If you employ five, ten or twenty-five people, you probably don’t need the same cyber security stack as a bank. You also need more than hoping Microsoft 365, antivirus and a decent password will see you through.
This is the difficult bit for smaller businesses – there are hundreds of cyber security products promising to stop ransomware, phishing, account takeover, data theft and everything in between. Start researching EDR, MDR, MXDR, ITDR, SIEM, XDR and DLP and it doesn’t take long before it feels like alphabet soup.
For a small business, more security isn’t automatically better security.
The aim should be proportionate protection: understanding what could realistically hurt your business, putting sensible controls around it and making sure somebody knows what to do when something goes wrong.
That matters because smaller organisations aren’t being ignored by attackers.
The UK Government’s 2025/26 Cyber Security Breaches Survey found that 42% of micro businesses and 46% of small businesses had identified a cyber breach or attack during the previous 12 months. Phishing remained the most commonly reported attack by some distance, affecting 38% of businesses overall.
The NCSC’s guidance for small organisations makes a similar point: being small doesn’t make you invisible. Its recommendations concentrate on practical areas including email, online accounts, devices, backups and spotting attacks.
So what does a 5–25 person UK business actually need?
Start with your business, not the software
A ten-person building contractor and a ten-person accountancy practice may have the same number of employees.
Their cyber risks may be very different.
The accountant could hold financial information, tax records, payroll data and access to client systems.
The contractor might depend heavily on email, Microsoft 365, supplier accounts, invoices and access to procurement frameworks.
A recruitment company could hold thousands of CVs.
A care provider may handle particularly sensitive personal information.
Before buying another cyber security product, ask:
What information would cause us the biggest problem if it was stolen?
Which systems would stop us operating if they were unavailable tomorrow morning?
What could somebody do if they took over one of our Microsoft 365 accounts?
Could a convincing fake invoice cause us to send money to the wrong bank account?
What security requirements do our customers, insurers, regulators or contracts place on us?
If something happened at 2:13am, who would actually notice?
Those answers should decide what you spend money on. Not the latest acronym.
1. Get the Cyber Essentials basics right first
For most small businesses, Cyber Essentials is a very sensible place to start.
The NCSC describes Cyber Essentials as the government’s recommended minimum cyber security standard for organisations of all sizes. It is built around five areas:
firewalls
secure configuration
security update management
user access control
malware protection.
Even if you don’t need the certificate, the controls provide a useful baseline.
If you cannot reliably answer questions such as:
Are unsupported devices still being used?
Are critical updates being installed?
Does everybody have administrator rights?
Is MFA enabled where it should be?
then buying more sophisticated monitoring probably isn’t the first problem to solve.
Cyber Essentials can also become commercially important. Some government and NHS contracts require suppliers to hold Cyber Essentials, Cyber Essentials Plus or demonstrate equivalent controls, depending on the contract and the information involved.
Best suited to:
Almost every 5–25 person business.
Look at something more advanced when:
You have already covered the basics and need better detection, monitoring or response.
2. Protect Microsoft 365 and your online accounts
For many small businesses, the most valuable computer system isn’t sitting in the office. It’s Microsoft 365.
Email, Teams, OneDrive, SharePoint and company files may all ultimately depend on one identity.
If an attacker gets control of that identity, traditional antivirus on the employee’s laptop may never see them.
That is why MFA should be treated as a basic control rather than an optional extra.
Access should also follow the principle of least privilege. Everyday users shouldn’t have administrator rights simply because it makes life easier, and administrative accounts should be separated from normal day-to-day accounts.
For businesses where Microsoft 365 is particularly important, Identity Threat Detection and Response (ITDR) can add another layer.
ITDR can help identify suspicious behaviour around accounts and identities, including activity that could indicate an account has been compromised.
Best suited to:
Businesses heavily reliant on Microsoft 365, particularly those handling money, confidential information or customer data.
Consider ITDR when:
A compromised Microsoft 365 account could create a serious financial, operational or data-protection incident.
3. Improve email security if email is where your risk lives
Phishing remains the most commonly identified cyber attack against UK businesses.
That shouldn’t be surprising.
Email is where businesses:
approve invoices
reset passwords
share documents
receive customer enquiries
speak to suppliers
arrange payments
receive Microsoft 365 notifications.
Modern phishing isn’t always an obviously fake email from an obviously fake address.
We increasingly see malicious messages arriving from genuinely compromised accounts.
Advanced email security can analyse links, attachments, behaviour, account reputation and other signals before a message reaches the user.
For organisations with significant email-based financial or data risk, this can be far more relevant than adding yet another endpoint tool.
