It usually doesn’t start with alarms going off.
No flashing screens.
No dramatic “you’ve been hacked” moment.
Most of the time, it starts quietly.
A login from somewhere unfamiliar.
An email sent that no one remembers writing.
A file accessed late at night.
And by the time someone notices…
It’s already been going on for a while.
The first stage: access (and no one notices)
Most cyber incidents don’t begin with breaking (or havking) in. They begin with logging in.
That might be:
- A stolen Microsoft 365 password
- A phishing email that looked legitimate
- A reused password from another breach
- Missing or incomplete MFA
Once access is gained, there’s rarely any rush. Attackers take their time.
They:
- Read emails
- Learn how the business operates
- Identify who handles payments
- Look for sensitive data
At this stage, nothing looks obviously wrong.
No alerts.
No disruption.
Just quiet access.
The second stage: blending in
This is where it gets uncomfortable.
Because everything still looks normal.
The login appears legitimate.
The activity doesn’t trigger alarms.
But behind the scenes, someone is learning how your business works.
They might:
- Send emails from real accounts
- Set up inbox rules to hide replies
- Forward emails externally
- Create new admin users
This is often called “living off the land”.
They’re not smashing windows. They’re walking through the front door with a copied key.
The third stage: something changes
This is usually when businesses first realise something isn’t right.
It might be small at first.
A supplier questions a payment request.
A client asks about a strange email.
Someone spots activity that doesn’t add up.
Or it might be more obvious.
Files suddenly become inaccessible.
Systems slow down or stop working.
And in some cases…
A ransomware note appears.
If ransomware is involved
This is the scenario most people picture.
Systems locked.
Files encrypted.
A message demanding payment.
At this point:
- Access to systems may be gone
- Backups may be targeted
- Recovery becomes time critical
Every hour matters.
Because the business isn’t just dealing with IT issues. It’s dealing with disruption.
The real impact (beyond the headlines)
When people hear “cyber attack”, they often think about data.
But the real impact is usually operational.
It’s:
- Staff unable to work
- Systems unavailable
- Emails disrupted
- Day-to-day processes stopping
Then comes everything else:
- Lost time
- Recovery work
- Reputational concerns
- Potential data protection issues
For many small businesses, the biggest challenge isn’t the attack itself.
It’s the interruption.
What most businesses say afterwards
There’s a pattern you hear time and time again.
- “We thought we were alright”
- “We’ve never had an issue before”
- “We didn’t think we’d be a target”
And the one that sticks:
- “We didn’t realise how it actually happens”
Because it rarely looks like a “hack”. It looks like normal activity…
Until it isn’t.
How long does it take to recover?
There’s no single answer.
It depends on how quickly the issue is detected and how well the business is prepared.
In some cases:
- A few hours of disruption
- Minimal impact
In others:
- Days or weeks of recovery
- Systems rebuilt
- Data restored (if possible)
The difference usually comes down to three things:
- How quickly it was spotted
- How quickly someone responded
- Whether backups were usable
Where cyber insurance fits in
Cyber insurance can help with the aftermath. But it doesn’t stop the incident – and it won’t always cover everything.
Most insurers now expect certain controls to be in place, such as:
- Multi-factor authentication (MFA)
- Endpoint protection
- Email security
- Backup controls
If those aren’t in place, cover can be limited or declined.
Which is why more businesses are being asked about their security posture before getting cover.
What actually helps (in the real world)
It’s easy to focus on tools.
But what makes the difference is what happens around them.
Things like:
- Someone actively watching for unusual behaviour
- A clear response when something triggers
- Visibility across logins, devices, and activity
- Backups that are separate, secure, and tested
Not just having protection in place – but knowing what’s happening.
The question most businesses don’t ask
Most businesses don’t need to be perfect.
They just need to be aware.
Because attacks don’t usually announce themselves. They start quietly and build over time.
So the real question isn’t:
“Do we have cyber security?”
It’s:
If something started quietly…
would we know?
A practical next step
You don’t need to overhaul everything overnight.
But it’s worth understanding where things currently stand.
- Are logins properly protected?
- Is anything being actively monitored?
- Would unusual behaviour be spotted?
If the answer is “not really”…
That’s usually where a simple conversation starts.
No pressure.
Just clarity.
