10 Common Gaps in Cyber Security for SMEs, and How to Close Them
Most cyber attacks on SMEs don't rely on clever hacking. They rely on the same handful of everyday gaps in cyber security: an account without multi-factor authentication, a laptop that missed its updates, a backup nobody has ever tested.
Attackers now use automated tools to scan for those weaknesses at scale. That means businesses are targeted because of their gaps, not because of their size or profile.
This guide explains why those gaps matter, the 10 we see most often in UK SMEs, how to find them in your own business, what to fix first, and when it makes sense to bring in specialist support.
Why gaps in cyber security matter for SMEs
The risk is real and recent. ESET research published in September 2026 found that 49% of UK SMBs suffered a cyber incident in the past year, and on average it took just over four weeks to identify and recover from a breach. The most common causes were phishing, unpatched vulnerabilities, weak passwords and a lack of security monitoring.
A month of disruption has a business cost, not just a technical one. Systems go down, billable hours are lost, and a single diverted invoice payment can wipe out a month's margin. Clients notice, and trust takes longer to rebuild than servers.
There are obligations too. Serious personal data breaches must be reported to the ICO within 72 hours, and cyber insurers now ask about MFA, backups and patching at renewal. Clients, procurement teams and tenders increasingly ask for Cyber Essentials or evidence of controls, and Cyber Essentials is required for many central government contracts. So gaps can cost you new business as well as cause incidents.
The good news is that most of these gaps are well understood and inexpensive to fix once you can see them.
The 10 most common cyber security gaps in SMEs
The list below draws on the UK government's Cyber Security Breaches Survey 2025/26 and on what our team regularly sees when assessing SME environments. These cyber security gaps are common, not careless. Most build up quietly as a business grows.
1. Multi-factor authentication (MFA) isn't switched on everywhere
Fewer than half of UK businesses (47%) use two-factor authentication, and stolen or guessed passwords remain one of the simplest ways in. The usual blind spots are senior staff given exceptions, admin accounts, remote access and older systems that "don't support it".
First step: MFA on every account, with no exceptions. Start with email, admin accounts and remote access.
2. Too many people have admin rights, and leavers keep their access
Admin rights get handed out "to make life easier", logins get shared, and accounts stay open after people leave or change roles. Each one is a door an attacker can use.
First step: apply least privilege, so people only access what they need. Give admins separate accounts for admin work, and set up a joiners, movers and leavers process that HR and IT own together.
3. Software and devices aren't kept up to date
Unpatched vulnerabilities are one of the most common ways attackers get in. Windows 10 reached end of support in October 2025, so any device still running it without extended security updates is a gap in its own right.
First step: turn on automatic updates wherever possible and apply critical and high-risk updates within 14 days, in line with Cyber Essentials. Plan and budget to replace unsupported kit.
4. Microsoft 365 is left on default settings
Most SMEs run on Microsoft 365, but its default settings are rarely secure enough. We often find legacy authentication still switched on, external sharing wide open and mailbox forwarding rules that nobody is monitoring.
First step: a configuration review is a quick way to see where you stand. Our guide on how secure is your Microsoft 365 walks through the settings that matter most.
5. Email isn't protected against spoofing and payment fraud
Phishing is the most common attack type for UK businesses. Invoice and payment diversion fraud is one of its costliest forms: an attacker spoofs or takes over a mailbox, sends a convincing "change of bank details" email, and a payment goes to an account it can't be recovered from.
First step: set up email authentication (SPF, DKIM and DMARC) and introduce a simple call-back rule. Any change to bank details or payment instructions is verified by phone, on a number you already hold.
6. Backups exist, but nobody has tested a restore
Most businesses back up their data, but a backup is only useful if it can be restored quickly and ransomware can't reach it. File sync tools such as OneDrive are not the same as a backup: if files are encrypted or deleted, the sync copies that change too.
First step: keep backups separate from the main network, run regular test restores, and agree recovery times for your key systems.
7. Staff aren't trained to spot attacks
Only 19% of UK businesses ran staff training or awareness-raising in the last year, according to the same government survey, even though people are the target of most attacks. A newer gap sits alongside this one: staff pasting company or client data into unapproved AI tools.