Best suited to:
Businesses where email is central to payments, customer communication or confidential information.
Particularly worth considering for:
Accountants, financial services firms, recruitment businesses, conveyancers, payroll providers and other professional services organisations.
4. Use endpoint protection appropriate to the risk
Every laptop and desktop needs malware protection, but how far do you need to go beyond traditional antivirus.
At the simpler end, centrally managed endpoint protection gives you visibility over devices and helps prevent common malware.
Endpoint Detection and Response (EDR) goes further by looking for suspicious behaviour on devices rather than relying solely on identifying known malicious files.
Add a managed service and somebody can investigate those alerts for you.
That’s an important distinction.
Installing a security product that generates an alert at 2:13am isn’t the same as having somebody looking at that alert at 2:13am.
Best suited to:
Centrally managed endpoint protection should be standard for virtually every business.
Consider EDR or managed EDR when:
A compromised laptop could give an attacker meaningful access to company systems, customer data or cloud accounts.
5. Patch the software you’ve already bought
Sometimes the best new cyber security product is simply making sure the products you already have are up to date.
Attackers routinely exploit vulnerabilities in operating systems, browsers and applications.
The ICO specifically highlights actively managing software vulnerabilities, using supported software and applying software update policies as examples of appropriate security measures.
For a business with five laptops, somebody checking updates manually might just about work.
At fifteen or twenty-five devices, plus remote workers and applications such as Chrome, Adobe Reader and Microsoft Office, things become much harder to track.
Central patch and asset management can tell you:
what devices you have
what software is installed
whether it is supported
what needs updating
whether an update actually installed.
Best suited to:
Pretty much everyone.
Automated patch management becomes particularly useful when:
Devices are spread across multiple locations, staff work remotely or nobody has time to check them individually.
6. Don’t forget password management
Small teams often accumulate a surprising number of shared services.
Social media.
Suppliers.
Banking platforms.
Website administration.
Cloud services.
Wi-Fi.
Industry portals.
The dangerous shortcut is using one password across several of them, storing passwords in spreadsheets or passing credentials around by email.
A business password manager makes it easier to use long, unique credentials without expecting employees to remember dozens of them.
It also makes access easier to remove when somebody leaves.
Best suited to:
Any organisation with multiple online services.
It becomes particularly useful when:
Passwords are shared between employees or one person has become the unofficial keeper of every company login.
7. Back up what would hurt to lose
Backup sounds simple until you ask:
What exactly are we backing up?
A small business might need to consider:
Microsoft 365
SharePoint
OneDrive
servers
desktop files
line-of-business applications
databases
cloud platforms.
Microsoft 365 being in the cloud doesn’t automatically answer your backup and recovery requirements.
The right backup strategy depends on where your information sits, how quickly you would need it back and how much data you could afford to lose.
The NCSC specifically includes backing up important data as one of the key areas small organisations should address.
Just as importantly, backups need testing.
A backup that reports “successful” every night isn’t much comfort if nobody has ever checked that the data can actually be restored.
Best suited to:
Everyone who has data they cannot easily recreate.
Which is almost everyone.
Increase your resilience when:
Hours or days without your data would cause serious operational or financial damage.
8. Protect your email domain with DMARC
There are two separate email problems businesses often confuse.
One is somebody getting into your email account.
The other is somebody pretending to be you.
DMARC helps address the second problem.
Combined with SPF and DKIM, it helps receiving email systems determine whether a message claiming to come from your domain is authorised.
That can make it much harder for criminals to impersonate your business using your own domain.
This matters particularly where customers or suppliers trust emails appearing to come from you.
DMARC shouldn’t simply be switched straight to the strictest setting without understanding all the legitimate services sending email on your behalf.
Monitoring first allows you to identify those senders and gradually move towards enforcement.
Best suited to:
Any business that relies on its domain and email reputation.
Particularly valuable when:
Invoices, payment instructions or sensitive communications are routinely sent by email.
9. Add MDR or MXDR when you need somebody watching
This is where proportionality really matters.
Not every six-person business needs a sophisticated security operations centre.
Some absolutely benefit from managed monitoring.
MDR (Managed Detection and Response) normally combines security technology with people who investigate suspicious activity and respond when necessary.
MXDR (Managed Extended Detection and Response) can broaden that visibility across multiple areas such as endpoints, identity, email and network activity.
The value isn’t another acronym.
It’s having somebody watching.
Consider the difference between these two statements:
“Our security software generates alerts.”
and:
“A security team investigates serious alerts and can take action when something genuinely malicious happens.”
They’re very different outcomes.
