A business can outgrow its original way of working before anyone notices that its security arrangements have stayed the same. More staff, more accounts and more suppliers create more decisions about who can access what.
The National Cyber Security Centre's latest SME Behaviour Tracker, released on 21 September, found that 76% of businesses with 20–49 employees had experienced a cyber threat or attack in the previous six months, compared with 53% across SMEs. That wording matters: it does not mean three-quarters suffered a successful breach.
Make the routine controls routine
The NCSC points businesses towards measures including multi-factor authentication, software updates, backups and staff training. These work best when someone owns the process and checks that it is happening.
A growing business should be able to explain how a new employee gets access, how that access changes with their role and how it is removed when they leave. The same questions apply to external contractors.
Shared accounts can make an immediate task easier while making responsibility harder to establish later. Reviewing them is a practical way to find places where convenience has overtaken control.
There is also a commercial reason to involve people outside the IT function. An accounts employee may be the first to receive an unusual payment request, while a customer-service team may notice that messages are being sent from an account unexpectedly. A response plan should use that knowledge rather than treating security as something happening elsewhere.
A short practice exercise can be enough to expose uncertainty. Give the team a hypothetical suspicious invoice and ask how it would be checked, who would be contacted and what would happen if the usual approver were unavailable. The value lies in resolving the unanswered questions.
Rehearse the first hour
Preparation should include what happens when someone spots a suspicious message or unusual account activity. Staff need a reporting route that feels quick and safe to use, including when they have already clicked something.
Blame can delay a report at exactly the moment early action matters. A clear response procedure gives people something more useful to do than worry about how the mistake will be received.
The survey is a reason to examine exposure, not to assume every firm faces an identical threat. Each business should understand its own systems and dependencies.
Cyber security becomes more manageable when it is built into ordinary administration. Access reviews, tested recovery arrangements and confident reporting are business practices as much as technical tasks.
