If you run a small or micro-business, you probably rely on technology more than you realise.
Your business may run on email, Microsoft 365, cloud software, online banking, shared documents, mobile phones and laptops. You may send invoices, store customer information, manage staff records, use supplier portals and hold sensitive business data.
You may not have a large team, an IT department or a board of directors.
But if your systems stopped working tomorrow, it would still hurt.
That is the part that often gets missed.
Many MSPs, IT providers and cyber security companies prefer to work with businesses once they reach a certain size. For some, that might mean 20 users. For others, it might be 30, 50 or more.
That approach makes sense for them. Larger clients are often easier to package, support and manage at scale. But it leaves many smaller businesses in a difficult position.
You still face cyber risk, but the support available to you is often either too basic, too expensive, too complex or simply not designed for the way your business works.
Small does not mean low risk
For a long time, many small business owners believed they were unlikely to be targeted.
You may think attackers are only interested in banks, large companies, councils, schools or household names. You may look at your own business and think, “Why would anyone come after us?”
The problem is that many modern cyber attacks do not work like that. A lot of cyber crime is automated.
Criminals can scan the internet for vulnerable systems. They can test stolen passwords against Microsoft 365 accounts. They can send phishing emails at scale. They can create convincing fake login pages using ready-made kits. They can look for old software, weak passwords, exposed remote access and accounts without strong security controls.
They are not always looking for the biggest business. They are often looking for the easiest way in.
That could be an email account without multi-factor authentication. It could be a weak or reused password. It could be a missing security update. It could be an unprotected inbox, an untested backup or a device that nobody is monitoring.
You do not need to be a large organisation to be caught by an automated attack.
You just need to be exposed.
The impact is personal when it is your business
In Skin in the Game, Nassim Nicholas Taleb writes about the importance of carrying the consequences of decisions.
For small business owners, that is not an abstract idea. You already know what skin in the game feels like.
If your email account is compromised, you may be the person who has to explain it to customers. If an invoice is intercepted and payment goes to a criminal, you may be the person who has to deal with the loss. If your files are encrypted, your inbox is locked or your systems are unavailable, you may be the person working late into the evening trying to keep the business moving.
In a larger organisation, a cyber incident may become a board paper, a project plan or an insurance claim.
In a founder-led business, it can feel much closer. It is your name, your reputation, your customers, your cash flow and your sleep on the line.
That is why cyber security for smaller businesses needs to be practical, clear and proportionate. It cannot be based on scare tactics, jargon or oversized projects. It has to help you make better decisions with the time, money and people you actually have.
You should not need to be an enterprise to access better protection
Larger organisations often have access to stronger cyber security tools.
They may use managed detection and response, advanced email security, Microsoft 365 backup, patch management, identity protection, DNS protection, security awareness training and incident response planning.
Smaller businesses are often offered a much thinner version.
A basic antivirus licence. A few settings in Microsoft 365. Some general password advice. A backup that may or may not have been tested. Maybe an annual reminder to watch out for phishing emails.
That may have felt enough in the past. Today, it often is not.
You do not need enterprise complexity, but you do need proper protection.
You need to know that your email is better protected against phishing, business email compromise and invoice fraud. You need your devices monitored for suspicious activity. You need your Microsoft 365 data backed up properly. You need known software weaknesses patched before attackers can use them. You need staff training that helps people spot problems without making them feel blamed.
Most of all, you need someone to help you understand what matters first.
Not everything is urgent. Not every product is right for your business. Not every small business needs the same setup.
Good cyber security starts with understanding what you rely on, what could hurt you most and what sensible controls would reduce the risk.
The right support should fit your size
If you run a small business, you should not have to choose between doing almost nothing and buying an enterprise-level solution you do not need.
There is a middle ground.
For some businesses, the right starting point may be Cyber Essentials. For others, it may be stronger Microsoft 365 security, better email protection, managed endpoint detection, reliable backup, patch management or simple security awareness training.
The right answer depends on your business.
A nursery does not have the same risks as a building firm. A care provider does not work in the same way as an accountant. A parish council does not need the same setup as a recruitment agency. A founder-led company with five users needs different support from a 200-person organisation with an internal IT team.
That is why cyber security should be built around the business, not forced into a package designed for someone else.
Cyber security should start where the risk starts
Cyber security should not only become serious when a business reaches 20 users.
The risk starts much earlier than that.
It starts with the first customer record.
The first invoice.
The first staff account.
The first shared mailbox.
The first laptop.
The first supplier portal.
The first time your business depends on systems working properly.
If losing access to email, files, invoices or customer data would cause you a problem, then cyber security already matters.
You do not need scare tactics.
You do not need enterprise jargon.
You do not need to buy everything at once.
You need clear advice, sensible tools and support that fits the size of your business.
Because small businesses are not too small to protect.
They are often the businesses with the most skin in the game.
