Cyber security helps businesses protect their devices, systems and data from cyber-attacks. Awareness of good cyber security practices is an important part of reducing the risk.
So, what is cyber security? What can you do to protect yourself from becoming the victim of a cyber-attack?
In this article, we’ll give you a firm definition of what cyber security is, go over the most common types of cyber threats and explain what you can do to reduce the risk of a cyber-attack.
In broad terms, cyber security refers to all the actions and precautions we take to protect ourselves from a cyber-attack.
Cyber security covers the technology and procedures we use to prevent unauthorised access to our data and protect it from theft, damage or disruption. It protects our devices, like laptops, desktop computers, mobile phones and tablets. It also helps keep the services we use online secure and available.
You might think your cyber security practices are acceptable because you’ve never been targeted by hackers. However, attacks can go undetected, so a lack of known incidents is not proof that your systems are secure.
Any business or individual can be the victim of a cyber-attack. The Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the previous 12 months. Fieldwork ran from August to December 2025, and the findings cover incidents organisations detected and reported. (DSIT and Home Office, 2026)
The survey found that 30% of businesses had carried out a cyber security risk assessment in the previous year and 81% had updated malware protection. Among businesses identifying a breach or attack, 29% experienced them at least weekly. (DSIT and Home Office, 2026)
The damage can extend beyond stolen money or data. In April 2025, Marks & Spencer reported that its cyber incident had disrupted contactless payments and Click & Collect, with some processes moved offline to protect the business. (Marks & Spencer, 2025)
For businesses identifying a breach or attack, the median perceived cost of the most disruptive incident was £0, rising to £560 where an outcome such as lost money or data occurred. The 2026 survey stopped publishing mean costs because the estimates were highly skewed. These medians do not rule out severe losses. (DSIT and Home Office, 2026)
If you’re not paying enough attention to cyber security, it could cost you dearly. Reducing the risk starts with knowing what types of cyber threats to look for.
Our Cyber Security Training course provides a thorough understanding of the key aspects of the General Data Protection Regulation, data security levels and different types of threats that organisations or workplaces may face.
Cybercrime includes crimes targeting computers and networks, as well as offences such as fraud that technology enables.
Many methods used by cybercriminals aren’t sophisticated. Attackers may exploit trust, urgency or authority, as well as technical weaknesses. Technology allows them to commit these offences on a larger scale. The information stolen by attackers can be sold, used to steal money or used to commit identity fraud.
Cyber threats businesses should understand include:
The sections below explain how these threats work and where they overlap.
Phishing is one of the most common forms of cyber-attack: 38% of all businesses surveyed identified phishing in the 2025/2026 survey. (DSIT and Home Office, 2026) In a phishing scam, the attacker sends an email, text or instant message that looks like it’s from a legitimate company, such as your bank. The message may ask you to follow a link and enter personal details, open an attachment or make a payment.
The problem is that the website you reach may be fake, even though the message looks legitimate. Creating a copy of a genuine site is website spoofing; attackers may also use misleading or lookalike domain names.
Once you’ve put your details into the spoofed website, the scammer can use them to try to access your accounts or commit fraud. Phishing can also result in a person’s computer being infected with malware. (NCSC phishing guidance)
Common phishing methods include:
For workplace examples and verification checks, see our guide to phishing and impersonation fraud.
Generative AI can help criminals produce convincing phishing messages and impersonate trusted contacts. The NCSC’s 2025 assessment identifies social engineering and basic malware generation among the activities AI can support. Its June 2026 statement warns that AI is accelerating the speed and scale of cyber threats. (NCSC AI assessment, 2025; NCSC AI statement, 2026)
Deepfake fraud uses AI-generated or manipulated audio and video to impersonate real people. For example, a caller who sounds like a director might instruct an employee to transfer money urgently. Familiar voices or faces should not replace independent verification. (NCSC New Zealand, 2025)
Check unusual payment requests and changes to bank details through an established contact route, such as calling a number already held in company records. Apply the normal approval process even if the request appears to come from a senior colleague.
Malware is a catch-all term for software designed to cause damage or steal information. It includes viruses, trojans, spyware and ransomware. Computer viruses are self-replicating code that attaches to legitimate files or programs and spreads when infected code runs. A trojan is software that looks legitimate but carries out malicious activity; it does not have to contain a virus.
