What’s new
MI5 is warning about hostile states. Should a small business be worried?
You’ve probably seen the headlines. The head of MI5 says threats from hostile states have quadrupled in ten years. Former security advisers are warning about attacks on energy, transport and air traffic control. And somewhere between the news and your Monday morning sits a quieter question: is any of this about us?
It’s a fair question, and it deserves a straight answer: what is the real risk, and how do you protect a small business from cyber attacks without spending a fortune?
Is a small business a target for a hostile state?
Almost certainly not directly. A government trying to disrupt the power grid has no reason to bother with a firm of twenty people.
That’s only half the picture, though. In his speech on 13 October, the head of MI5 said Russia has lost much of its own spy network and is increasingly paying criminals to carry out attacks on its behalf. He also said AI is making the contest between attackers and defenders more intense (BBC News).
Criminals aren’t fussy about size. They go for whoever has left a door open. The government’s own survey found that 43% of UK businesses reported a breach or attack in the last 12 months (UK government Cyber Security Breaches Survey 2025/2026). Most incidents turn out to be a nuisance rather than a disaster, but a small share are serious, and there’s no way to know in advance which kind you’ll get.
So the headlines aren’t about your business. The risk sitting behind them, ordinary criminal attacks getting a bit cleverer, is.
How we’d protect a small business from cyber attacks
None of this needs a big budget, and most of it matches the NCSC’s guidance for small businesses. This is the order we’d do it in:
- Turn on multi-factor authentication for email first. That’s a second step when you sign in, like approving it on your phone, so a stolen password isn’t enough on its own. Fewer than half of UK businesses (47%) use it consistently (Cyber Security Breaches Survey).
- Keep everything updated. Computers, phones, your router and your firewall. Most attacks use flaws that have already been fixed, so updates close the door before anyone walks through it.
- Back up your data, and test that you can restore it. A backup nobody has tried restoring is a guess. Keep one copy separate from your main systems, and the NCSC’s advice is to make backing up part of everyday business.
- Help your team spot a suspicious email, and make it safe to say “I clicked something”. People who fear blame stay quiet, and that’s when a small problem becomes a big one. Don’t leave it all with one person either.
- Write down what you’d do if something happened. Who you’d ring first, and how you’d get people working again. Only a quarter of UK businesses have a formal plan (Cyber Security Breaches Survey).
- Get an independent check. Cyber Essentials, the UK government scheme, tests that the basics are in place, and some customers and insurers now ask for it.
What we’d leave until later: specialist tools, and any sales pitch that starts with fear. The six steps above do more for a business your size than most of what’s sold.
Where we come in
If you’d rather not work through that list alone, it’s the day-to-day work of Cactus IT. We put these things in place to protect a small business from cyber attacks, check they’re working, and keep them that way, in plain English. For one financial services firm, that meant reaching Cyber Essentials Plus, the higher level that includes hands-on technical testing. You can read how that went here.
If this has you wondering where your business stands, get in touch. We’ll listen first, tell you honestly what we see, and only suggest what you actually need.
Sources: BBC News, MI5 chief warns of threats to UK from Russia, Iran and AI, 13 October 2026. UK government, Cyber Security Breaches Survey 2025/2026. National Cyber Security Centre (NCSC), Small Business Guide.