GCHQ’s 2026 Annual Lecture at Bletchley Park carried a clear message for UK businesses:
Cyber security is no longer something to leave until later.
Anne Keast-Butler, Director of GCHQ, said cyber security is now a critical priority for all businesses and that businesses need to take immediate action.
That matters.
Not just for banks, government departments and large companies with security teams.
It matters for schools, care providers, charities, parish councils, trades, professional services firms and smaller businesses that rely on email, Microsoft 365, cloud files, online banking, remote access, suppliers and customer data every day.
You may not think of your organisation as critical national infrastructure.
Attackers may still see value in your data, your accounts, your invoices, your contacts, your systems and your supply chain relationships.
What GCHQ said
The speech covered a lot of ground: AI, data, quantum computing, space, supply chains, Russia, China, partnerships and national resilience.
But for smaller organisations, a few points stood out.
Cyber security has never been more important.
Businesses need to act now.
Data is no longer just “data”. It is a strategic asset.
AI brings huge opportunity, but it also changes the threat picture.
Supply chains need to be protected.
People should move away from passwords where possible and start using passkeys.
That is a serious message from the UK’s intelligence and security community. It is also a practical one.
This is not about making every small business behave like a government agency. It is about recognising how much everyday business now depends on digital systems.
Why this matters to smaller organisations
A small business owner might hear a GCHQ speech and think:
“That’s important, but it’s not really about us.”
I don’t think that is true.
Most smaller organisations now run on the same basic foundations as much larger ones:
Microsoft 365 or Google Workspace
email
cloud storage
mobile devices
supplier portals
online accounts
finance systems
customer records
remote access
shared calendars
cloud backups, or sometimes no proper backup at all
A compromised email account can be enough to cause serious damage.
A malicious inbox rule can hide fraudulent messages.
A stolen password can give an attacker access to files, contacts, invoices and payment conversations.
A fake supplier email can lead to money being sent to the wrong place.
A ransomware attack can stop a care provider, school, charity or small business from operating properly.
This is why cyber security can no longer sit in the “we’ll sort that later” pile.
You still hold valuable data
One of the strongest points in the GCHQ speech was about data.
Smaller organisations often underestimate the value of what they hold.
It might not look exciting from the inside. It may just be:
email history
client contact details
invoices
contracts
pupil records
care records
staff files
payroll data
supplier information
project documents
login details
quote requests
insurance documents
To an attacker, that can be useful.
It can be stolen, sold, encrypted, copied, used for fraud, used for impersonation, or used to attack someone else.
That is why protecting data is not just a technical issue. It is a business resilience issue.
If your organisation relies heavily on Microsoft 365, it is worth checking whether your accounts, email and cloud data are properly protected. We explain this in more detail on our Microsoft 365 backup page.
AI makes the basics more urgent, not less
AI was a major theme in the GCHQ speech.
For small businesses, the practical point is simple: AI can help defenders, but it can also help attackers move faster.
Phishing emails can look more convincing.
Scam messages can be better written.
Attackers can research companies more quickly.
Fake messages can be tailored to specific people, roles and business processes.
That does not mean small businesses need to panic or suddenly buy every AI security tool they see advertised.
It means the basics matter even more.
If your accounts are weak, your devices are unpatched, your backups are untested, your staff are untrained and your email security is poor, AI gives attackers more room to work.
The answer is not fear. The answer is preparation.
Move away from passwords where possible
One of the clearest practical points from the speech was the call to move from passwords to passkeys.
That is worth paying attention to.
Passwords are still one of the biggest weaknesses in business security. They get reused. They get guessed. They get phished. They get stolen in breaches from other services.
Multi-factor authentication helps, but not all MFA is equal.
Passkeys can reduce the risk of phishing and stolen-password attacks because they are designed to be more resistant to the tricks attackers use to capture login details.
For many businesses, the sensible route is gradual:
use MFA on all important accounts
start with admin accounts, finance accounts and email accounts
use a proper password manager
move to passkeys where key services support them
remove shared passwords
review old accounts that no one uses anymore
This is not always glamorous work, but it is some of the most useful work a business can do.
Protect Microsoft 365 accounts, not just devices
Many attacks now start with a login rather than a virus.
That matters because a business can have antivirus on a laptop and still be exposed if an attacker gets into Microsoft 365.
Once inside, an attacker may try to:
read emails
add forwarding rules
create hidden inbox rules
access OneDrive or SharePoint files
impersonate a director or finance contact
abuse OAuth permissions
monitor payment conversations
launch further phishing attacks from a trusted account
That is why identity monitoring is becoming more important.
Endpoint protection still matters, but it should sit alongside Microsoft 365 account protection.
You can read more about this on our Huntress ITDR page and our Huntress Managed EDR page.
Patch devices and applications
Patching is one of those boring cyber security jobs that becomes very interesting after an attack.
Many successful attacks exploit known weaknesses where a fix already existed.
That means businesses need a clear process for keeping systems, devices and applications updated.
