How do small businesses get hit by ransomware?

Most small business ransomware attacks happen through one of three routes: a phishing email with a malicious attachment or link, compromised credentials (usually from password reuse after a data breach), or unpatched software that is actively exploited. All three are largely preventable with basic security hygiene.

How much do ransomware attacks cost small businesses?

The ransom demand for a small business attack in 2025 typically ranges from £5,000 to £50,000 in cryptocurrency. Beyond the ransom, there are recovery costs, downtime losses, potential regulatory fines, and reputational damage. Many businesses that pay the ransom never receive a working decryption key.

What should a small business do after a ransomware attack?

Isolate affected machines from the network immediately. Contact your IT support provider. If you have clean offline backups, begin the recovery process. Report the incident to the NCSC and your cyber insurer. Do not pay the ransom without taking specialist advice first.

How can a small business prevent ransomware?

The most effective preventive measures are: MFA on all accounts (blocks most credential-based attacks), patching all software within 14 days of updates (eliminates unpatched vulnerability exploitation), staff phishing awareness training, offline or immutable backups, and endpoint protection software centrally managed.

How long should a business laptop last?

For most business laptops used daily, three to four years is a sensible replacement cycle. By year four, hardware is typically behind current standards, battery life has degraded, and minor issues start compounding. By year five or six, lost productivity and IT support costs often exceed the price of a new machine.

What are the signs a business laptop needs replacing?

Key signs for replacement include: the hardware cannot run Windows 11 (Windows 10 reached end of support in October 2025); battery life has dropped below four hours; the SSD is showing signs of failure; or the machine takes more than five minutes to become usable after boot.

When is it worth repairing a business laptop instead of replacing it?

Repair is worthwhile if the machine is under three years old and well-specified, the issue is a software problem rather than hardware, a RAM or SSD upgrade would resolve the slow performance, or a battery replacement is cost-effective on a machine less than three years old.

How should a small business plan its laptop refresh cycle?

Budget to replace approximately one third of your laptops each year, so each machine lasts three to four years. At around £1,100 per business laptop, a 10-person team should budget roughly £3,500 to £4,000 per year for hardware refresh. Assess each machine at the three-year mark rather than waiting for failure.

What are the biggest security risks of remote working for small businesses?

The main remote working security risks are: staff using personal, unmanaged devices with no endpoint protection; accounts without MFA enabled for remote access; files saved to local laptop drives instead of SharePoint; no VPN for accessing on-premise systems; and staff connecting from unsecured public WiFi networks.

Should remote workers use a VPN?

If any of your systems are not fully cloud-based (an on-premise server, network storage, or office-based applications), remote staff need a VPN to reach them securely. If everything is in Microsoft 365 or other cloud services, a VPN may not be necessary, but MFA and Conditional Access become more important.

Can staff use personal laptops for remote work?

Ideally, work should be done on company-managed devices enrolled in Microsoft Intune or equivalent device management. If personal devices must be used, a clear policy about acceptable use and minimum security requirements (patching, endpoint protection, encrypted storage) should be in place and enforced.

Blog

News, advice and guides for small business IT in Kent and the South East.

A laptop screen showing a domain registrar search interface with several co uk domains and a notepad of ideas

Written by Phil on 04 September 2025.

Choosing a Domain and Email Setup That Will Not Embarrass Your Business

I regularly receive enquiry emails from businesses using addresses like This email address is being protected from spambots. You need JavaScript enabled to view it. or This email address is being protected from spambots. You need JavaScript enabled to view it.. The services on offer are often perfectly good. The email address is doing quiet, persistent damage to how professional they appear before the conversation has even started.

Getting your domain and email right is a one-time job that takes a few hours and costs very little. Here is how to do it properly.

A dim office at end of day with a single laptop screen glowing red with a blurred warning message

Written by Phil on 28 August 2025.

Ransomware in 2025: How Small Businesses Actually Get Hit

The image most people have of a ransomware attack is a sophisticated team of hackers targeting a hospital or a bank. The reality for small businesses is considerably more mundane, and more preventable. Most attacks on SMEs in 2025 follow one of three patterns, and all three are largely avoidable with basic security hygiene.

Here is how attacks actually happen, what the consequences look like, and what sensible prevention looks like for a business of ten to fifty people.

Written by Phil on 14 August 2025.

When to Replace a Business Laptop (and When Not To)

A slow laptop is one of those things that creeps up on a team until someone finally mentions it and you realise half the office has been quietly losing 15 minutes a morning to boot-up time. By then the machine is usually four or five years old and well past the point where it was worth keeping.

The right time to replace a business laptop is before it becomes a problem, not after. Here is how to tell the difference between a laptop that needs replacing and one that just needs some attention.

A UK small business owner reviewing a three-page stapled Business Continuity Plan document at a desk

Written by Phil on 07 August 2025.

Business Continuity for Micro-Businesses: The Three-Page Plan

The phrase "business continuity plan" sounds like something large organisations have: a thick document that sat in a drawer for five years until someone needed it and nobody could find the drawer. For a small business, that approach is both impractical and unnecessary.

What a micro-business actually needs is a three-page document that answers a handful of critical questions clearly enough that any member of the team can act on it at 7am on a Tuesday when something has gone badly wrong. Here is what those three pages need to cover.

A tidy home-office setup with a laptop, external monitor and a handwritten numbered checklist in a notebook

Written by Phil on 31 July 2025.

Remote Working: The Security Checklist Most SMEs Miss

Most small businesses in Kent now have at least some staff working from home part of the time. Very few have updated their security setup to reflect that. The result is a business that works fine in the office but has significant gaps the moment someone logs in from a home network or a kitchen table.

This is the checklist I work through when a new client has a remote or hybrid team. Tick the ones you have covered. The gaps are your priority list.