Cyber security without an IT department

Key takeaways

Cyber security without an IT department is manageable if someone owns it. The DSIT Cyber Security Breaches Survey 2025/2026 found 43% of UK businesses reported a breach or attack in the previous year. Five basic controls, set out by the National Cyber Security Centre, stop most common attacks, and none needs a specialist.

• 43% of UK businesses reported a cyber breach or attack in the last year.
• 5 controls: firewalls, secure settings, updates, access control, malware protection.
• Phishing is the most common type of attack.
• Name 1 owner and give them an hour a month.

Who looks after security when there is no IT team?

When there is no IT team, security falls to whoever is most technical, on top of their real job, or to nobody. The business is still responsible. The first step is not a tool but a named owner with a short list and a regular slot to work through it.

• The hidden costs of doing everything in-house
• DIY IT support in a small business: the hidden costs

What are the five basic controls?

The government-backed Cyber Essentials scheme sets out five technical controls that protect against the most common internet attacks.

• Firewalls: protect your internet connection.
• Secure configuration: remove default passwords and unused accounts.
• Security updates: keep devices and software patched.
• User access control: give people only the access they need.
• Malware protection: use built-in or reputable antivirus tools.

• Sharing passwords at work: the risk and the fix

What does a breach cost a small business?

A breach costs time first: days spent restoring systems, resetting accounts and reassuring customers. It can also cost lost work, regulatory reporting and, for payment fraud, the money itself. For a business doing everything in-house, the same few people who would fix the breach are the ones needed to keep trading.

• A business continuity plan for a small business

What can you do in an hour a month?

An hour a month, spent consistently, covers the essentials.

• Check updates are installing on every device.
• Confirm backups ran and test restoring one file.
• Review who has admin access.
• Remove accounts for leavers.
• Remind staff how to report a suspicious email.

• Shadow IT in a small business: risks and fixes

When do you need outside help?

Bring in help to set things up properly, to achieve Cyber Essentials certification if customers require it, after any incident, and when you hold sensitive data. Ongoing basics can stay in-house with a named owner. Anyone handling your data on your behalf should meet the same standards.

• Data security with an outsourced team

What do attacks on small businesses look like?

Most attacks on small businesses are ordinary and automated.

• Phishing emails that capture a login.
• Fake invoices or requests to change bank details.
• Reused passwords tried against email and cloud accounts.
• Malware arriving through an attachment or download.
• Outdated website software exploited by a scanner.

• Website security for small businesses

What does the basic setup cost?

The basics cost little. Automatic updates and built-in malware protection are free. Two-step verification is free on most services. A password manager and cloud backup together cost a few pounds per user per month. The real cost is attention: an hour a month from a named person. Cyber Essentials certification, if a customer requires it, has a modest assessment fee that depends on the size of the organisation.

What should staff know?

Staff need to know three things: how to recognise a suspicious message, who to tell, and that they will not be blamed for reporting a mistake quickly. Most successful attacks depend on someone clicking and then staying quiet. A ten-minute briefing twice a year, with real examples, does more than a long policy nobody reads.

What should you do in the first hour of an incident?

Change the affected passwords, sign out other sessions, and disconnect any infected device from the network. Tell your bank immediately if money or payment details are involved. Write down what happened and when. The National Cyber Security Centre's guidance on response and recovery sets out the steps for small organisations, and it is worth reading before you need it.

• A business continuity plan for a small business

What does this look like in practice?

A pattern we see in small firms: laptops postpone updates for months because restarts are inconvenient, backups go to a drive in the same office, and the only administrator is the owner. Each is a ten-minute fix that nobody was asked to do.

• See client work
• BPO Solutions for UK businesses

Cyber security checklist

Start here.

• Name a security owner.
• Turn on automatic updates everywhere.
• Enable two-step verification on email.
• Set up backups stored separately.
• Limit admin rights.
• Brief staff on phishing.
• Read the NCSC Small Business Guide.

• The hidden cost audit: score your business in an hour

Next step

If security is one of the reasons you keep work in-house, tell us your concerns. We will walk you through how access, devices and data are controlled in a managed team, in a 30-minute call.