Security

How not to get hacked: the basics that matter most

Robert Edmonds · November 2026 · 9 min read

You don't need to be a large organisation to be a target. The government's 2025/26 Cyber Security Breaches Survey found that 43% of UK businesses had a cyber security breach or attack in the previous 12 months. Phishing was the most common, affecting 38% of businesses.

Most attacks aren't sophisticated. They rely on someone clicking, an account without MFA, or a system that hasn't been updated. These are the basics that make the biggest difference.

1. Be suspicious of messages that ask you to act

Phishing emails, texts and calls try to get you to click a link, open an attachment, enter a password or make a payment. The warning signs are usually urgency, an unexpected request, or a change to how things normally work.

• Never act on a change of bank details by email alone. Phone the supplier on a number you already have, not one in the email.
• Check requests from senior staff to make urgent payments or buy gift cards, using a different channel.
• Don't enter your password after clicking a link in an email. Go to the site directly instead.
• Report suspicious emails by forwarding them to report@phishing.gov.uk, and suspicious texts to 7726. Tell your IT team too.

Make it easy and blame-free for staff to report something they clicked. The sooner it's reported, the less damage it does.

2. Lock down your accounts

Use passkeys where services support them, and two-step verification everywhere else, starting with email. A stolen password is far less useful to a criminal when it isn't enough on its own. I cover this in detail in Passwords and MFA.

3. Keep everything up to date

Updates fix the security holes attackers use. Turn on automatic updates for operating systems, browsers and apps, on phones and tablets as well as computers. Replace anything that no longer receives updates.

4. Look after your devices

• Use the built-in antivirus and keep it switched on.
• Set screen locks and encrypt company laptops, so a lost device doesn't mean lost data.
• Manage company devices centrally, for example with Microsoft Intune, so settings are enforced and a lost device can be wiped.

5. Give people only the access they need

Staff shouldn't use admin accounts for everyday work. If an everyday account is compromised, the damage is limited. Review who has access to what, and remove access for leavers on their last day.

6. Have backups you can restore

If the worst happens, a working backup is what gets you running again without paying a ransom. Attackers know that, so they go after backups too. See Backup: one isn't enough.

7. Plan to be hacked

This is the best defence of all. Almost anything can be hacked, so after passwords and backups, the most valuable thing you can have is a plan to recover, written before you need it.

A good plan covers systems:

• The order you'll bring systems back, and how long each takes to restore
• A ready-made holding page for your website that can go live on a different host, buying you time while the real site is restored
• Contact details for your IT provider, key suppliers, insurer and bank

And just as importantly, it covers people:

• Who does what, and who has authority to make decisions
• Who speaks to the media, if that's relevant, and who speaks to customers
• Who keeps staff informed, so they know what's happening and what to say
• How you'll communicate if your systems are down. If your Microsoft 365 tenant is compromised, your email and Teams may be unavailable or untrustworthy. Agree an alternative in advance, such as a phone list kept off your systems or a separate messaging group.

Then test it. Walk through a scenario with the people involved and see what breaks. The NCSC's free Exercise in a Box is designed for exactly this. A plan nobody has rehearsed is a plan that won't work on the day.

8. Make it someone's responsibility

Security works best when someone senior owns it. The 2025 breaches survey found that only 27% of businesses had a board member responsible for cyber security, down from 38% in 2021. Cyber Essentials, the government-backed scheme, is a sensible baseline to measure yourself against.