Journey

Cyber security quick wins

Five practical security improvements any business can implement today without technical expertise. Covers passwords, updates, backups, phishing awareness, and access control.

Running a Business Updated 15 September 2026

5 milestones references 3 guides

Quick security wins for your business

You do not need technical expertise to protect your business from most cyber attacks. These five actions take minutes to implement and block the majority of common threats.

Why this matters now

Small businesses face record cyber threats. Understanding the current risk helps motivate action.

The UK is experiencing record cyber threats. The National Cyber Security Centre (NCSC) states: "The question is no longer if your organisation will face a cyber incident, but when."

NCSC CEO Richard Horne's warning: "Cyber criminals will target organisations of all sizes, operating in any sector."

Nationally significant attacks (year to September 2025): 204 attacks (up from 89 previous year)
Nationally significant attacks per week: 4 per week
Increase in highly significant incidents: 50% increase
Proportion of attacks classified as nationally significant: 48% (record high)
Ransomware incidents per week: 35-40 incidents per week (up from 20-25 in 2024)
Ransomware classification: Most acute cyber threat to UK organisations (NCSC)
Small businesses targeted by ransomware: 71% of ransomware attacks
Average ransomware downtime: 21 days
Average ransom demand: £100,000-£500,000 (varies widely)
Suspicious emails reported to SERS: 10.9 million in past year
Successful attacks beginning with phishing: Over 90%
People using easy-to-guess credentials: 19%
Businesses reviewing supplier cyber risk: Only 14% in last 12 months

Use strong passwords and turn on two-step verification

Weak passwords are the easiest way into your business. 19% of people still use easy-to-guess credentials.

Do now: Enable two-step verification (2FA) on email, banking, and cloud storage. Use a password manager to create unique passwords for every account.

Full password and 2FA guidance

Step-by-step instructions for setting up strong passwords and two-factor authentication across your accounts
Turn on automatic updates

Security updates fix vulnerabilities that criminals actively exploit. Delaying updates leaves your door open.

Do now: Enable automatic updates on Windows, Mac, phones, tablets, and your router. This single action blocks many common attacks at no cost.

Security update guidance

How to configure automatic updates on all your devices and why the 14-day patching rule matters
Back up your data

Ransomware encrypts your files and demands payment. If you have backups, you can recover without paying. Average ransomware downtime is 21 days.

Do now: Use the 3-2-1 rule - three copies of important data, on two different types of storage, with one copy offline or in the cloud. Test that you can actually restore from backup.
Learn to spot phishing

Over 90% of successful attacks begin with a phishing email. Knowing the warning signs protects your entire business.

Red flags: Urgency ("act now"), unexpected requests for money or passwords, sender addresses that do not match the display name, suspicious links. When in doubt, verify by phone using a known number.

Report suspicious emails: Forward to report@phishing.gov.uk
Review who has access to what
Only 14% of businesses reviewed supplier cyber risk in the last 12 months. Former employees and unnecessary admin accounts create risk.

Do now: Remove access for anyone who has left. Review who has admin rights - most staff should not. Check which third parties can access your systems and whether they still need to.
These align with official guidance

These quick wins map directly to the government's Cyber Essentials framework - the five controls that block approximately 80% of common attacks.
Cyber Essentials certification addresses five core technical controls that help protect against almost all cyber threats:

Firewalls and Internet Gateways: Establish boundaries between your organisation and the internet. Properly configured firewalls on all internet connections with default deny policy for incoming connections.

Secure Configuration: Remove unnecessary accounts and software, disable insecure defaults, lock unattended devices. Change default passwords, implement automatic screen locking (maximum 10 minutes).

Access Control: Manage user accounts, enforce unique credentials, use multi-factor authentication (MFA) for cloud services. MFA mandatory for administrator accounts, remote access, and cloud services handling sensitive data.

Malware Protection: Protect devices from malware using anti-malware software. Automatic updates enabled, regular scans configured, email scanning for attachments and links.

Security Update Management: Apply security updates within 14 days of release for critical patches. Automatic updates enabled where possible, documented approach for legacy systems.

Control 1: Firewalls and Internet Gateways

Default deny policy, only necessary services exposed, regular review of firewall rules

Control 2: Secure Configuration

Disable unnecessary accounts/software/services, change default passwords, auto-lock after 10 minutes maximum

Control 3: Access Control

Unique user accounts, strong passwords, MFA for admin/remote/cloud, least privilege principle

Control 4: Malware Protection

Anti-malware on all devices, automatic updates, regular scans, email scanning

Control 5: Security Update Management

Apply critical patches within 14 days, automatic updates enabled, documented approach for unsupported software

MFA mandatory for

Administrator accounts, remote access, cloud services handling sensitive data

Screen lock maximum timeout

10 minutes

Security update timeline

Within 14 days for high-risk vulnerabilities

Next steps: get certified

Once you have implemented these basics, consider formal Cyber Essentials certification. It demonstrates your security to customers and is required for many government contracts. Basic certification costs around 320 pounds for micro businesses.

Get Cyber Essentials certified

How to achieve certification, what it costs, and when you need it for contracts

If you have been attacked

Despite precautions, attacks can still happen. If you experience a cyber incident, you may need to report to multiple authorities within strict deadlines.

Report a cyber incident

Who to contact, what to report, and the 72-hour deadline for data breaches

ncsc.gov.uk

NCSC Cyber Action Plan (opens in a new tab)

Free online tool that creates a personalised security action plan for your business

Cyber security quick wins

Quick security wins for your business

Use strong passwords and turn on two-step verification

Full password and 2FA guidance

Turn on automatic updates

Security update guidance

Back up your data

Learn to spot phishing

Review who has access to what

Next steps: get certified

Get Cyber Essentials certified

If you have been attacked

Report a cyber incident

NCSC Cyber Action Plan (opens in a new tab)

Related journeys

Cyber security fundamentals

Respond to a data breach

Data breach 72-hour checklist

Respond to a cyber attack