Malware can be delivered through a compromised website, a program you’ve downloaded or an attachment you’ve opened. A fake shopping website is not itself malware, although it may be used to deliver malware or commit fraud.
Ransomware is a type of malware that can encrypt files or lock users out of systems. Attackers demand payment to restore access and may also steal data and threaten to publish it. An attack can disrupt a single device or an entire network. There’s no guarantee, of course, that paying the ransom will restore access or prevent stolen data being leaked. (NCSC ransomware guidance)
Read more about ransomware and other cyber threats to small businesses.
Spyware often has no obvious visible impact on a computer. Spyware can look completely legitimate and may even perform a function. Or it may just sit quietly in the background. However, it secretly monitors activity or collects information and sends it to another party.
Adware is software that displays advertisements and may be unwanted or intrusive. It is different from malvertising, where attackers use online adverts to direct people to scams or deliver malware. Even familiar branding does not prove that an advert is safe.
A distributed denial of service (DDoS) attack overwhelms a website, server or network with traffic from multiple sources. It may use a network of compromised computers or other connected devices, known as a botnet, to overload the service and make it unavailable to legitimate users.
Sometimes DDoS attacks are accompanied by demands for money. They may also be carried out to disrupt an organisation for political reasons or simply to cause harm.
In a man-in-the-middle attack, a criminal intercepts and may alter communications between two parties. Cybercriminals may exploit a weakly protected or insecure Wi-Fi network to intercept unencrypted traffic. Like spyware, a man-in-the-middle attack can be challenging to detect.
Protecting your business from cyber-attacks requires a combination of technical safeguards, clear procedures and staff awareness. No single measure removes every risk. Follow the tips below to improve your cyber security:
Never use simple or reused passwords. Use a reputable password manager permitted by your organisation to generate and store strong, unique passwords. Browser-based password managers can be appropriate when configured and used securely. Never share your passwords. (NCSC password guidance, 2025)
Use passkeys where available and supported by your organisation. Where passwords remain in use, enable multi-factor authentication (MFA), such as two-step verification, especially for email, finance and administrator accounts. (NCSC account guidance, 2026)
Regularly updating your software helps fix security weaknesses that attackers could exploit. Install security updates promptly, enable automatic updates where appropriate and replace software that no longer receives security support. (NCSC device guidance, 2026)
Make regular backups of all your important data and store them in a different place. Keep a copy offline or use a backup service that protects copies from alteration or deletion during an attack. A drive permanently connected to the network can also be attacked. Test that data can be restored. (NCSC ransomware guidance)
Ensure suitable antivirus or endpoint protection and firewalls are enabled, correctly configured and kept up to date. Limit administrator access to people who need it. If necessary, speak to an IT expert for advice.
If you feel like a website or a message isn’t legitimate, don’t click on links within it or open its attachments. Never give out information if you’re unsure who you’re communicating with. Verify unusual payment or account-change requests through a trusted contact route, using details already held in your records.
Scam messages or websites may have odd phrasing, incorrect logos or small mistakes in a web address. However, polished language and familiar branding are not proof of authenticity. AI-generated messages may lack the errors people previously relied on spotting. Report suspicious messages promptly through your organisation’s agreed process.
Make sure your Wi-Fi network and router administration are protected by strong, unique passwords, current security settings and firmware updates. For remote work, follow your organisation’s connection policy and use its approved VPN where required. Avoid sensitive work on networks you do not trust.
Providing people with clear guidelines and practices will help protect them against cyber criminals. Use our guide to writing a cyber security policy to develop rules for your business and ensure all your staff understand and follow them. Cover access permissions, payment verification, approved AI tools, remote working and incident reporting, with named responsibilities and regular reviews.
Technical controls can reduce how many malicious messages and websites employees encounter, but some threats will get through. Teach your people the cyber security practices relevant to their roles, including how to verify unusual requests and report suspected incidents quickly. Make reporting straightforward and supportive, even when someone has already clicked a link.
Maintain and rehearse an incident response plan so staff know who to contact, how to escalate a suspected attack and who is responsible for restoring services.
The internet is a fantastic tool, but it is also rife with security risks. Educating your people on cyber security can help them recognise and report threats. This awareness needs to work alongside technical safeguards, management oversight and tested response procedures.
Human Focus Cyber Security Awareness Training helps your team recognise common cyber security threats and understand steps to reduce the risk. This online course can be taken at your convenience. It supports staff awareness as part of your organisation’s wider cyber security arrangements.