This includes:
Windows and macOS updates
browser updates
Microsoft 365 apps
third-party software
remote access tools
firewall and router firmware
old devices that are still connected to the network
Cyber Essentials also focuses heavily on secure configuration, supported software, access control, malware protection and security updates.
If you need help understanding what Cyber Essentials involves, we cover this on our Cyber Essentials support page.
Protect email properly
Email is still one of the main routes into smaller organisations.
That is not because staff are careless. It is because attackers know email works.
They use pressure, timing, impersonation and believable requests.
A good email security setup should reduce the chances of phishing emails, malicious links and dangerous attachments reaching people in the first place.
It should also sit alongside training, MFA, domain protection and account monitoring.
If your organisation relies on Microsoft 365 or Google Workspace, it is worth reviewing whether built-in filtering is enough for your risk level. We explain more on our Avanan email security page.
Back up cloud data
One of the biggest misunderstandings around Microsoft 365 is backup.
Microsoft keeps the platform running, but that is not the same as giving every organisation a separate, dedicated backup of its own business data.
Cloud data can still be lost through:
accidental deletion
malicious deletion
account compromise
ransomware
sync issues
overwritten files
retention gaps
mistakes during staff changes
A backup is not just about having another copy.
It is about knowing whether you can recover the right data, quickly enough, when something goes wrong.
For smaller organisations, Microsoft 365 backup is often one of the most practical resilience improvements they can make.
You can read more on our ConnectWise Cloud Backup for Microsoft 365 page.
Check your suppliers
GCHQ also talked about supply chains, dependencies and knowing who you are placing trust in.
That point should not be ignored. Your risk is not limited to your own laptops and email accounts.
It can also sit with:
IT providers
software platforms
finance systems
outsourced payroll
cloud services
marketing platforms
managed service providers
contractors
subcontractors
specialist suppliers
This does not mean every supplier needs to be perfect.
It does mean you should understand which suppliers have access to your data, systems, accounts or customers.
Useful questions include:
What data do they hold for you?
Do they use MFA?
Are they Cyber Essentials certified?
How do they protect admin access?
What happens if they are breached?
Can they prove they back up your data?
Do they have an incident response process?
Are they relying on another supplier you know nothing about?
For organisations that need to prove cyber maturity to clients or larger contractors, our Cyber Essentials supply chain page is a useful starting point.
Train staff without blaming them
Security awareness training is often handled badly.
Too much of it is dull, patronising or built around catching people out.
That approach misses the point.
Your staff are not the problem. They are often the people attackers are trying to rush, distract or manipulate.
Good training should help people spot warning signs in real situations:
fake invoice changes
spoofed supplier emails
malicious links
QR code scams
password reset tricks
Microsoft 365 login pages
fake file-sharing notifications
social engineering calls
urgent payment requests
Training also helps create evidence for insurance, compliance and client assurance.
You can see how we approach this on our CyberSmart Learn security awareness training page and our Huntress Managed Security Awareness Training page.
Keep evidence for insurers and tenders
Cyber security is not just about doing the right things.
It is also about being able to prove them.
That matters when you are:
applying for cyber insurance
renewing insurance
answering client questionnaires
bidding for contracts
working with schools, councils or larger organisations
trying to show board-level responsibility
dealing with an incident after something has gone wrong
Useful evidence might include:
MFA records
backup reports
patching reports
security awareness training records
Cyber Essentials certificates
incident response plans
email security configuration
endpoint monitoring reports
supplier checks
recovery test results
This is one reason we often talk about cyber security as a business process, not just a set of tools.
Prepared, not paranoid
The speech was delivered at Bletchley Park, GCHQ’s wartime home.
That setting matters.
One of the stories in the speech was about Alastair Denniston, the first Director of GCHQ, seeing what was coming and preparing for it. He focused on foresight, practicality and partnerships.
That is still a useful lesson for businesses today.
Cyber security should not be about panic.
It should be about being ready.
Ready to spot suspicious activity.
Ready to recover lost data.
Ready to answer insurer questions.
Ready to reassure clients.
Ready to deal with a compromised account.
Ready to keep operating when something goes wrong.
For smaller organisations, that rarely means building a large internal security team.
It usually means getting the right layers in place, using sensible tools, working with trusted partners and reviewing risk before there is a crisis.
A practical starting point
If you are not sure where to begin, start with these questions:
Are all important accounts protected with MFA or passkeys?
Do you know who has admin access?
Are your devices and applications patched?
Is your email security strong enough for modern phishing?
Are Microsoft 365 accounts being monitored for suspicious activity?
Is your cloud data backed up separately?
Could you recover quickly after deletion, compromise or ransomware?
Have staff had useful, recent cyber awareness training?
Have you checked your key suppliers?
Could you prove your controls to an insurer, client or tender assessor?
If the honest answer is “not sure”, that is the place to start.
Cyber security does not need to be dramatic.
It does need to be taken seriously.
GCHQ’s message was clear: businesses need to act now.
The best time to prepare is before the pressure arrives.
If you would like a practical review of where your organisation stands, Black Swan Cyber Security Solutions can help you identify the obvious gaps, prioritise the next steps and build a sensible cyber security plan around your risk, budget and compliance needs.
