Why the threat is no longer theoretical

For many years, cyberattacks were seen as a problem primarily affecting large corporations with high public profiles. That perception has changed.

Today, research shows that more than 40% of cyberattacks in Europe target SMEs, and that up to 38% of small businesses have experienced a cyber scam or incident. What’s driving this shift is not a sudden surge of large-scale, custom attacks, but rather highly automated, scalable techniques that target common vulnerabilities found across many organisations.

What’s also striking is how professional cybercrime has become. Analysts estimate the global cybercrime economy to be worth multiple trillions of euros annually, on par with some legitimate industries. Many criminal groups now operate almost like corporate entities, complete with technical teams and even “support” channels to assist victims in paying ransoms – a clear indicator that this is a market-driven criminal enterprise with real financial incentives.

Healthcare and professional practices: high stakes, high risk

The risk is particularly acute for healthcare and professional practices that handle sensitive personal, medical data and financial data. In the EU, robust data protection frameworks, such as the GDPR, impose legal obligations on organisations to safeguard personal information. But beyond regulatory compliance, there’s something even more vulnerable at stake: trust.

Imagine this scenario: a ransomware attack encrypts patient records or blocks access to core systems, forcing the rescheduling of appointments and halting communications. The immediate operational disruption is costly, as backups may also be encrypted, and the data is permanently lost. But the reputational damage can take years to repair as customers transfer to another practice to seek treatment.

European research further suggests that many SMEs believe a serious cyber incident could threaten their business survival if systems were down for more than a few days, and that organisations that rely on continuous access to client records and scheduling systems face outsized consequences from even short disruptions.

How cyberattacks actually start

Despite the high-level discussions about cybercrime syndicates and ransomware, most attacks affecting small organisations begin with surprisingly simple entry points:

Such entry points could be as simple as a convincing phishing email or a stolen password that slips past busy reception staff. Once an attacker gets that first foothold, they move fast, resetting access, hijacking email flows, and deploying ransomware or stealing data.

Turning the tide: what small businesses can do today

The good news is that many of the most disruptive cyber incidents are preventable or at least can be mitigated significantly. Small organisations don’t need enterprise-level cybersecurity teams to make meaningful progress; they need well-chosen controls, consistency, and awareness. Here are some of the most effective controls that practices can adopt:

• Backing up your data – keep regular, tested backups (possibly an offline copy) so you can restore quickly if ransomware hits or data gets deleted.
• Protecting your organisation from ‘malware’. Practices MUST use up-to-date endpoint protection and prompt patching to block common malware and prevent its spread across devices. DO NOT USE FREE anti-malware software
• Keeping smartphones (and tablets) safe by enforcing screen locks, auto-updates, and remote wipe, so lost devices or risky apps don’t become an easy entry point into company accounts
• Ensuring all staff have their own individual passwords to protect your data and track access using strong, unique passwords. For sensitive systems (e.g. payment systems) ensure multi-factor authentication is enabled so stolen credentials (passwords) alone aren’t enough
• Avoid phishing attacks – train staff to spot suspicious messages and verify payment or login requests out-of-band, because phishing is still the simplest way attackers get in.

Reframing cybersecurity as business resilience

In 2026, cybersecurity moved from a technical silo to a business imperative. Preparedness now goes hand in hand with competitiveness and trustworthiness. Organisations that treat cybersecurity as a core element of their risk management strategy are better positioned to protect their clients, maintain continuity, and strengthen their reputation.

This is especially true in sectors like healthcare and professional services, where data is both sensitive and indispensable. The goal is not perfection. No system can be completely invulnerable, but it is about moving from reactive firefighting to proactive resilience.

At this stage of digital evolution, cyber risk is a normal part of doing business. The organisations that understand this will be the ones best equipped to thrive not despite cyber threats, but alongside them.

Get in touch to find out how you can protect your business in 2026.

Why Is This Still So Difficult?

That’s the right direction, and we all agree, but it’s hard to do in practice. Why? Because most security functions are still consumed by day-to-day activity, stretched resources and competing priorities. And too often we lack a clear line of sight between what the team is doing and the business processes, services, assets and dependencies that matter most. From my perspective, without that line of sight, risk assessments, penetration testing, control reviews, etc., become too generic, lack strong direction and purpose, or, even worse, focus on areas of the business that just aren’t that critical and may benefit from applying baseline controls.

Cyber Risk Doesn’t Exist in Isolation…

It’s made harder by the fact that cyber risk rarely exists in isolation. The risks we deal with now are hybrid and cut across cyber, technology risk, operational resilience, physical security, third-party management, enterprise risk, compliance, and audit, and yet, many of these functions still report vertically, with little lateral sharing. That makes it genuinely difficult to build a joined-up picture of what’s truly critical, how it’s protected, where the dependencies run, and where we’re most exposed.

The uncomfortable truth is that no one can secure everything to the same standard. So, prioritisation isn’t optional; it’s our job to perform. Yet our assurance effort often follows the wrong triggers. A new application attracts a risk assessment, a pen test, or a code review simply because it’s new, while a mission-critical system that’s underpinned the business for a decade hasn’t been tested in years. The result is a mismatch between where we point assurance and where the real exposure lives.

Start with What Matters Most

The place to start is by identifying the business’s nucleus: the critical services, processes, data, systems, people, and third-party dependencies that must be protected and kept running at all costs. This requires discussion, challenge, and consensus across business, technology, risk, and resilience teams. It won’t be perfect the first time, but skipping it because it’s hard leaves us with no defensible basis for prioritisation at all.

Once we understand what’s most critical, risk assessment starts to earn its keep. The point isn’t to generate another risk register; it’s to work out what could realistically go wrong, how likely it is, what it would cost the business, and which controls we need to prevent, detect, and respond. That’s what connects business criticality to threat exposure, control effectiveness and remediation priorities.

It also gives us a far stronger story to tell regulators, boards, and auditors, which broadly follows a clear line from what matters most to the business, through the risks we’ve identified, to the controls we’ve put in place and the investment we’ve chosen to make. It’s the difference between security as a broad compliance exercise and security as focused business protection.

The Goal

This must ultimately be our goal now in cybersecurity: a cybersecurity programme that’s more practical, more connected, and more targeted. One that’s built around understanding what the business genuinely cannot afford to lose, how those critical services and assets are exposed, and where our time, effort and investment will have the greatest impact. That means moving beyond security activities driven primarily by compliance schedules or technology change and instead focusing assurance where it matters most.

We’ll never have unlimited resources, nor will we ever eliminate every risk. But by establishing a clear line of sight between business criticality, credible threat scenarios and the controls that protect them, we can make better decisions, justify investment more effectively and build resilience where it counts.

This is what good cybersecurity should be about: not trying to secure everything equally, but making informed, defensible decisions that protect what matters most to the organisation.