The Main Cyber Risks for UK SMEs and the Most Common Attacks
By Daniel Agyemang Prempeh, Founder, DefendVistaLast reviewed:
Cyber risks relevant to UK transport, warehousing and professional services SMEs, with controls that can reduce exposure.
This guide covers cyber risks relevant to UK SMEs and practical measures that can reduce exposure. It is not a ranking of attack frequency or a guarantee that any single control will stop an incident.
What are the main cyber risks for UK SMEs?
The main cyber risks for UK SMEs are phishing and credential theft, business email compromise, ransomware, exploitation of unpatched remote access appliances, supplier compromise, honest insider mistakes and short DDoS extortion attacks. The relative risk depends on the business. MFA can reduce credential-related risk but does not prevent every attack.
- ✓Phishing and credential theft: fake login pages can steal passwords. MFA and suitable access controls reduce risk but do not guarantee prevention.
- ✓Business email compromise: an attacker sits in your email for two to six weeks, then redirects a payment. Verify any bank detail change by phone to a known number.
- ✓Ransomware: preceded by weeks of quiet reconnaissance. Strong identity, modern EDR, tested offline or immutable backups and network segmentation are the controls that matter.
- ✓Remote access exploitation: unpatched Citrix, Fortinet, Ivanti and Cisco appliances exploited within hours of disclosure. Patch internet facing kit within 72 hours.
- ✓Supplier compromise: attacks pivot in through customs broker portals, EDI gateways and managed IT supplier remote access. Document and review every integration quarterly.
- ✓Insider mistakes: misdirected email or public file shares can expose personal data and require a documented breach assessment.
- ✓DDoS and extortion noise: short, opportunistic attacks with a small crypto ransom demand. Cloudflare or AWS Shield Standard handles the volume cheaply.
Phishing and credential theft
Phishing can lead to credential theft or fraudulent payment requests. MFA, suitable email protection and staff reporting can reduce risk, but cannot prevent every attack. Review account coverage, access policies and independent payment verification alongside training.
Business email compromise (BEC)
An attacker may compromise or impersonate a mailbox to redirect payments. Verify bank-detail changes through a previously known contact channel, not details supplied in the request. Account protection, email filtering and clear approval procedures can reduce risk without guaranteeing prevention.
Ransomware
Ransomware may follow stolen credentials, exploited software or other unauthorised access. Restrict privileges, use suitable endpoint protection, test isolated backups and segment systems where appropriate. These measures support prevention, detection and recovery but do not guarantee containment or a recovery time.
Remote access exploitation
Unpatched Citrix, Fortinet, Ivanti and Cisco appliances scanned and exploited within hours of vulnerability disclosure. The 2024 Fortigate vulnerabilities, the 2023 MOVEit campaign and the long tail of Citrix bleeding are all examples. Patch fast (within 72 hours for internet facing kit), replace legacy VPN with modern zero trust alternatives where possible, and put MFA on every remote access path including the IT supplier's.
Supplier compromise
A compromised supplier may expose your business through trusted access or integrations. Document connections, limit permissions, review access and agree incident contacts with suppliers. The effect of a supplier incident depends on those connections and controls.
Insider mistakes (not malice)
Misdirected email, lost devices or public file-sharing settings can expose personal data. Appropriate access controls, data-loss prevention and staff training can reduce these risks. Assess and document each breach rather than assuming a reporting obligation.
DDoS and extortion noise
Distributed denial of service attacks against SME websites are usually short, opportunistic and accompanied by a ransom demand for a few thousand pounds in cryptocurrency. Cloudflare or AWS Shield Standard handles the volume cheaply. Pay the bill once, never the ransom.
Frequently asked questions
What is the single most effective control?+
Priorities depend on your risks. MFA on email, remote access and privileged accounts is an important measure, alongside patching, suitable endpoint protection, tested backups and clear reporting procedures. No single control prevents every attack.
Does antivirus still matter?+
Modern endpoint detection and response (EDR) goes well beyond traditional antivirus and is essential. Legacy AV alone leaves you blind to the techniques used by current ransomware groups. Expect to pay £3 to £6 per endpoint per month for a competent EDR product.
How quickly do attackers move?+
Timing varies by access route, attacker and controls. Prepare for rapid escalation rather than relying on an assumed period before ransomware or data theft.
Are we too small to be a target?+
No business is protected by size alone. Opportunistic scanning, stolen credentials and malicious emails can affect small businesses as well as larger organisations.
What is the biggest cyber risk to a small business in the UK?+
The highest risk depends on your systems and operations. Consider phishing, account compromise, ransomware, vulnerable software and supplier access, then prioritise controls against likely business impact.
How much does a cyber attack cost a UK SME?+
Costs depend on the systems affected, disruption, recovery work and contractual terms. Use your own operational figures and supplier quotes to estimate exposure; there is no single cost that applies to every UK SME.
What cyber security should a UK SME have as a minimum?+
Multi factor authentication on email and critical systems, modern endpoint detection and response rather than legacy antivirus, tested offline or immutable backups, patching of internet facing kit within 72 hours, and short targeted staff awareness training.
Next step
Want to talk this through?
Book an initial call. No sales pitch, just clear answers.
Book an initial call