Originally published on Ashdown Systems in October 2026, and revised for this blog. Read the original.
“We’re too small to be a target”
It’s one of the most common things we hear about security. Attackers go after banks and big brands, the thinking goes, not a twenty-person business on the high street.
Unfortunately, most attacks aren’t personal. Phishing emails, password guessing and automated scans for unpatched systems are sent out in bulk, and they find whoever is easiest to get into. Smaller businesses are often exactly that: busy, under-resourced and running on systems nobody has reviewed in years.
Most only think seriously about security after something goes wrong: a hijacked email account, a fraudulent invoice paid, a laptop lost with customer data on it. By then the cost is already being counted.
Why bolted-on security costs more
When security is an afterthought, it gets added in layers on top of systems that were never designed for it. The result is usually expensive, inconvenient and still full of gaps.
Picture a business where everyone shares one admin login, customer data is copied between a dozen tools, and old staff accounts are never switched off. Fixing that after a breach means untangling years of shortcuts while also handling the incident, notifying customers and, if personal data is involved, potentially reporting to the Information Commissioner’s Office.
Building security in from the start is far cheaper. It’s the same lesson as technical debt: decisions that save a few hours today can take weeks to unpick later.
What “security by design” actually means
It sounds like something only large enterprises can afford. In practice it comes down to a handful of principles any business can apply:
- Least privilege. People and systems get the access their role needs and nothing more. The office manager doesn’t need admin rights to the finance system.
- Identity first. Everyone has their own account, protected by multi-factor authentication, and accounts are removed promptly when people leave.
- Know your data. You understand what sensitive data you hold, where it lives and who can reach it, which is far easier when it isn’t scattered across spreadsheets and inboxes.
- Defence in depth. No single control is relied on to stop everything. If a password is phished, MFA stops the attacker; if a laptop is lost, encryption protects the data.
- Plan for recovery. Assume something will eventually go wrong, and make sure there are tested backups and a clear plan for what happens next.
Cyber Essentials: a practical UK starting point
For UK businesses, the government-backed Cyber Essentials scheme, run on behalf of the National Cyber Security Centre, is the natural place to begin. It focuses on five technical controls that defend against the most common attacks:
- Firewalls: controlling what can reach your devices and services from the internet.
- Secure configuration: removing default passwords and switching off what you don’t use.
- Security update management: keeping software and devices patched promptly.
- User access control: giving people only the access they need, with strong authentication.
- Malware protection: stopping malicious software from running.
There are two levels: Cyber Essentials, a verified self-assessment, and Cyber Essentials Plus, which adds independent technical testing. Customers increasingly ask for it, and it’s required for some public-sector contracts, so it can win business as well as reduce risk.
It’s a baseline, not a finish line. But working through it often reveals exactly where systems were never designed with security in mind.
A proportionate, architecture-led approach
Good security for a smaller business isn’t about buying every product on the market. It’s about sound structural decisions with sensible controls layered on top:
- Map systems and data. Identify what you rely on, what sensitive data you hold and where it flows. You can’t protect what you can’t see.
- Centralise identity. Use a single identity provider with MFA for as many tools as possible, so access is granted and removed in one place.
- Shrink the attack surface. Retire unused tools and accounts, consolidate where you can, and avoid copying sensitive data into systems that don’t need it.
- Build security into every decision. When choosing a tool or building something new, ask how access, data and updates will be managed before committing, not afterwards.
- Prepare for the bad day. Keep backups separate from the main systems, test that they restore, and write down who does what during an incident.
These steps cost far less than a breach, and most can be done without slowing the business down.
Before, not after
The best time to think about security was when the first system was chosen. The second-best time is now: before the first breach rather than after it.