MDR/MXDR becomes more proportionate when:
you hold sensitive customer information
downtime would be particularly costly
you work in a regulated sector
you provide services into larger organisations
your customers expect stronger security
cyber insurance requirements are increasing
nobody internally could investigate a security alert
the business operates outside normal office hours.
For a lower-risk microbusiness, this may be more than it needs today.
That’s fine.
Security should match the risk.
10. Build a reporting culture, not a blame culture
Technology won’t stop everything.
Somebody will eventually click something.
They may answer a convincing phone call.
They might approve a Microsoft authentication request they shouldn’t.
They could send information to the wrong person.
The important question is what happens next.
If employees fear being blamed, they may sit on a mistake and hope nothing comes of it.
That gives an attacker time.
Training should therefore be accompanied by a very simple message:
If something doesn’t feel right, tell us.
Quick reporting can be one of the most effective detection tools a small business has.
Security awareness training can help people recognise threats, but it shouldn’t become an excuse to transfer responsibility for cyber security onto employees.
People need layers around them.
So what does a proportionate cyber security setup look like?
There isn’t one package that’s right for every 5–25 person company.
A useful starting point might look something like this:
| Risk or requirement | Consider |
|---|---|
| Basic cyber hygiene | Cyber Essentials controls |
| Malware on laptops | Centrally managed endpoint protection |
| Known software vulnerabilities | Patch and asset management |
| Microsoft 365 account takeover | MFA + ITDR where appropriate |
| Convincing phishing emails | Advanced email security |
| Someone impersonating your domain | DMARC |
| Lost or encrypted data | Tested backups |
| Shared/reused passwords | Business password manager |
| Nobody monitoring security alerts | MDR/MXDR |
| Employees unsure what to report | Awareness training and a reporting culture |
The important word is consider.
You shouldn’t buy all ten because they’re on a list.
What about compliance?
Compliance should influence your security decisions, but it shouldn’t be the only reason you protect the business.
UK GDPR and data protection
UK data protection law requires organisations to put appropriate measures in place to protect personal data. The ICO describes this as a risk-based approach and specifically identifies measures including asset management, secure configuration, vulnerability management, managed devices, encryption and testing.
There isn’t a universal piece of software called “GDPR compliance”.
What is appropriate depends on the information you process and the potential impact if it is compromised.
Cyber Essentials
Cyber Essentials is the government’s recommended minimum cyber security standard and may also be requested by customers or procurement frameworks. Certain public-sector contracts require Cyber Essentials, Cyber Essentials Plus or equivalent controls.
Payment card information
If your organisation stores, processes or transmits payment card information, PCI DSS may apply. PCI DSS applies to merchants involved in payment processing regardless of company size, although the requirements for validating compliance vary.
Sector-specific requirements
Some organisations will have additional requirements because of what they do.
Schools, care organisations, financial services companies, public-sector suppliers and businesses handling particularly sensitive information may need to consider sector-specific standards, contractual obligations or regulatory requirements.
Your customers can also become part of the equation.
A five-person supplier working with multinational businesses may face stricter cyber security expectations than a twenty-person local company serving consumers.
Size alone doesn’t determine risk.
What should a 5–25 person business spend money on first?
Start with consequences.
If your Microsoft 365 account was compromised tomorrow, what could an attacker reach?
If every laptop was encrypted, how would you operate?
If someone changed the bank details on an invoice, would anybody notice?
If an employee reported a suspicious login at 8pm tonight, who would investigate it?
Those answers tell you far more than a product comparison table.
A very small, low-risk organisation may need little more than well-configured devices, MFA, patching, backups, good email controls and somebody taking responsibility for cyber security.
Another fifteen-person company handling financial information, managing hundreds of customer accounts or depending entirely on cloud systems may reasonably need EDR, ITDR, advanced email protection and 24/7 managed detection.
Both approaches can be right.
Enough security is a perfectly sensible goal
I’ve used the word enough in business for a long time.
Cyber security is no different.
You don’t need every product.
You don’t need the most expensive technology.
You need enough protection for the risks your organisation actually faces, enough resilience to recover when something goes wrong and enough visibility that an incident isn’t quietly developing for three weeks before somebody notices.
That’s what proportionate cyber security should look like.
Not sure what “enough” looks like for your business?
Black Swan Cyber Security Solutions works with founder-led small and micro businesses that don’t have their own cyber security team.
We can look at what you already have, where the genuine risks sit, your compliance or contractual requirements and where additional protection would actually make a difference.
No wall of acronyms. No assumption that you need every product we sell.
Book a free cyber security review and we’ll help you work out what is proportionate for your business.
