Could Your Business Still Open Tomorrow After a Cyber-attack?

Cyber preparedness is not just about security software. It depends on how your people respond, whether your plans work under pressure, and whether your backups can actually be restored.

By Sam Wheeler, Founder and Managing Director, Samaryam Tech

Imagine it is 9:03 on a Monday morning.

A member of staff receives a routine-looking Microsoft 365 sign-in request. The branding looks right, the wording feels familiar and the page behaves exactly as expected. They enter their details and carry on working.

By lunchtime, an attacker is reading the mailbox, sending convincing payment requests and using the account to reach colleagues and customers. Staff begin losing access. The IT provider takes systems offline to contain the problem. Email, calendars, shared files and customer contact details are suddenly unavailable. Payments are paused. Clients want answers. The key decision maker is on holiday.

Then the team discovers that the only readily available backup sits inside the same compromised environment, and nobody can remember when it was last successfully restored.

Scenarios like this are happening to small business across Scotland and the rest of the UK more and more frequently. It is a composite of patterns businesses and security teams prepare for every day. There is no mysterious hacker in a hoodie and no dramatic countdown on a screen. There is simply a normal working day that becomes a business crisis.

The real question: If your email, files and customer systems disappeared today, could your business still operate tomorrow?

Small does not mean invisible

The idea that a business is ‘too small to be targeted’ is one of the most dangerous assumptions an Small to Medium Enterprise (SME) can make. Many attacks are broad, repeatable and opportunistic. Criminals use stolen credentials, automated tools, impersonation and large scale phishing to find whichever organisations are easiest to exploit. They do not need to know your name before you become a victim.

The latest UK Government Cyber Security Breaches Survey found that 42% of microbusinesses and 46% of small businesses had identified a cyber breach or attack in the previous 12 months. Phishing was experienced by 38% of all businesses and was named as the most disruptive type of attack by 69% of affected businesses.

Yet only one in four businesses had a formal incident response plan. Among microbusinesses, the figure was just 21%. That gap is important to note because the damage from an incident is rarely confined to a laptop. It can stop payments, interrupt services, expose customer information, damage trust and create legal or regulatory obligations.

The figures show why resilience planning matters even for the smallest organisations. Source: UK Government Cyber Security Breaches Survey 2025/2026.

A useful shift in thinking: Cyber security is not only an IT problem. It is a business-resilience problem involving people, processes and technology.

Your people can be your strongest early-warning system

People are often described as the weakest link in cyber security. That description is incomplete and, used carelessly, can make the problem worse. A person who feels they will be blamed for clicking the wrong link may stay quiet. The delay gives an attacker more time.

No organisation can eliminate every human mistake. The more realistic objective is to help people recognise unusual activity, pause before acting, double-check important requests and report concerns immediately. A fast report can be the difference between a suspicious email and a serious incident.

In the British Army, we talk about the concept of moral courage: the willingness to speak up and do the right thing, even when it feels uncomfortable. Businesses should celebrate that behaviour. An employee who quickly admits, ‘I think I may have clicked something,’ has given the organisation a chance to respond. They should be thanked, not punished.

Technology is the tool. Process is how the work is done. People make the decisions and operate both. When people understand why security matters and know exactly who to contact, they become the first line of defence rather than a problem to be managed.

Technology and process matter, but people make them work when the pressure is real.

A backup is not the same as a recovery

Many business owners are reassured when they hear, ‘Yes, we have backups.’ The more important question is: have you proved that you can restore them?

I have encountered backups kept on devices that were compromised alongside the original data, and backups that later proved damaged or incomplete. A green tick on a dashboard tells you that a process ran. It does not necessarily tell you that the data is current, safe and usable, or that your team knows how to recover it.

Every SME should be able to answer:

1. Where are our backups stored, and are they separated from the systems they protect?
2. Who can access them if our normal accounts or devices are unavailable?
3. When did we last restore a representative sample successfully?
4. How long would it take to restore the systems the business needs first?
5. How do we know the original threat has been removed before we reconnect recovered systems?

Recovery priorities should come from a simple business impact assessment. For one organisation, email may be the first priority. For another, it may be card payments, patient records, manufacturing systems or the ability to contact vulnerable customers. The business, not only its technology provider, must decide how much downtime it can tolerate.

For many SMEs, a quarterly restore test is a sensible starting point, with additional testing after significant changes. The result should be written down: what was restored, how long it took, what failed and what needs to change.

A successful restore test turns an assumed safety net into evidence the business can use.

Remember: A backup you have never restored is a promise, not proof.

Your incident plan must survive the incident

An incident response plan stored only in the email or cloud environment that has just become unavailable is not much use. The plan must remain accessible when normal technology, people and routines are disrupted.

