Ten cybersecurity threats growing companies should plan for

Attackers don’t need to choose you. Much of the crime online is automated: scripts scan the internet for weak passwords, unpatched software and open storage, and then try whatever they find. A company with valuable data and few security staff is an easy result for a script, whatever its name or size.

The numbers reflect it. In its 2025 Data Breach Investigations Report, Verizon found ransomware present in 44% of the breaches it reviewed, and in 88% of those at smaller organisations, compared with 39% at larger ones. Third-party involvement in breaches doubled to 30%, and stolen credentials (22%) and exploited software flaws (20%) were the leading ways in.

Here are ten threats to plan for, followed by the protections that cover most of them.

The ten threats

1. Phishing and impersonation

Emails, texts and calls that look like they come from a supplier, a colleague or a bank, designed to get someone to click a link, share a password or approve a payment. They are now better written, and attackers can imitate a voice or a face with AI tools, so a well-spoken phone call is no longer proof of identity.

2. Ransomware

Software that locks your files or systems until you pay. It hits any business that depends on uninterrupted access to data, which is why hospitals and schools are frequent targets. The cost is the downtime and the recovery, not just the ransom.

3. Stolen and reused passwords

If one account’s password is leaked and used on other services, an attacker can walk straight in. Credential theft is among the most common routes into a company.

4. Malware

Viruses, spyware and programs that quietly harvest passwords from browsers. They typically arrive through attachments, fake software downloads or compromised websites.

5. Mistakes and insiders

Most insider incidents are accidents: an email sent to the wrong person, a laptop left on a train, a file shared too widely. Deliberate misuse by a disgruntled employee is rarer but costly, particularly where access isn’t tightly controlled.

6. Unmanaged devices and connected equipment

Cameras, printers, building systems and staff phones that nobody maintains can give an attacker a way into the wider network.

7. Cloud misconfiguration

Cloud services let you store and share data easily. They also make it easy to leave a folder open to the internet or give too many people access. The provider secures the platform. The settings are yours.

8. Social engineering

Manipulating people rather than computers: a caller pretending to be IT support, a message that creates urgency, a request that exploits politeness. These tactics work because they use trust.

9. Denial-of-service attacks

Floods of traffic that knock a website or service offline. For a company that relies on online orders or bookings, even a few hours of downtime has a measurable cost.

10. Out-of-date software

Software flaws are published and exploited within days or weeks. A system that hasn’t been updated is a known opening. Verizon’s 20% figure for exploited flaws shows how often it is used.

Five habits that stop most of it

1. Turn on multi-factor sign-in everywhere it is offered

A password plus a second check, such as an app prompt or a security key, defeats most stolen-password attacks. Start with email, banking, cloud storage and anything with admin rights. Use a password manager so that people can have a different strong password for every service.

2. Keep backups you have actually tested

Keep copies of important data that are separate from your main network, so ransomware can’t reach them, and try restoring from them at least twice a year. A backup that fails on the day is no protection.

3. Update everything promptly

Switch on automatic updates for operating systems, browsers and business software. Keep a simple list of what you run so nothing is forgotten, and retire software that is no longer supported.

4. Train people, and test them kindly

People are the front line. Short, regular sessions on spotting suspicious messages work better than an annual lecture. Run occasional simulated phishing emails to see where the gaps are, and use the results to teach, not to blame. Our guide to running a phishing simulation shows how. Agree a simple rule for payments and changes to bank details: always confirm by calling a number you already hold.

5. Plan for the day it happens

Write down who decides what, who to call, how you will communicate with customers and staff, and where the backups are. Rehearse it once with the leadership team. Companies that have done this recover faster and make fewer expensive mistakes.

Beyond the basics

• Limit access. Give people the access they need for their job, and remove it when they leave or change role.
• Check your suppliers. With third-party involvement in breaches rising, ask the vendors who hold your data how they protect it.
• Monitor. Logs and alerts are only useful if someone is watching. If you can’t staff that, a managed monitoring service is an option.
• Protect customer data. Know what you hold, where it lives and how long you keep it. See our guide to protecting customer data.
• Secure remote work. Home networks and personal devices extend your perimeter. See cybersecurity for remote workers.

If you want a starting point, our basic cybersecurity practices guide sets out the first steps in order. For help assessing where you stand across data, systems and governance, try the AI Readiness Index or talk to us.