Defence and protection against wave after wave of unrelenting cyber attacks on our businesses and organisations requires constant vigilance and a core set of security practices. 

Good cyber hygiene encompasses risk assessment and management, technical controls and governance of your enterprise network. Increasingly, it includes those of your third-party supply chain partners and managed service providers (MSPs). 

Most importantly, cyber hygiene needs to be a continuous, never-ending process. With AI now central to cyber attacks, alongside more sophisticated social engineering, this has never been more important. 

Summer cyber attacks illustrate the dangers

In August, when much of Britain’s workforce was on holiday, cyber criminals stayed busy. Beacon CRM, a customer relationship management platform popular among charities, announced a cyber breach after access credentials were compromised. 

Three weeks after the Beacon CRM attack, hackers stole 8.7m customers’ private data records from the Manchester Airport Group.

“No one’s secure,” says Phil Osgathorpe, Director and Head of Cyber and IT Assurance at PFK Francis Clark chartered accountants. “You've got multi-million-, multi-billion-pound corporations getting breached. And it's not because there wasn't some ultra-expensive tool not doing its job, it's because someone used ‘password 123’ or something like it. 

For him, cyber hygiene is about doing the basics and getting the foundational things right: the day-to-day maintenance of people, process and technology. And not to become ultimately ‘cyber secure’, a fallacy to his mind. “It's also looking at when a cyber attack happens, not if. And that when it actually does happen, you minimise the ‘blast radius’,” says Osgathorpe.

Adhering to Cyber Essentials

Phishing remains the most prevalent and disruptive threat for businesses and charities, with over half experiencing attacks this year, according to the UK Government’s 2025/2026 Cyber Breaches Survey.

To prevent common threats, the government promotes the Cyber Essentials standard, based on five technical controls: 

• firewalls; 
• secure configuration; 
• security management updates; 
• user access controls; and 
• malware protection.

Maritz Cloete, Director of Risk Advisory Services at Moore Kingston Smith, views Cyber Essentials as an important baseline, especially for small and medium-sized enterprises (SMEs) with fewer resources to spend on network security. “These are things SMEs can do,” he says. “If implemented and followed properly, Cyber Essentials is very effective in preventing those ‘commodity’ type attacks” – assaults committed using easily available ‘off-the-shelf’ tools and techniques. 

One Cyber Essentials recommendation is regular ‘patching’: plugging software vulnerability gaps with manufacturer’s updates. The government is encouraging large organisations to insist on Cyber Essentials for all supply chain partners. The National Cyber Security Centre (NCSC) has a supply chain playbook to help businesses embed Cyber Essentials across their supply chains. 

“Security patching is very important in the Windows environment, because Microsoft releases patches and essentially what happens is that through the use of AI, attackers can reverse engineer those patches exceptionally quickly now,” Cloete warns.

This challenges smaller companies outsourcing to managed service providers, whose service level agreements (SLAs) may omit routine updates. Cloete advises ensuring that SLAs cover all five Cyber Essentials controls.

Osgathorpe, however, warns against easy complacency along the lines of: "We've got Cyber Essentials, so we're fine." 

“That's just one part of a bigger picture,” he says. “A good part, but it's not everything. For example, it doesn't focus on backups and how to restore networks from backups, or whether you actually should do that, and whether you do any kind of incident exercising.”

Incident exercising is increasingly acknowledged as a critical, pre-emptive aspect to maintaining good cyber hygiene. Luke Blake, founding director and crisis management specialist at Oakwood Risk Group, says that such procedures help to fill gaps in a company’s defence strategy.

“Preparedness – that’s policy, procedure, plan development, exercising and testing – is expensive. It costs a lot of money, but not as much as it costs to respond to a breach or if you don’t have a plan before it happens.”

On the topic of preparedness, Osgathorpe points to the absurdity of companies ensuring fire and theft insurance is in place where, despite the likelihood of a cyber attack being far greater than an office inferno, the emphasis of ‘protection’ is skewed towards the latter. 

“When was the last time your building burned down? When in reality, your network is being attacked right now, hundreds if not thousands of times a day.” He drives that point home, quoting his company’s CIO who recently told Osgathorpe that only 15% of all emails to the firm “make it through” to inboxes: the remaining 85% are regularly blocked by the network's spam and phishing email filters.  

Getting back to basics

Regardless of a company’s size, annual turnover or sophisticated defence technologies, the following are fundamental to any cybersecurity strategy: robust user identity and access management; multifactor authentication across all network services; and comprehensive asset inventory, where every device on the enterprise network is mapped and accounted for.

Supply chains and software providers also need to be a consideration; attacks often originate from supply chain partners and suppliers, so ensure they are also taking cybersecurity seriously.

Take a ‘layered’ approach to defence, where your security components overlap each other, so that if one fails, others can mitigate the attack. 

Forcing a governance mind shift

Cybersecurity is an enterprise-wide issue, not an ‘IT problem’. It requires active leadership and accountability, regular drills and visible board involvement to foster a strong security culture. The government’s Cyber Governance Code of Practice offers some helpful advice on how to put this into action 

Having a plan – before and after a breach

Effective responses depend on pre-established crisis management and business continuity plans, with pre-trained teams ready to act at a moment’s notice.