𝓤𝓷𝓲𝓽𝓮𝓭 𝓝𝓮𝔀𝓼

Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Membership today.

Join today

Already a member?
Log in

Hacking has been a risk for small business for a couple of decades, but the threat has increased over time.

The rise of artificial intelligence has made cyberattacks much easier, more frequent and lowered the technical knowledge required, so the risk to founders and firms has jumped in the past couple of years.

Amid the global breakdown in cyber security with the PHP vulnerability emerging, it’s more important than ever that SME owners are able to ensure their company – and their clients’ details – remain safe and secure.

There are many ways in which hacking can damage a business, from stealing customer data to outright theft of money from company bank accounts.

High profile examples of recent hacks include the Jaguar Land Rover attack in August 2025, a hack of Marks & Spencer’s systems in April that same year and a customer data breach of Manchester Airports Group earlier in 2026.

To combat these risks, cybersecurity expert Conor O’Neill, co-founder and CEO OnSecurity, has provided small business owners with his top tips.

Encrypting customer and payment data

Making sure your data is encrypted is a crucial first step.

“If encrypted data is stolen in a cyberattack, it will be unreadable without the decryption key, preventing attackers from accessing or exploiting the information,” O’Neill said.

Staying up to date when this type of software improves is also important.

Using multi-factor authentication

You should not be relying on just a password to keep accounts safe.

Everything you need to build, launch and grow online

LEARN MORE

ADVERTISEMENT

Everything you need to build, launch and grow online

LEARN MORE

ADVERTISEMENT

Multi-factor authentication could come in the form of an extra login step through a phone app, a text or a confirmation button on email.

“This adds an extra layer of security by requiring users to provide more than one form of verification when logging in, leaving stolen passwords useless.” said O’Neill.

Running regular security audits

Running security tests and audits might require some specialist help, but it is well worth doing.

O’Neill said: “Organisations need to ensure their most critical assets are secure through regular penetration testing, to assess for vulnerabilities before they are exploited.”

Training staff to spot threats

As with many aspects of running a business, training staff up well is key.

“Staff must be properly trained to recognise the signs of cyberattacks to easily identify attempts and report them immediately,“ O’Neill said.

“When employees consistently recognise suspicious behaviour and report it quickly, organisations gain early warning of attacks, reducing the number of successful breaches and creating a culture where security is everyone’s responsibility.”

Keeping systems and software up to date

Updating to the latest software is always a good idea, whether you run your own business or not.

“Outdated software can contain weaknesses that attackers may exploit to gain access to systems,” O”Neill said.

If you’re not confident about how to regularly check in on the software you use, most let you simply auto-update whenever the providers push out a new release.

Creating an incident response plan

“Having a response plan in place means businesses can act quickly if a cyberattack occurs, and should include how to identify, contain and respond to an incident, alongside who is responsible for each stage,” said O’Neill.

“This helps to limit the disruption caused and protect systems.”

It’s impossible to know when or how an attack on your firm might occur so – similar to training staff – it’s important everyone is clear on how to respond if and when it happens.

“As AI makes cyberattacks faster and increasingly more difficult to detect, businesses need to proactively prevent and prepare for potential hacks,” he added. “A combination of technology, processes and training can help companies to mitigate the risk of attacks and enhance their resilience.”