For many UK SMEs, a security incident does not begin with a dramatic technical exploit. It starts with an ordinary-looking email, a convincing phone call or a payment request that feels too urgent to question.
That is why security cannot sit solely with IT. Your people are part of the organisation’s defences, not because they should be expected to spot every scam, but because they need clear ways to pause, check and report when something feels wrong.
The scale of the problem is clear. The UK Government’s Cyber Security Breaches Survey 2025 found that 43% of businesses had experienced a cyber breach or attack in the previous 12 months. Among businesses that experienced an incident, phishing was the most commonly reported type.
For an SME, the practical question is not whether staff will encounter suspicious messages. It is whether the organisation has made the safe response easy.
Why attackers target smaller firms
Criminals often look for opportunity rather than a particular company size. SMEs can be attractive targets because they may have lean finance teams, informal approval processes and fewer layers between a request and the person who can act on it.
Attackers exploit trust and routine. A message appears to come from a supplier, a director or a customer. It refers to a real project or a busy period. It asks for a payment, a password reset or a quick change to bank details. Urgency is used to crowd out the normal checks.
Common approaches include:
- Email links and attachments that direct staff to fake sign-in pages or malicious files.
- Invoice fraud, including requests to change supplier bank details.
- Fake helpdesk calls from someone claiming they need to resolve an account problem.
- Urgent director impersonation, asking an employee to make a payment or buy gift cards discreetly.
- Unexpected MFA prompts intended to persuade someone to approve a sign-in they did not initiate.
The message may be polished. It may even match the tone of a real colleague. Security awareness should therefore focus less on spotting a suspicious-looking email and more on having a reliable process for checking unusual requests.
The NCSC guidance on phishing recommends treating suspicious communications cautiously and checking their legitimacy using contact details obtained independently, not details provided in the message.
Make reporting routine, not risky
A good reporting culture is one where staff speak up quickly, even when they are unsure. If employees expect blame for clicking a link or asking a “silly” question, they may delay reporting. That delay gives an attacker more time to exploit an account or persuade someone else.
Set out a simple response:
- Stop: Do not click, reply, pay or share a code.
- Check: Verify the request through a known, separate channel.
- Report: Use a clear internal route, such as a report button, helpdesk ticket or dedicated phone number.
- Escalate quickly: If someone clicked, entered credentials or approved an unexpected sign-in, say so immediately.
Be explicit that early reporting is useful, not an admission of failure. A quick report can limit the impact; a quiet delay can turn a small mistake into a wider incident.
The process needs to work in real life. Tell staff what to report, where to send it and what information to include. The NCSC explains how people can report phishing emails, texts, calls and websites. Internally, make sure reporting a suspicious message does not require employees to navigate a long policy document or guess which supplier to contact.
Put verification around high-risk requests
Some actions deserve a stronger check every time. These include supplier bank-detail changes, unusual or urgent payments, gift card purchases and requests to reset access to sensitive systems.
Agree a simple rule: never verify a high-risk request by replying to the message that made it. Instead, contact the person or organisation using a phone number or other contact method already held in a trusted record. Do not use a number, link or email address supplied in the suspicious request.
For payments and account changes, consider a two-person approval process. One employee handles the request; another independently checks it before action. The procedure should also state that unusual urgency, secrecy or pressure to bypass approval is a reason to pause, not a reason to speed up.
These checks should apply regardless of who appears to have sent the request. A director’s name in an email is not proof of identity, and a familiar writing style is not a control.
The helpdesk is part of the security boundary
Helpdesk Support can be an important safeguard, but only if identity checks are built into the support process. A caller who knows an employee’s name, job title or some internal details has not necessarily proved who they are.
Before resetting credentials or granting access, the helpdesk should follow a documented verification procedure using methods already established by the business. For sensitive or privileged accounts, stronger checks and escalation may be appropriate. If a request is unusual, staff should be able to pause it and seek a second review rather than bypass the process to satisfy a caller’s urgency.
A consistent process should cover what happens when a user has lost a device, cannot access their normal verification method or asks for an MFA reset. It should also make clear that support staff must never ask a user to disclose their password or read out an MFA code.
Use technical controls as the backstop
People make mistakes. Good security does not depend on nobody ever clicking the wrong link. It limits what can happen next.
Multi-factor authentication (MFA) makes it harder for an attacker to access an account using only a stolen password. The NCSC’s guidance on MFA for corporate online services covers how organisations can choose and apply stronger methods. Prioritise accounts that manage users, email, finance and sensitive business information, and avoid approving sign-in prompts that you did not initiate.
Identity controls should also be backed by sensible access management: give staff access to what they need for their role, remove access promptly when it is no longer required, and protect administrator accounts especially carefully. Cloud Solutions can help enforce identity and MFA policies across services; Managed IT Services can support monitoring, patching and the consistent application of security settings.
These measures are not a substitute for staff confidence. They are the technical safety net beneath it.
Replace annual box-ticking with short, realistic practice
A single annual training session is easy to forget. Short, relevant refreshers are more likely to become part of how work gets done.
Use examples your staff might actually encounter: a supplier changing bank details, a director asking for an urgent payment, a caller requesting an MFA reset. Ask employees what they would do, then practise the correct reporting and verification route. Keep sessions brief and repeat them at sensible intervals, including when processes or threats change.
Measure whether people report suspicious messages promptly and whether high-risk requests follow the agreed checks. A click-rate alone can paint an incomplete picture; effective training should help staff recognise when to pause and make reporting feel straightforward.
Connect staff behaviour to your wider security plan
Cyber Essentials provides a useful baseline for organisations seeking to improve their cyber security. Its requirements include technical controls, and the NCSC’s Cyber Essentials information explains the scheme and its purpose. Staff awareness and verification procedures strengthen that baseline, but training alone does not make an organisation compliant or guarantee protection.
This is where the Fractal IT Director approach matters. The IT strategy should define what risks the business is addressing, which actions require independent verification, how incidents are reported and who is accountable for responding. Delivery then follows the strategy: Helpdesk Support operates the verification and reporting routes, Cloud Solutions applies identity controls, and Managed IT Services supports monitoring and patching.
The wider plan might also cover Network Solutions, Voice and Connectivity, Disaster Recovery and Technology Expense Management. These are not disconnected technical purchases; they are execution services and decisions that should support the organisation’s agreed priorities. For a joined-up view of these areas, see our SME roadmap for IT services.
The same principle applies to business applications, including a Dynamics 365 Jump Start where Business Central and Microsoft 365 are part of the organisation’s plans. If your business depends on IBM i, IBM i Management should sit within that security and continuity conversation too.
The strongest control is a clear, shared habit
A human firewall is not a demand that every employee become a security expert. It is a workplace where people know how to check unusual requests, can report concerns without fear and are supported by practical identity controls.
Start with one rule staff can remember: pause, verify through a known channel and report anything suspicious. Then make sure the helpdesk, finance team and IT strategy all reinforce it. For an overview of the wider Evestaff group, visit evestaff.co.uk.
SEO tags: Cloud Solutions, Disaster Recovery, Dynamics 365 Jump Start, Helpdesk Support, IBM i Management, Managed IT Services, Network Solutions, Technology Expense Management, Voice and Connectivity, SME cybersecurity, phishing awareness, social engineering, Cyber Essentials, identity security, multi-factor authentication
Join The Discussion