The Cyber Threats UK Businesses Should Be Thinking About Right Now

Cyber security has changed. Has your business changed with it?

Phishing, stolen accounts, ransomware and vulnerable software aren’t new. However, cyber threats continue to change, and some can be difficult to recognise.

At the same time, businesses now rely heavily on email, cloud services and connected systems. As a result, it’s worth checking that your cyber security is keeping up.

For business owners, this isn’t a reason to panic. Instead, it’s a reason to take a fresh look at the basics.

So, what are the main cyber security threats UK businesses should be thinking about right now?

1. Phishing and social engineering

We’re all familiar with the warning signs of a poor phishing email. Bad spelling, strange formatting and suspicious links can quickly give the game away.

However, you can’t rely on those signs alone.

UK Government guidance warns that phishing can arrive through emails, messages, social media and phone calls. Therefore, unexpected or unusual requests should always be checked carefully.

Pay particular attention to:

• Unexpected payment requests
• Changes to bank details
• Password reset requests
• Requests for sensitive information
• Unusual links or documents

For example, if a supplier suddenly asks you to send money to a different account, check the request using contact details you already trust.

The aim isn’t to make your team suspicious of everything. It’s to make checking something unusual quick, easy and normal.

2. AI is making checks even more important

Artificial intelligence is creating exciting opportunities for businesses. However, it’s also changing the cyber security conversation.

UK Government guidance recognises that new technology, including AI-generated images, can make some fraudulent claims look more convincing.

Something looking professional doesn’t automatically make it genuine.

Of course, that doesn’t mean you should distrust every email or message you receive.

Instead, put simple checks around important actions. If an unexpected request involves money, sensitive information or account access, check it through another trusted method.

Sometimes a quick phone call is all it takes.

3. Compromised user accounts

Strong passwords are important. But knowing who has access to what matters too.

In fact, user access control is one of the five technical controls within the Government-backed Cyber Essentials scheme.

Ask your business:

• Who can access our important systems?
• Does everyone still need the access they have?
• Are accounts removed when people leave?
• Which accounts have higher levels of access?
• When did we last review access?

You don’t need to understand every technical setting. Instead, you need confidence that somebody is checking the right things.

4. Software updates still matter

It’s easy to put off a software update when everything seems to be working.

However, keeping software up to date remains an important part of good cyber security.

Security update management is another of the five Cyber Essentials controls. It helps protect businesses from criminals using weaknesses in software as a way into systems.

Ultimately, good cyber security isn’t always about adding more technology. Sometimes getting the basics right can make a real difference.

5. Ransomware and business disruption

Ransomware sounds like an IT problem. In reality, the bigger concern for a business owner is often disruption.

What happens if your team can’t work?

• Could your people still communicate?
• Could customers place orders?
• Could you access important information?
• Could you continue serving customers?
• Would everyone know who to contact?

UK Government research has highlighted the disruption caused by major cyber attacks, including incidents affecting Marks & Spencer and Co-op.

Therefore, ransomware shouldn’t only be seen as a technology problem. It’s also a business continuity issue.

Don’t just ask, “How do we stop an attack?” Also ask, “How would we keep operating if something went wrong?”

6. Third-party and supplier cyber risk

Your cyber security doesn’t stop with your own business.

After all, most organisations rely on IT providers, accountants, payroll services, software companies, cloud services and other partners. Some of these businesses may have access to systems or information that matters to you.

Start with four simple questions:

• Which suppliers can access our systems or data?
• What can they access?
• Do they still need that access?
• What happens to their access when we change supplier?

You don’t need to turn every supplier relationship into a security investigation. However, you should know where important access exists.

7. Why Microsoft 365 security needs regular review

For many organisations, Microsoft 365 is part of everyday working.

However, simply using Microsoft 365 doesn’t remove the need to manage accounts, access, security settings and your people.

Over time, every business changes. People join and leave, permissions change and new services are added. Meanwhile, the way your team works can change too.

That’s why Microsoft 365 security deserves regular attention.

A useful Microsoft 365 security review should help you answer three clear questions:

1. What’s protected?
2. Where are the gaps?
3. What should we do next?

In short, you need clear answers and practical next steps, not a long list of technical terms.

8. What can businesses do about cyber security?

The good news is that improving your cyber security doesn’t always mean buying more technology.

Instead, start with the basics.

Protect accounts

Review who has access to important systems and information. Also, remove access when it’s no longer needed.

Use multi-factor authentication

Add another layer of protection beyond passwords, especially for important accounts.

Keep software updated

Make it clear who’s responsible for important security updates.

Train your people

Help your team recognise suspicious requests. Just as importantly, make sure they know what to do if something doesn’t look right.

Check unusual requests

If an unexpected message asks for money, sensitive information or an account change, check it using contact details you know and trust.

Review supplier access

Know which outside organisations can access your systems and data. Then, check that this access is still needed.

Prepare for disruption

Finally, make sure your team knows what to do if an important system suddenly becomes unavailable.

9. Cyber Essentials is a practical place to start

With so much cyber security advice available, knowing where to begin can be difficult.

Fortunately, Cyber Essentials gives businesses a recognised starting point.

Cyber Essentials is a Government-backed scheme designed to help organisations protect themselves against common online threats.

It focuses on five technical controls:

• Firewalls
• Secure configuration
• Security update management
• User access control
• Malware protection

As a result, Cyber Essentials can help turn a complicated subject into a clearer set of priorities.

You don’t need to become a cyber security expert. You simply need to know that the right foundations are in place.

Cyber confidence starts with clarity

There’ll always be another cyber security headline, another threat and another piece of technology to understand.

Thankfully, you don’t need to follow every development.

Instead, focus on three simple questions:

Good cyber security isn’t about scare stories. Instead, it’s about sensible protection, informed people, regular reviews and knowing what to do if something goes wrong.

Cyber security has changed. Has your business changed with it?