The threats hitting small and mid-sized UK businesses have changed. The old picture, a virus arriving in a dodgy attachment, is mostly obsolete. What we see day to day on the helpdesk is quieter, more targeted, and far more likely to start with a person than a piece of malware.
Here's what's actually landing, and what stops each one.
1. Business email compromise
The most expensive threat we deal with, and it involves no malware at all. An attacker gets into a mailbox, usually through a phished password, then sits quietly reading. They learn who pays invoices, how requests are phrased, and when the finance manager is on holiday.
Then they send a genuine-looking email from a genuine account asking for bank details to be updated. Because it comes from a real internal mailbox, every technical check passes.
What stops it: enforced multi-factor authentication, conditional access rules, mailbox rule alerting, and a hard internal policy that bank detail changes are verified by phone on a known number. Our Microsoft 365 support work starts with exactly these controls.
2. MFA fatigue and token theft
Attackers have adapted to MFA. Two techniques dominate: spamming push notifications until a tired user taps "approve", and adversary-in-the-middle phishing pages that steal the session token after a legitimate login.
What stops it: number matching instead of simple approve/deny prompts, phishing-resistant methods where practical, and conditional access policies that restrict sign-ins by device compliance and location.
3. Ransomware that steals before it encrypts
Modern ransomware groups exfiltrate data first, then encrypt. Even a flawless restore doesn't help if they're threatening to publish your client files. Entry is usually through exposed remote access, unpatched edge devices, or a compromised account rather than an email attachment.
What stops it: patching discipline, removing exposed RDP, endpoint detection and response, immutable offsite backups, and a tested recovery plan. Our ransomware readiness assessment is built around exactly this scenario, and there's more detail in our ransomware protection guide.
4. Supply chain and third-party compromise
You can run a tight ship and still be breached through a supplier, a managed service, or a browser extension. Attackers target the weakest link with access to many organisations.
What stops it: knowing which third parties hold your data and what access they have, reviewing supplier security annually, and applying least-privilege to every integration. This sits squarely in technology risk assessment territory.
5. AI-assisted phishing
The tell-tale signs people were trained on, clumsy grammar, odd phrasing, have gone. Phishing emails now read like your suppliers wrote them, and voice cloning has made "the MD phoned me" a credible attack vector.
What stops it: process over instinct. Verification steps that don't depend on whether an email "looks right", plus regular short training that focuses on urgency and payment requests rather than spelling mistakes.
6. Unpatched edge devices
Firewalls, VPN appliances and remote access gateways are internet-facing by definition. Vendors publish patches; attackers scan for anyone slow to apply them, often within days of disclosure.
What stops it: managed patching with reporting, and retiring end-of-life hardware rather than nursing it. We handle this as part of WatchGuard firewall support and proactive IT maintenance.
7. Ex-employee and dormant accounts
Accounts that were never disabled, shared logins nobody owns, and service accounts with old passwords and standing admin rights. Unglamorous, and a regular root cause.
What stops it: a documented leaver process, quarterly account reviews, and removing standing admin privileges.
Where to start
If you do nothing else this quarter, do these five things:
- Enforce MFA with number matching on every account, including admins and shared mailboxes.
- Confirm you have an independent, tested backup of Microsoft 365 and your servers.
- Patch every internet-facing device and set a schedule.
- Audit and disable dormant accounts.
- Write down your payment verification process and tell the finance team.
A Cyber Essentials certification covers most of the technical baseline and gives you something to show clients and insurers.
Getting a clear picture
Most breaches we're called into weren't sophisticated. They exploited something known and unfixed. If you'd like an honest assessment of where your gaps are, our cyber security consultancy team runs reviews for businesses across Birmingham, Solihull and the West Midlands, book a call and we'll go through it with you.