First step: short, regular training for everyone, including directors and contractors. Frame phishing simulations as practice, not "catching people out", make it easy to report suspicious emails without blame, and publish a short policy on approved AI tools.
8. There's no plan for when something goes wrong
Only a quarter of UK businesses have a formal incident response plan. Without one, the first hours of an incident are lost working out who to call and what to switch off.
First step: write a simple plan covering roles, key contacts (IT partner, insurer, legal), how you'll communicate with staff and clients, and how you'll meet the ICO's 72-hour deadline. Test it once a year with a short tabletop exercise, and know who provides your cyber incident response before you need it.
9. Supplier and third-party risk is unchecked
Only 15% of businesses reviewed the cyber risks posed by their immediate suppliers. Yet IT providers, software vendors and outsourced services often have direct access to your systems and data.
First step: list who has access to what, remove access that's no longer needed, and make sure contracts cover security standards and breach notification.
10. Nobody is regularly testing for weaknesses
Many SMEs assume they're secure because nothing has gone wrong yet. That's luck, not evidence.
First step: a vulnerability assessment finds known weaknesses before attackers do. Cyber security also needs an owner at leadership level, with regular plain-English reporting, so gaps don't quietly reopen.
How to find the gaps in your own cyber security
Knowing what's common is useful. Knowing whether your business has these gaps is what matters. Start with a quick self-check:
Is MFA on for every account, including directors and admins?
Do leavers lose all access on their last day?
Are critical updates applied within 14 days on every device?
When did we last test a restore from backup?
Would a "change of bank details" email be verified by phone?
Do we have a written incident response plan?
Any "no" or "not sure" is a gap worth looking at.
For independent assurance, there are four levels, from lightest to most thorough:
A security health check or risk assessment gives a quick, high-level picture of where you stand.
An automated vulnerability assessment scans your systems for known weaknesses.
A Cyber Essentials Plus audit has an assessor verify your controls hands-on.
Penetration testing has specialists safely try to break in, the way an attacker would.
A second pair of eyes matters. Internal teams are often too close to their own setup to see its blind spots.
Where to start: closing the gaps in order of impact
Ten gaps can feel like ten equal tasks, but they aren't. Work through them in three stages.
Quick wins (the next 30 days): MFA everywhere, closing leavers' accounts, turning on automatic updates and introducing a call-back rule for payment changes. These cost little and stop the most common attacks.
Foundations (the next 90 days): work towards Cyber Essentials, which covers five of the most important technical controls. If you're unsure which level you need, our guide to Cyber Essentials vs Cyber Essentials Plus explains the difference.
Ongoing: test restores, run training, review suppliers, test your incident response plan and repeat vulnerability testing so new gaps are caught early. Cyber Essentials certification lasts 12 months, so treat it as an annual cycle rather than a one-off project.
When to bring in specialist support
Some businesses can close these gaps in-house. Others benefit from a partner. Signs it's time for support:
You can't confidently answer a client or insurer security questionnaire.
There's no in-house security expertise.
Your IT team is stretched by day-to-day support.
Cyber Essentials renewal is stressful, or you've failed it.
The business is growing or opening a new office.
Skills shortages and keeping up with new threats are among the biggest barriers SMEs face, so this is common, not a failing.
When choosing a partner, look for recognised accreditations Cyber Essentials Plus, CREST, ISO 27001), proactive rather than reactive support, experience in your sector and plain-English reporting for directors. Support can sit alongside an existing IT team through co-managed IT services, or take on IT entirely.
Consider IT is an IASME Cyber Essentials Plus certifying body, CREST accredited and ISO 27001 certified, with offices in Edinburgh, Glasgow and London. We support SMEs in financial services, professional services, energy and utilities and the public sector. Find out more about our cyber security services.
Next steps: closing your cyber security gaps with confidence
Most gaps in cyber security are common, well understood and fixable. The businesses that stay secure aren't the ones with the biggest budgets. They're the ones that find their gaps early and close them in a sensible order.
If you'd like to know where your business stands, take our free cyber security health assessment. It takes less than five minutes and gives you a clear score across key risk areas. Want to talk through the results? Get in touch with our team.
