What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A small business is not too small to be targeted: 46% of UK small businesses and 42% of micro businesses said they had identified a cyber breach or attack in the previous 12 months, according to the 2025/2026 Cyber Security Breaches Survey. Those figures cover incidents respondents could identify and were willing to report, so hidden attacks may be missed. Start by protecting email and important accounts, keeping devices updated, verifying unusual requests, testing backups, and deciding how you will respond. These practical steps follow the National Cyber Security Centre’s guide for small organisations.
Why small businesses need a basic security plan
In the 2025/2026 government survey, 38% of businesses reported phishing attacks in the previous 12 months; that figure is for businesses overall, not small businesses alone. Separately, the NCSC says 85% of cyber attacks against businesses start with a scam email, citing its 2026 spotting-attacks guidance. These are different measures and should not be read as a prediction of any one firm’s risk. The survey counts attacks organisations identified and reported, and says the true prevalence may be higher because some incidents remain hidden or go unnoticed.
Preparation is uneven: in the same survey, 41% of small businesses had undertaken a cyber-security risk assessment, 52% had a formal cyber-security policy, and 44% had a business continuity plan addressing cyber security. Each share was lower than the corresponding 2024/2025 result. A short written plan is useful even for a sole trader: it clarifies which accounts and data matter, how to keep operating, and who to contact if something goes wrong.
Prioritise these protections
- Protect email and critical accounts. Turn on passkeys where available; otherwise use a strong, unique password and 2-step verification.
- Update and protect devices. Install software and security updates, and use a standard user account for everyday work rather than an administrator account.
- Teach people to verify unusual requests. Check suspicious payment, login, or information requests using a known, official contact route.
- Back up the information you need to operate. Keep copies in a form that can be restored, and test the process.
- Prepare an incident plan. Decide who coordinates the response, how you will maintain essential work, and which stakeholders may need to know.
Secure email and business-critical accounts
A work inbox can expose private and banking information, let an attacker impersonate your business, and provide a route to reset passwords elsewhere. Protect it before less important accounts. Use passkeys where the service supports them. Otherwise choose a strong password that is not reused on any other service, and enable 2-step verification.
Recommended Free Tools
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Apply the same protections to accounts that could interrupt trading or expose sensitive information: banking, payroll, HR, online storage, domain and website hosting, social media, and point-of-sale systems. Give each person only the access needed for their role, and remove accounts or permissions when a staff member or supplier no longer needs them. The NCSC’s account and password guidance explains these measures.
On computers, use a standard user account for routine tasks and reserve administrator access for changes that require it. This limits what can be changed from an everyday account if it is compromised. Keep operating systems, apps, browsers, and security software updated; updates often address security weaknesses. The NCSC’s device guidance covers protecting the devices your organisation uses.
Help staff spot scams and verify requests
Phishing and other scams can arrive by email, text, or phone. A message may try to steal login credentials, bank details, or customer information, or persuade someone to transfer money. Train everyone who handles business accounts or payments to pause when a request is unexpected, urgent, or unusual.
- Do not use a link or phone number supplied in a suspicious message to verify it.
- Contact the organisation through its official website or a number you already know.
- Verify unexpected payment or bank-detail changes using a trusted, independent contact route before acting.
- Make it easy for staff to report a suspicious message or a mistake quickly, without fear of blame.
The NCSC puts it plainly: “If you have any doubts about a message, contact the organisation directly. Don’t use the numbers or links in the message – use the details from their official website.” Read its spotting cyber attacks guidance.
Rank #3
Back up business data so you can restore it
Choose the information you would need to keep trading or recover after an incident. Depending on your business, that may include website content, email, invoices, documents, contacts, and customer information. An online backup can suit a business with reliable internet access. If internet access is unreliable, an external hard drive or USB device may be useful. In either case, a storage device alone is not proof that a working backup exists.
For a device backup, keep the storage secure and disconnect it when it is not in use. If practical, keep both an online copy and a separate device copy so that one compromised account or connected system is less likely to affect every copy. Decide how quickly you need to restore essential work, then check that the backup contains the required data and that you can restore it. The NCSC’s backing-up guidance covers online and device options and checking recovery.
Rank #4
- BUSINESS CYBERSECURITY SOLUTION: SafeBiz is an advanced cybersecurity solution that protects your work network and safeguards your Business data and all internet connected devices in your business from cyber threats and hackers. SafeHome blocks phishing, malware, ransomware, online scams and dark web threats.
- ADVANCED THREAT PREVENTION: SafeBiz includes a Next-Gen Firewall, DNS Security, Web Filtering, Dark Web Protection, Geo-fencing and other AI Powered cybersecurity features protecting your Business and Sensitive Data from internet threats and hackers.
- BUSINESS DATA & IDENTITY SECURITY: Safeguards your Official and financial data, protecting them from online theft and unauthorized access.
- EASY SETUP: Connects effortlessly to any existing wireless router or internet connection, setting up in minutes without the need for any changes to your Business internet connection.
- HIGH SPEED CONNECTIVITY: Supports an aggregate throughput of up-to 4.3 Gbps, maintaining high-speed browsing and streaming performance for up to 128 devices.
Write an incident plan before you need it
Keep the plan short enough to use under pressure, and make sure the people who need it can access it if ordinary systems are unavailable. Include:
- Who identifies and coordinates the response, including a deputy if the main contact is unavailable.
- How the business will keep essential services running or communicate a temporary disruption.
- Which technical support contacts, suppliers, insurers, or other stakeholders may need to be involved.
- Where to find critical account and recovery information without relying on an affected device or inbox.
- How to record what happened and review recovery steps once the immediate incident is contained.
Rehearse the plan with a simple scenario, such as losing access to the work email account or files. Confirm that contact details are current and that the people responsible know what to do. The NCSC’s response and recovery guidance provides a sequence to follow; use it rather than improvising a universal playbook.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What to do if your business is attacked
If an attack is live, use the contact route in your plan, seek appropriate technical support, and follow the NCSC’s response-and-recovery steps. Consider which stakeholders are affected and how you will maintain essential work. The NCSC says businesses can call 0300 123 2040 for a live cyber attack; its service is available 24 hours a day, seven days a week. Check the official NCSC incident-reporting page for the current contact route and advice.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
