Small businesses are attacked for the same reason large ones are: they have money, data and email accounts that can be used to reach customers and suppliers, and they usually have fewer people watching. This list ranks the ten cyber threats that most often hurt small firms, what each looks like in practice and the specific steps that stop it, with the official UK and US guidance behind each fix. It is written for owners, office managers, the person who "does the IT" and the managed service providers who support them. Most fixes cost little or nothing. For the step-by-step setup, use the Small Business Cybersecurity Basics Guide and the Small Business Cyber Security Checklist; this page explains which threats those steps defend against and in what order.
Key takeaways
- Phishing is the main way in. The UK Cyber Security Breaches Survey 2025 found phishing affected 85% of businesses that reported a breach or attack, and 42% of small businesses reported phishing attacks in the year.
- Fraud costs more than malware. The FBI's IC3 recorded about US$2.77 billion in reported business email compromise losses in 2024 from 21,442 complaints, against 3,156 ransomware complaints.
- Email and finance accounts need MFA first. CISA tells small businesses to enforce MFA on key accounts, especially email, and names FIDO security keys as the strongest option.
- Backups decide whether ransomware is a bad week or the end. The NCSC advises two backups, one offline or disconnected, and testing restores.
- Cyber Essentials covers most of this list. Its five controls (firewalls, secure configuration, security update management, user access control and malware protection) defend against most items here.
The Top 10 at a glance
| # | Threat | What it costs a small firm | First fix |
|---|---|---|---|
| 1 | Phishing and email account takeover | Stolen logins, fraud sent from your mailbox | MFA on email; report button |
| 2 | Invoice fraud and business email compromise | Payments sent to criminals | Call back before changing bank details |
| 3 | Ransomware and data extortion | Days or weeks offline, data leaked | Offline, tested backups |
| 4 | Weak, reused and shared passwords | Accounts opened by password guessing or old leaks | Password manager and MFA |
| 5 | Unpatched and unsupported devices and software | Remote takeover through known flaws | Automatic updates; replace unsupported kit |
| 6 | Phone, text and tech support scams | Remote access to PCs, gift card and payment fraud | Staff rule: never act on unsolicited calls |
| 7 | Compromise through your IT provider or suppliers | Attackers arriving with trusted access | Ask how your provider secures its access |
| 8 | Former staff, shared logins and too much access | Access nobody remembers granting | Named accounts; remove leavers on day one |
| 9 | Lost or stolen laptops and phones | Customer data exposed, accounts reached | Disk encryption, screen lock, remote wipe |
| 10 | Website, domain and social media hijack | Defaced site, lost domain, scams sent to customers | MFA and recovery details on every admin account |
The ranking reflects how often each threat appears in UK and US official data and how much harm it causes small firms. Items 1 to 4 share the same small set of fixes, so a firm that does those well has dealt with most of its risk.
1. Phishing and email account takeover
What it looks like: an email that appears to come from Microsoft, a courier, a bank or a known supplier asks someone to log in, open an invoice or approve a document. The fake login page captures the password, and the attacker reads the mailbox, sets up forwarding rules and emails your customers.
Why it ranks first: the Cyber Security Breaches Survey 2025 found 43% of UK businesses identified a breach or attack in the previous 12 months, with phishing the most common and most disruptive type, experienced by 85% of those businesses. 35% of micro businesses and 42% of small businesses reported phishing attacks.
How to stop it: turn on MFA for every email account, using an authenticator app or security key rather than text messages where you can. Switch on your email provider's filtering and publish SPF, DKIM and DMARC records for your domain, as the NCSC recommends. Give staff an easy way to report a suspicious message and thank them when they do. See How to Spot a Phishing Email Guide.
2. Invoice fraud and business email compromise
What it looks like: a supplier "changes bank details", the boss emails asking for an urgent payment or gift cards, or a genuine email thread is hijacked to send a revised invoice. Often the attacker is inside a real mailbox (yours or the supplier's) after item 1.
Why it matters: the IC3 2024 report recorded 21,442 business email compromise complaints with US$2,770,151,146 in reported losses. For a small firm a single diverted payment can exceed a year's profit, and banks may not recover it.
How to stop it: make it a fixed rule that any change of bank details, or any unusual payment request, is confirmed by phone on a number you already hold, never one in the email. The NCSC recommends exactly this second-channel check for payment changes. Require two people to approve new payees and large transfers. See the Business Email Compromise Awareness for Finance Teams Guide.
3. Ransomware and data extortion
What it looks like: files and systems are encrypted (MITRE ATT&CK T1486 Data Encrypted for Impact) and a ransom note demands payment, often with a threat to publish stolen data. Entry is usually through phishing, a stolen password on remote access, or an unpatched internet-facing system.
