A suspicious email is no longer necessarily riddled with spelling mistakes, while a payment request arriving in a genuine conversation might not be what it seems.
This Cybersecurity Awareness Month 2026, SoGlos speaks to Gloucestershire-based managed IT specialist System Force IT about how criminals gain access to businesses, the consequences for smaller organisations and the practical steps that make them harder to target.
What is Cybersecurity Awareness Month – and why should small businesses take notice?
Cybersecurity Awareness Month is an international campaign that runs every October, encouraging individuals and businesses to improve the everyday habits that keep them safer online.
It began in the US in 2004 and is now observed by organisations around the world. The National Cybersecurity Alliance’s 2026 theme is Don’t Make It Easy for Them, which sums up cyber security for small businesses rather well.
Attackers are constantly looking for the easiest route in. The aim isn’t to turn every member of staff into a cyber security expert; it’s to embed a handful of sensible habits across the business so you stop being an easy target.
That means using strong, unique passwords, turning on multi-factor authentication, keeping software updated, recognising suspicious messages and knowing what to do when something doesn’t look right.
How can Gloucestershire SMEs get involved?
You don’t need to sign up for anything or spend money to start making improvements.
For free, independent advice, start with the National Cyber Security Centre – the NCSC. Its free guide Small organisations guide to cyber security covers securing email and online accounts, protecting devices, backups and recognising scams.
We’ve also built a collection of free tools on the System Force website. They don’t require an email address or sign-up, and we don’t store what people enter.
Our Cyber Security Score asks 12 questions and gives businesses a risk score out of 100, alongside a prioritised list of improvements.
Our Email Security Checker examines the settings that help prevent criminals impersonating your business by email, highlighting potential weaknesses.
The Downtime Cost Calculator estimates what an hour without your IT systems could cost. That tends to make conversations about backups and resilience much more tangible.
They’re all available at systemforce.co.uk/free-it-tools.
But the thing we’d most encourage businesses to do during October 2026 is make one genuine improvement.
Turn on multi-factor authentication across the company. Check that your backups can actually be restored. Spend 10 minutes showing staff what a modern phishing email looks like.
One change that lasts beyond October is worth far more than a month of good intentions.
How do cybercriminals get into a business – and what should staff look out for?
People often picture somebody furiously typing away, trying to break through a digital wall. In reality, attackers often don’t need to break in at all – they persuade somebody to let them in.
Phishing remains a major route. That might be an email, Teams message, text message or fake login page designed to get somebody to click a link, enter their password, open an attachment or approve something they shouldn’t.
These messages have become much more convincing. AI means criminals can produce polished emails in good English very quickly, so simply looking for spelling mistakes isn’t enough anymore.
Stolen passwords are another route in. If somebody uses the same password on several websites and one is breached, criminals can try those details against Microsoft 365 and other business accounts.
Then there’s social engineering, which is about manipulating people. Somebody might phone pretending to be your bank, IT company, a supplier or a senior colleague, creating enough urgency or trust to persuade you to act.
Attackers also exploit software that hasn’t been updated or systems with insecure settings.
Once they gain access, they may deploy ransomware to encrypt systems so the business can’t operate, steal confidential information and threaten to publish it, or do both.
People are a major route into businesses, but they aren’t the only one. Good cyber security has to address people, technology and processes together.
What impact can a cyber attack have on an SME?
The damage normally arrives in several waves.
First comes the operational disruption. Systems go offline, people can’t work, orders stop being processed and phones or email may be unavailable. The business suddenly discovers how dependent it is on its IT.
For a small business, even a day or two of disruption can be extremely expensive.
Then there’s the cost of investigating and recovering from the incident, alongside lost productivity, lost revenue and potentially fraud.
One example is payment diversion fraud. If a criminal gains access to a mailbox, they can monitor genuine conversations and change payment instructions at exactly the right point. To the customer receiving the email, everything can look legitimate.
If customer or employee information has been compromised, the business also needs to assess what happened and the risks to those affected. Reportable personal data breaches must be notified to the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
But the longest-lasting impact can be reputational. The technical incident might be contained in a few days, while customers are still asking what information was taken, why it happened and what you’re doing to prevent it happening again.
There can be a commercial impact afterwards, too, with customers and supply chains asking for evidence of security measures before awarding work.
Trust takes years to build and can disappear remarkably quickly.
What practical steps should businesses take to protect themselves?
Many common cyber attacks are opportunistic. Closing the obvious doors makes it significantly harder for an attacker to succeed, and there’s plenty a business can do itself.
Turn on multi-factor authentication, or MFA, particularly for email, Microsoft 365, administrator accounts and anything containing sensitive information. It adds another check when someone signs in, rather than relying on a password alone. Where services support passkeys or other phishing-resistant authentication, even better.
Use unique passwords and a password manager. Reusing passwords across different systems can turn a breach elsewhere into a potential breach of your business.
Keep software and devices updated. Security updates exist because vulnerabilities have been found; delaying them unnecessarily gives attackers an opportunity.
Back up important data – and test the restore. A backup that has never been restored from is still an assumption. Businesses should know they can recover and roughly how long it will take.
Finally, train your people. Staff should know how to recognise suspicious emails, calls and login requests, but just as importantly, they should know who to tell when something goes wrong.
You want somebody who has clicked something suspicious to report it immediately, rather than sit on it for three hours because they’re worried they’ll get into trouble.
Where can a managed IT partner like System Force make a difference?
A managed IT provider adds value in the areas that are much harder for an SME to maintain continuously.
That includes monitoring systems around the clock, managing security updates, checking backups, protecting Microsoft 365, controlling administrator access, spotting unusual activity and responding to threats.
Those measures support the everyday habits we’ve discussed. Staff awareness matters, but it needs to sit alongside properly maintained systems and processes that help the business respond when something goes wrong.
To explore System Force’s free cyber security tools, visit systemforce.co.uk/free-it-tools – or find out more about its managed IT and cyber security services at systemforce.co.uk.
