Small Businesses Are the Prime Target for Cyber Attacks. Most Still Don't Believe It.

Five practical steps every small and medium business should take before, not after, the breach.

By Jay Ball, CEO of Flotek Group

I meet business owners every week, and very few take cyber security seriously until they have already been breached. That is the honest pattern.

The conversation almost always starts the same way. How much is your IT support? Rarely does anyone ask the more important question, which is how do you keep my business secure.

Small and medium businesses are not flying under the radar. They are the radar. Smaller security budgets, less mature processes, and a quiet belief that attackers are aiming at someone bigger. That belief is what gets exploited.

The breach that changes the conversation

A while back, I sat with a partner and recommended they move to managed detection and response. We run it as a service called CyberGuard. They told me the budget was not there. Fair enough.

Several months later, they suffered a major breach. Ransomware took their team offline for three weeks. We rebuilt servers from backup, restored databases, and reactivated out-of-date software. Their insurance provider commented on how well our team had handled it. That was the moment they started listening to advice.

It is a story I have watched play out more times than I would like to admit.

The seven percent problem

Every month, we run a free cyber security webinar. Genuinely free, open to anyone, and a real investment of our time. We regularly get 200 plus attendees, and across a year we see around 1,000 unique people come through it.

We support roughly 15,000 people across our managed IT base. That means around 7% of the audience we serve are actively engaging with cyber education.

The other 93%? Many of them will land on that webinar within weeks of a breach, with their whole team booked in. By then, the damage is already done.

The industry keeps shouting about it. Breaches, ransomware, stolen data sitting on the dark web for sale. And still the most common question I get is how much your IT support costs, not what you actually do to keep my business protected.

Not everyone is like this. Plenty of business owners are switched on and want to do the right thing. But the majority still quietly assume it will not happen to them. I am still seeing businesses running Windows 10 with no plan to move. I have even had organisations come to us still running Windows 7, because their core software only works on it. That is a problem you cannot keep ignoring.

Five things to do about it

If I could give a business five practical things to do, this is where I would start.

1. Get proper email security in place

Microsoft does a lot of things brilliantly. Their built-in email security is not one of them. We use Check Point, which sifts out spam but more importantly keeps inboxes clear of phishing and ransomware. Yes, it can occasionally hold back an email you wanted. With a hit rate around 99.9%, that small bit of friction is worth it. As I always say, it is easier to leave my house and car open so I do not need to carry keys, but the risk is not worth it.

The other side of email security is your team. Even great filtering does not catch everything, and humans are still the most common point of failure. We run phishing simulations that send realistic test emails to your team and flag who clicks, who reports it, and who needs more training. One of the cheapest, most effective ways to actually change behaviour.

2. Get your Microsoft 365 audited

Around 99% of the attacks we see come through Microsoft 365. So it makes sense to protect the thing that matters most.

Get your accounts locked down. Make sure your Managed Service Provider is reviewing security logs in real time, or better still, that you have a Security Operations Centre connected up to disable compromised accounts 24/7. If your provider cannot tell you when an account is breached, they cannot stop it.

3. Work towards Cyber Essentials

Cyber Essentials is a government framework that measures five key areas of your business. We certify over 200 businesses every year through it, and it is genuinely one of the best ways to measure whether you are doing the basics properly.

But do not be fooled by the badge alone. I know too many providers who deliver Cyber Essentials as a tick-list exercise, passing ownership back to the customer who signs off something that is not actually true.

If you are unsure, go for Cyber Essentials Plus. That is an external, evidenced audit, not a self-assessment. Some sectors now require both as mandatory for contract awards or compliance. It is a far stronger position to be in.

4. Move to MDR

Managed detection and response is cost effective these days. If you are still relying on traditional anti-virus that has its roots in the late 1980s, you have to ask why.

MDR, or CyberGuard as we brand it, does not just check files against a database of known virus signatures. It monitors behaviour 24/7. It picks up suspicious activity, unexpected system changes, lateral movement and account compromise patterns that traditional anti-virus would never see. It is the difference between a smoke alarm and a fire crew already in the building.

5. Be proactive, not reactive

Proactive is a word our industry overuses. The reality in most MSPs is that proactive work, like patching and software updates, happens when engineers have a free moment between tickets. Which means it slips, then it gets missed.

At Flotek, we have a dedicated team doing this seven days a week, pushing updates live to your machines. Yes, the restart prompts are annoying. I know. But patching is critical. Leaving software unpatched is the digital equivalent of leaving a bedroom window open and hoping nobody notices.

Where to start

There is plenty more to say. Endpoint hardening, backup strategy, identity protection, supplier risk, incident response planning. The list goes on. But if you start with these five, you will already be ahead of most small and medium businesses.

A few things you can do right now, at no cost. Check what data of yours is already out there on the dark web with our Breach Monitor free scan. Get your team tested with a phishing simulation. Get them on our monthly cyber security webinar. One hour a month could pay back many times over.

Do not be the next small or medium business that stayed loyal to a Managed Service Provider that was not actually protecting them.

Further Reading

Flotek Partners with Citation Cyber to Enhance Your Cyber Defence — Cyber Essentials, penetration testing, phishing simulations and more, now available through Flotek.

Flotek Partners with Breach Monitor — Affordable dark web monitoring for SMEs, with a free scan worth £39 available until 30 June 2026.

Flotek Partners with Check Point for Email Security — The email security platform we use to keep partner inboxes clear of phishing and ransomware.

All The Latest Trends In Business Cyber Security — A practical look at the threats businesses face and what good protection looks like today.