Why it matters: the Cyber Security Breaches Survey 2025 estimated about 1% of UK businesses, roughly 19,000, experienced ransomware in the year, up from under 0.5% the year before. The IC3 received 3,156 ransomware complaints in 2024. Rare compared with phishing, but the impact can close a small business.
How to stop it: follow the NCSC's backup advice: back up all the data the business needs, keep one copy on a device that is disconnected when not in use and one online, protect online backups with two-step verification, and practise restoring. Remove remote desktop from the internet and put MFA on any remote access. See Ransomware Basics for Small Businesses Guide.
4. Weak, reused and shared passwords
What it looks like: one password used for email, banking and the accounting system; a shared admin login written on a note; passwords that appeared in an old breach of another site. Attackers try common passwords against many accounts (T1110.003 Password Spraying) or replay leaked ones, then log in as a valid user (T1078 Valid Accounts).
How to stop it: give everyone a password manager, use long unique passwords, and turn on MFA wherever it is offered, starting with email, banking, accounting, payroll and domain registrar accounts. CISA advises enforcing MFA with technical controls rather than relying on staff to enrol, checking regularly for gaps such as new hires or people who changed phones, and requiring MFA for every administrator account. See the Small Business Identity and Access Security Guide.
5. Unpatched and unsupported devices and software
What it looks like: laptops that postpone updates for months, an old router or firewall no longer receiving firmware, a server running an unsupported operating system, or a web plugin that was never updated. Attackers scan the internet for known flaws in exposed systems (T1190 Exploit Public-Facing Application).
How to stop it: the NCSC advises keeping all devices, software and apps up to date, turning on automatic updates, deleting apps you no longer use and replacing devices that no longer receive updates. CISA adds that small businesses should prioritise vulnerabilities in its Known Exploited Vulnerabilities catalogue. Cyber Essentials requires security update management as one of its five controls. See the Small Business Device Management Guide.
6. Phone, text and tech support scams
What it looks like: a caller claiming to be from the bank, the tax office, Microsoft or "your IT support" asks staff to install remote access software, read out a code or move money to a "safe account". Texts carry links to fake parcel or bank pages.
Why it matters: the IC3 recorded US$1,464,755,976 in reported tech support fraud losses in 2024 across all victims. These scams target the person, so technical filters rarely stop them.
How to stop it: agree simple house rules: nobody installs software or shares a code because someone called them; hang up and call back on a known number; your IT provider will tell you in advance how it contacts you. Remove administrator rights from everyday accounts, which CISA recommends because it makes malicious software harder to install. See the Vishing and Help Desk Social Engineering Awareness Guide.
7. Compromise through your IT provider or suppliers
What it looks like: your managed service provider's remote management tool, or a supplier's account with access to your systems, is used by an attacker to reach you. Small firms rarely see this coming because the access is trusted and always on.
How to stop it: ask your provider how it protects its own access to you: MFA on its tools, named engineer accounts, logging you can see, and how quickly it would tell you about an incident. Make sure you, not only the provider, hold the administrator credentials for your email, domain and cloud accounts. Remove supplier access you no longer need. See Choosing an IT Support Provider or MSP Securely.
8. Former staff, shared logins and too much access
What it looks like: a leaver's email and cloud accounts still work months later; everyone logs in as "office@" or "admin"; every member of staff can see payroll and customer files. Cyber Essentials covers this as user access control.
Where identity fits: shared logins make it impossible to tell who did what, and accounts used by apps and integrations (an accounting sync, a website plugin, an API key for a payment service) are often created once and forgotten. Each is an identity that needs an owner and should be removed when no longer used.
How to stop it: give everyone a named account; remove access on a leaver's last day using a short checklist; review who has admin and finance access every quarter; list the apps connected to your email and cloud accounts and remove ones you do not recognise.
9. Lost or stolen laptops and phones
What it looks like: a laptop left on a train or taken in a break-in, with customer files and saved logins on it.
How to stop it: CISA advises enabling disk encryption on Windows and Mac laptops because lost and stolen laptops are common. The NCSC advises locking phones and tablets with a PIN, password or biometrics. Turn on device location and remote wipe, keep work files in cloud storage rather than only on the device, and know who to call to disable the device's accounts.
10. Website, domain and social media hijack
What it looks like: the website's admin login is guessed and the site is defaced or made to serve malware; the domain registrar account is taken over and email stops; the company's social media pages are hijacked and used to scam customers.
