Most conversations about cyber security are about stopping something from happening. Better passwords, MFA, email protection, endpoint security, updates... all very important. But there’s another question that businesses don't always spend quite as much time thinking about... What happens if something gets through anyway?
Perhaps an employee's Microsoft 365 account is compromised. A laptop starts behaving strangely. Files suddenly become inaccessible. Someone clicks a convincing phishing link and enters their password before realising what they've done.
Who does your team call? What gets disconnected? Who checks whether company data has been accessed? And could you recover the systems and information you need to keep working?
If the answer is a slightly uncomfortable silence, it might be worth having that conversation now.
A cyber incident doesn't automatically mean your entire business has been compromised. What matters is identifying what's happened and responding quickly. If somebody thinks they've clicked something suspicious, entered their password into a fake website or opened a questionable attachment, you want them to tell your IT team straight away.
Not tomorrow. Not after they've waited to see whether anything odd happens.
Creating a culture where people are comfortable reporting mistakes is important. The quicker your IT team knows about a potential incident, the quicker they can investigate it and, if necessary, contain it.
Depending on what has happened, your IT team might need to isolate a device, reset a password, revoke Microsoft 365 sessions or block an account while they investigate. This is one of the reasons we talk about layered cyber security.
Endpoint Detection and Response, for example, can help identify suspicious activity on a device and allow action to be taken quickly. Good Microsoft 365 security can help protect accounts, while monitoring can give your IT team much better visibility of what's actually happening across the network.
The aim isn't to assume that every security measure will fail. It's to make sure one failure doesn't automatically become a much bigger problem.
Backups aren't particularly exciting... until the day you need one! Think about the systems your business genuinely relies on. Your files are an obvious starting point, but what about Microsoft 365, business applications, databases and servers. Then there's the slightly more important question: when did somebody last check that those backups could actually be restored? A successful backup notification is reassuring. Being able to recover the information you need is what really matters.
This can become surprisingly confusing during an incident. Who contacts your IT provider? Who tells management? Who deals with customers if services are affected? Who decides whether your cyber insurer needs to be contacted?
Depending on what has happened, there may also be reporting obligations. The Information Commissioner's Office provides guidance on personal data breaches, while the National Cyber Security Centre has advice on responding to and reporting cyber incidents. You don't necessarily need a 40 page disaster recovery manual that nobody will ever read. A clear, practical incident response plan that people actually understand is far more useful.
It's easy to assume cyber criminals are mainly interested in large organisations with enormous IT budgets. The UK Government's latest Cyber Security Breaches Survey found that 43% of businesses identified some form of cyber breach or attack during the previous 12 months. For small businesses it was 46%, and for medium businesses it rose to 65%. GOV.UK. Phishing remained by far the most commonly identified type of attack.
That doesn't mean businesses should panic. It means having a sensible plan for prevention, detection and recovery is now simply part of running a business.
At your next management meeting, ask :
“If we discovered we'd been compromised at 10am tomorrow, what would we do?”
You don't need everybody to know the technical answer. They should know who to contact, though, and the people responsible for your IT should know what happens next.
If you're not sure how quickly you'd detect a problem, what your backups cover or how your business would respond, that's something we can help you work through.
Our job isn't just keeping the technology running when everything is behaving itself. It's making sure you've got a plan for the days when it isn't 😊
📧 support@espi.net
📞 01954 213999
➡️ Endpoint Detection & Response (EDR)
➡️ Phishing Emails Are Getting Better. Here's What Your Team Should Be Looking For 🎣
