Cyber Security for UK Small Business
Most cyber security advice is written for enterprises with a dedicated SOC. Small businesses need a different playbook that costs less than the breach it prevents.
The UK government's Cyber Essentials scheme lists five technical controls that stop about 80% of common attacks. Start there — it costs £300–500 and takes a few afternoons. But certification alone will not stop a determined attacker. For that, you need a layered approach.
Step 1: Get the basics right
- Patching. Windows updates, firmware updates, browser updates. Automate them. The median time from CVE publication to exploitation is now under five days.
- MFA everywhere. Email, cloud consoles, VPN, HR system. SMS-based MFA is better than nothing; app-based or hardware tokens are better.
- Backups. Offline, offsite, tested. If ransomware encrypts your file server, the backup is your only way back without paying.
- Least privilege. Nobody runs as local admin day-to-day. Give staff the minimum access they need; revoke it when they leave.
Step 2: Train your people
Phishing is still the number one entry vector. Your people are either your weakest link or your best detection layer. Give them a reporting button and tell them that clicking "report" is never punished.
WatchTower's phishing simulation sends realistic, non-punitive simulations. Staff who click get a teachable moment, not a telling-off.
Step 3: Add endpoint detection
Defender is free but signature-based. WatchTower EDR watches what processes actually do: PowerShell reaching out to a new IP, a signed binary loading a suspicious DLL, Office macros spawning command interpreters.
WatchTower EDR starts at £5/device/month with a 30-day trial and no minimum seat count.
Step 4: Write an incident response plan
One page of A4 covering: who decides "this is an incident", whether devices get isolated, when the ICO gets notified, and how to communicate with customers.