October is Cybersecurity Awareness Month, an international campaign that has run every year for more than two decades. It’s a timely prompt for everyone, from individuals at home to growing businesses, to check their defences and ask a harder question: if an attack got through tomorrow, could we recover?
For most UK organisations, cyber risk is no longer a question of if, but when. The good news is that a handful of simple habits stop a large share of attacks, and the right insurance means a breach doesn’t have to become a business-ending event.
Tips for individuals
Many business breaches start with one person’s account, so good personal habits protect your employer too.
- Use long, unique passwords. Three random words make a strong passphrase, and a password manager saves you remembering them.
- Turn on two-step verification for email, banking and social media. Your email matters most, as it’s the key to resetting everything else.
- Install updates promptly on your phone, laptop and apps. Updates fix the weaknesses criminals exploit.
- Pause before you click. Be wary of messages that create urgency, ask for payment or request login details. Check with the sender through a number you already know.
- Report scams. Forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726.
- Back up what matters — photos, documents and anything you couldn’t replace.
Tips for small businesses
You don’t need an IT department to make your business a much harder target.
- Get Cyber Essentials. This government-backed certification covers five core controls and shows customers and insurers you take security seriously.
- Protect email and finance accounts with two-step verification. These are the accounts criminals target first.
- Train your team. A short session on spotting phishing and fake invoices is one of the most cost-effective defences there is.
- Verify any change to bank details by phone, using a number you already hold, before paying a supplier.
- Keep backups separate from your main systems, and test that you can restore them.
- Write a simple incident plan: who to call, what to switch off and how to keep trading if systems go down. The NCSC’s free Small Business Guide is a good starting point.
Tips for medium businesses
As businesses grow, so do their systems, suppliers and staff, and with them the routes in for attackers.
- Give cyber risk a named owner at board level. Treat it as a business risk, not just an IT issue.
- Check your supply chain. Know which suppliers hold your data or connect to your systems, and build security requirements into contracts.
- Limit access. Staff should only reach the systems and data their role needs, and leavers’ access should be removed on day one.
- Test your incident response plan with a tabletop exercise, so everyone knows their role before a real attack.
- Assess AI tools before you adopt them. The government survey found only 24% of businesses using AI have processes to manage the cyber risks it brings.
- Consider Cyber Essentials Plus, which adds independent technical testing of your controls.
The picture in the UK
The government’s latest Cyber Security Breaches Survey, published in April 2026, shows how widespread the problem is:
- 43% of UK businesses, roughly 612,000 organisations, identified a cyber breach or attack in the past 12 months.
- Medium-sized businesses are hit hardest among SMEs, with 65% reporting a breach, compared with 46% of small and 42% of micro businesses.
- Small businesses are slipping on the basics. Only 52% now have a formal cyber security policy, down from 59% the year before.
- Only around 3 in 10 businesses carried out a cyber risk assessment in the last year.
The message is clear: attacks are common, and many smaller firms are less prepared than they were a year ago.
Why cyber insurance matters
Even well-protected businesses can be breached. Cyber insurance is designed to help you respond quickly and recover the costs when that happens. Depending on the policy, cover can include:
- Expert incident response: IT forensics, legal advice and support from specialists, often available around the clock
- Data and system restoration: the cost of recovering or rebuilding what’s been damaged
- Business interruption: lost income while you’re unable to trade
- Liability: claims from customers or third parties whose data was affected
- Notification costs: informing affected people and handling regulatory requirements
The habits above matter here too. Insurers increasingly ask about controls such as two-step verification and backups, so good cyber hygiene can make cover easier to obtain. Every policy is different, so it’s important to understand exactly what yours includes and excludes.
Not sure how exposed your business is? Our free Cyber Insurance Checklist 2026 is a quick guide to whether your business needs cover. Tick off how you use email, data, cloud systems and online payments to see your exposure, then read up on the top five cyber risks facing UK businesses and the real costs of an attack without insurance.
How Readhunt can help
At Readhunt, we know every business is different. We take the time to understand how you operate, where your risks lie and what you need from a policy, then help you find cyber cover that fits.
Whether you’re a small business arranging cover for the first time or a growing company reviewing an existing policy, we’ll guide you through the options in plain English.
This Cybersecurity Awareness Month, take one step to protect your business. Download our Cyber Insurance Checklist, and if you’d like a no-obligation cyber risk review or quotation, call us on 01709 278178 or email info@readhunt.co.uk.