Updated November 2026.
Cyber attacks aren’t just a big-company problem. In the government’s latest Cyber Security Breaches Survey, 43% of UK businesses reported a breach or attack in the past 12 months. The good news? Most attacks on small businesses use the same handful of tricks – and most can be stopped with the basics done well.
1. Phishing and impersonation
Phishing is still the most common attack, reported by 38% of businesses. Emails pretend to be from Microsoft, a supplier or your own boss, and try to get someone to click a link or hand over a password.
How to stop it: advanced email filtering, regular staff training and phishing simulations, and multi-factor authentication so a stolen password isn’t enough.
2. Invoice and payment fraud
Criminals get into a supplier’s or customer’s email, watch the conversation, then send a genuine-looking invoice with new bank details. It’s one of the most expensive scams for small firms because the money is often gone before anyone notices.
How to stop it: always confirm changes to bank details by phone, using a number you already have – never the one in the email.
3. Ransomware
Ransomware locks your files and demands payment to unlock them. The 2025 attacks on Jaguar Land Rover, Marks & Spencer and Co-op showed how long the disruption can last – weeks, not days.
How to stop it: behaviour-based protection that can stop ransomware before files are encrypted, plus offsite backups you’ve tested restoring from.
4. Attacks through your suppliers
Your security is only as good as the companies you share systems and data with. Attackers increasingly go after IT providers, software suppliers and contractors to reach their customers.
How to stop it: ask your suppliers what security they have in place (Cyber Essentials is a good start), and give them only the access they need.
5. AI-powered scams
AI makes scams more convincing: phishing emails with no spelling mistakes, and even cloned voices on the phone asking for an urgent payment.
How to stop it: the same rule as invoice fraud – check any unusual request for money or data through a second channel, however real it sounds.
6. Old, unpatched systems
Any PC still running Windows 10 stopped getting security fixes in October 2025. Out-of-date software, routers and firewalls are an open door.
How to stop it: managed patching, regular vulnerability scans, and a plan to replace kit that’s past its supported life.
How Bandicoot can help
Our Protect package covers all six: email filtering, ransomware protection and rollback, staff training and phishing simulations, independent Microsoft 365 backups, vulnerability scanning and managed patching. Not sure where you stand? Take our free online cyber security audit or call us on 01282 506 617.