At a minimum, a practical SME plan should explain:

• Who has authority to lead, make urgent decisions and bring the right people together.
• How staff, customers and suppliers will be contacted if normal email or messaging is unavailable.
• Which out-of-band communication channel the leadership team will use.
• How the business will make and receive essential payments or continue critical services.
• Which systems and information must be recovered first, and the maximum tolerable downtime.
• When to contact the IT provider, cyber insurer, legal adviser, communications support, regulator or law enforcement.
• What staff can say to customers while facts are still being established.

Keep controlled copies in more than one place: locally, in an appropriately secured cloud location, physically off-site and, where useful, as a protected printed copy. Review the plan at least annually and whenever key staff, suppliers, responsibilities or technologies change. Contact lists deserve more frequent checks.

Your IT provider has an essential role in containing the threat and restoring systems safely, but incident leadership must remain collaborative. The business understands its customers, obligations, priorities and appetite for disruption. Technical recovery and business decision-making have to work together.

Rehearse before the pressure is real

A written plan can look excellent until somebody asks, ‘What happens if the person named here is on holiday?’ That is why plans need to be exercised.

A tabletop exercise is a guided conversation around a realistic fictional incident. I sometimes describe it as Dungeons & Dragons for crisis management or, in more traditional language, wargaming. A facilitator describes what has happened, the team discusses its decisions, and new complications are introduced as the scenario develops.

Those complications, known as injects, might include a key person being sick, an angry customer posting on social media, a journalist calling, a backup failing, or new evidence that personal data may have been exposed. The exercise can be tailored to a solicitor, care provider, medical practice, manufacturer, charity or any other organisation.

A useful session can take just 30 to 60 minutes. It should involve decision makers and the people who own important technologies and business processes, so each understands the other’s constraints. The aim is not to catch people out or award a pass mark. A successful exercise ends with better questions, clearer responsibilities and a list of improvements.

A tabletop exercise is a learning conversation: scenario, decisions, realistic complications, then an action-focused debrief.

Capture those lessons in a short report, assign actions and revisit them. Depending on the organisation’s maturity and risk, exercises might be annual, quarterly or more frequent. The right rhythm is the one that keeps knowledge current and turns learning into action.

Five questions to ask before the next working day

1. If email and shared files disappeared today, how would we contact our staff and customers?

Do not assume that normal contact lists or messaging platforms will still be available.

• Could we still make and receive essential payments?

Know the manual or alternative process, the people authorised to use it and the checks that prevent fraud.

• Which system must be recovered first, and how long can we operate without it?

The answer should come from business impact, not whichever system is easiest to restore.

• When did we last restore a backup successfully?

Ask for evidence of the result, the recovery time and any lessons that remain unresolved.

• Who leads the response, and when did we last practise together?

Everyone can raise the alarm, but authority, responsibilities and communication routes must be clear before pressure arrives.

Prepared, not paranoid

Cyber resilience does not mean buying every security product or pretending that risk can be reduced to zero. It means understanding what matters most, strengthening likely weak points and making sure your people can act with confidence when something goes wrong.

An old principle applies: prevention is better than cure. But prevention alone is not enough. A well prepared organisation assumes that an incident may still happen and makes sure a difficult day does not become an existential one.

I founded Samaryam Tech because many SME leaders already know cyber security matters, but find the subject overwhelming, expensive or buried in technical language. Smaller organisations deserve the same disciplined thinking used in larger and high-pressure environments, translated into practical steps that fit their people, budgets and ways of working.

Stronger, more confident SMEs also strengthen North Lanarkshire, the wider Glasgow business community and, collectively, Scotland and the UK. Resilience grows through informed leadership, prepared teams and trusted local relationships.

A calm next step: If these questions exposed uncertainty, that is not a failure. It is an opportunity to find the gaps while there is still time to fix them.

About Samaryam Tech

Samaryam Tech is a Scottish cyber security consultancy helping SMEs move from uncertainty to confidence through practical support across people, processes and technology. Its services include the Cyber Compass assessment, staff awareness and behavioural training, incident response planning, tabletop exercising, and ongoing fractional CISO and cyber advisory support.

Founder and Managing Director Sam Wheeler brings more than 15 years of experience across the British Army, cyber security consultancy and public-sector cyber operations. Trained through the SANS Cyber Incident Leader programme, he works alongside a growing network of specialist consultants.

If you would like to sense-check whether your current arrangements would work under pressure, Samaryam Tech welcomes an initial conversation.

Website: www.tech.samaryam.co.uk
Email: sam.wheeler@samaryam.co.uk
Telephone: 0141 474 9012

This article provides general information about cyber resilience and is not a substitute for advice tailored to an organisation’s systems, risks and legal or regulatory obligations.