Small Business Guide is a good starting point. Firms handling sensitive data or serving larger organisations may later need security monitoring, supplier risk assessments and Cyber Essentials Plus.
Know what you will do if something goes wrong
Only a quarter of UK businesses have a formal incident response plan. Even a one-page plan should cover who to call, how to isolate affected accounts, how to reach your bank quickly if money has moved, and when to notify customers or the ICO. In England, Wales and Northern Ireland, report cyber crime and fraud to Report Fraud, which replaced Action Fraud in December 2025. In Scotland, contact Police Scotland on 101.
Common Cybersecurity Mistakes Small Businesses Make
- Assuming criminals only target larger organisations.
- Treating antivirus software as the whole security strategy.
- Assuming an IT support provider automatically covers cybersecurity.
- Assuming cyber insurance prevents an attack.
- Only training staff after an incident has happened.
Frequently Asked Questions
Why do hackers target small businesses?
They can offer valuable data, money, credentials or access to other organisations, often with fewer defences in place, and automation lets criminals target thousands of them cheaply.
Where should a UK business report a cyberattack?
Report cyber crime and fraud to Report Fraud in England, Wales and Northern Ireland, or to Police Scotland on 101. If personal data is affected, you may also need to notify the ICO within 72 hours.
Does cyber insurance protect a business from cyberattacks?
It can help with some financial consequences, and some policies include incident response support. It does not prevent an attack, so security controls are still essential.
The Bottom Line for Small UK Businesses
A small business is not a target because it is small, but because of the information it holds, the accounts it controls and the organisations it connects to. The answer is not an enterprise-sized security operation. Protect the accounts, devices, data and people that matter most, then build from there. The earlier security becomes routine, the less likely one compromised account is to become a much larger problem.