How to stop it: put MFA on website, hosting, registrar and social media admin accounts; keep recovery email addresses and phone numbers current and under company control; keep website software and plugins updated; and make sure more than one trusted person holds admin rights. See the Small Business Website Security Guide and the Social Media Account Takeover Playbook.
Choosing your approach by size
| Your situation | Do first | Get help with |
|---|---|---|
| Under 10 people, no IT staff | MFA on email and banking, password manager, automatic updates, two backups | Cyber Essentials readiness tool; NCSC small business guide |
| 10 to 50 people with an IT provider | Agree the provider's security duties in writing; payment verification rule; leaver checklist | Device management, email security settings, backup testing |
| 50 to 250 people with in-house IT | Cyber Essentials Plus, phishing-resistant MFA for admins and finance, centralised logging | Incident response retainer, independent testing |
In the UK, Cyber Essentials certification starts at £320 plus VAT, small and medium-sized firms can book a free 30-minute consultation with an NCSC-assured Cyber Advisor, and organisations with turnover under £20 million that certify their whole organisation receive cyber liability insurance arranged by IASME. Cyber Essentials Plus adds independent technical testing.
Signs something is wrong and what to measure
- Warning signs: customers receiving odd emails from you; new mailbox forwarding or deletion rules; MFA prompts nobody requested; password reset emails you did not trigger; files renamed or unreadable; unknown remote access software on a PC.
- What to measure: percentage of accounts with MFA (target 100% for email, finance and admin); devices with automatic updates on and supported operating systems; date of the last successful test restore; number of leaver accounts still active; payment changes verified by phone.
Common failure patterns
- MFA on some accounts only: the owner's email is protected but the shared finance mailbox is not.
- Backups that were never restored: CISA notes incomplete or untested backups are a common reason ransomware victims struggle.
- Assuming the IT provider does security: nobody has agreed in writing who patches, who monitors and who responds.
- The provider holds every admin password: if the relationship ends or the provider is breached, the business cannot recover its own accounts.
- Training once a year: staff forget, and nobody knows how to report a suspicious call.
Mapping to frameworks
| Framework | Reference | Threats |
|---|---|---|
| UK Cyber Essentials | Firewalls; Secure configuration; Security update management; User access control; Malware protection | 5, 10; 3, 9; 5; 4, 8; 1, 3, 6 |
| NCSC Small Business Guide | Secure your email; Secure your important online accounts; Protecting your devices; Backing up your data; Spotting cyber attacks | 1, 2; 4, 8, 10; 5, 9; 3; 1, 6 |
| MITRE ATT&CK | T1566 Phishing; T1078 Valid Accounts; T1110.003 Password Spraying; T1190 Exploit Public-Facing Application; T1486 Data Encrypted for Impact; T1657 Financial Theft | 1; 4, 8; 4; 5, 10; 3; 2, 6 |
| NIST CSF 2.0 | PR.AA-03 authentication; PR.AT-01 awareness and training; PR.DS-11 backups of data | 1, 4; 1, 2, 6; 3 |
Where to start
- Today: turn on MFA for email, banking and accounting; agree the call-back rule for any payment change.
- This week: set up two backups, one disconnected, and test a restore; switch on automatic updates on every device.
- This month: roll out a password manager; give everyone named accounts; remove leavers and unused apps; encrypt laptops.
- This quarter: agree security duties with your IT provider; secure website, domain and social media admin accounts; work towards Cyber Essentials.
Practitioner checklist
- MFA on every email, finance, admin, registrar and social media account.
- Bank detail changes and unusual payments confirmed by phone on a known number, with two approvers.
- Two backups, one disconnected, with a restore tested in the last quarter.
- Password manager in use; no shared logins for systems that support named accounts.
- Automatic updates on; unsupported devices and software replaced; KEV-listed flaws prioritised.
- Everyday accounts without administrator rights.
- Leaver checklist removes all access on the last day; connected apps reviewed quarterly.
- Laptops encrypted, phones locked, remote wipe enabled.
- IT provider's access, MFA and incident notification agreed in writing; the business holds its own admin credentials.
- Staff know how to report suspicious emails and calls, and are thanked for doing so.
Standards and references
- NCSC: Small Business Guide
- NCSC: Cyber Essentials overview
- NCSC: Backing up your data
- NCSC: Protecting your devices
- CISA: Cyber Guidance for Small Businesses
- UK Government: Cyber Security Breaches Survey 2025
- FBI IC3: Internet Crime Report 2024
- NCSC: Phishing attacks, defending your organisation
Related NHI Mgmt Group resources: Small Business Cybersecurity Basics Guide · Small Business Incident Response Guide · Small Business Cyber Statistics · Top 10 Social Engineering Attacks