Expert’s guide to protecting your business from an attack

Two-thirds of small businesses close within a year of a cyberattack – and with criminals increasingly using AI to exploit weaknesses, the risks are rising fast. Detective Inspector Michelle Ohren, head of the Cyber Resilience Centre, explains why local firms must act now to strengthen their defences….

Cybercrime has a devastating effect on companies, with two-thirds of small businesses closing within 12 months of an attack. And as criminals turn to AI for new ways to steal data, the risks for businesses in Herefordshire and Worcestershire are growing.

Detective Inspector Michelle Ohren, head of the Cyber Resilience Centre (CRC), says firms of all sizes need to act now to protect themselves – and the CRC exists to help them do exactly that.

“People don’t realise how valuable data is and how important it is that you protect it,” DI Ohren said. “Data is what cyber criminals are looking for and they will try anything to get it. The best way to keep data safe is to have strong security and policies embedded from the start and make sure it is regularly updated. It is also important that all new staff joining know exactly what is expected of them and that there are policies in place telling them what to do in a particular scenario.”

The Cyber Resilience Centre for the West Midlands brings together expertise from law enforcement, academia and private sector specialists, offering government-backed, police-delivered support to businesses and organisations across the region – including Herefordshire and Worcestershire, as well as Shropshire, Staffordshire, Telford & Wrekin, West Mercia and Warwickshire. Part of its mission is to help smaller businesses, SMEs and supply chains access affordable security services and guidance.

And thinking you are too small to be noticed is the first mistake.

“As well as the traditional phishing scams and malware, criminals are using AI to trick businesses into thinking they are dealing with someone genuine and even create clone profiles. This is more of a risk with companies that rely heavily on or even operate solely using social media. We have seen a 60% increase in synthetic ID fraud from 2023–24,” DI Ohren said.

“We have also seen an increase in deepfake videos and news in which fake celebrity profiles such as Elon Musk and Steven Bartlett have been used to endorse a particular product or investment and encourage others to do the same – and people have lost hundreds of thousands of pounds.

“Criminals are also using deep voice, or voice cloning, to convince staff that they are speaking to one of the bosses, or the head of another company, and businesses have been conned out of millions of pounds.

“Chat bots are also being used to create fake online profiles to develop relationships with businesses and staff – which is what businesses are trying to do with customers. We have seen a lot of this with romance fraud, but now it is being used to target businesses, especially those that rely on Facebook Marketplace and online sites for sales or supplies.”

Even the most careful firms can still be caught out.

“Even with tight cyber security, people can still make a mistake and click on the wrong link or download a malicious file and let in a cyberattack. They might be in a hurry, or not feeling well, or fall victim to a very good scam that catches them off guard,” DI Ohren said.

“We’re all used to the HMRC and DWP scams, but if you’re under pressure and see an email that says your business owes X amount in unpaid tax, you might just fall for it. The important thing is to have the steps in place to know what to do to contain it and keep the business operating and safe moving forward.”

For small businesses in Herefordshire and Worcestershire, the risks are even sharper because fewer people are often carrying out multiple functions.

“Unfortunately, the differences in cyber security between businesses can be worlds apart,” she said. “A small business might be run from a laptop which one of the owner’s children uses for homework and the other plays games on. It will also have access to personal data and business bank accounts which makes it a huge risk.

“At the very least, they need to have separate log-in profiles, with the adult or business log-in having admin privileges.

“And the risks increase with each device – you might have the laptop secure but give the kids your phone to play a game on or the iPad to watch a video and they have access to everything to do with the business. It gives cyber criminals other ways in.

“Businesses can have the latest tech, but the human element is still the main risk. It’s an old saying, but if something seems too good to be true, it probably is.”
The CRC recommends that companies consider using network service providers and multi-factor authentication to keep systems secure.

“Network service providers already have policies and procedures in place and they concentrate on keeping data secure while the client carries on with their business,” DI Ohren said.

“And it is just as important for one-man bands and smaller businesses to be secure because you are only as strong as your weakest link and a compromised business will have suppliers and customers who are also being put at risk.

“We want businesses to think about their vulnerabilities and what procedures they need to introduce to keep their data, their networks, and their business safe.

“Criminals don’t care how much you have or how big or small a firm is. Once they have got the data, they don’t care about you or your business that has taken years to build up, they don’t care that it stops the only income keeping a roof over your head and food on the table.

“Unfortunately, two-thirds of small businesses close within 12 months of a cyber attack and 99.5% of companies in the UK are SMBs. You see these figures and it’s easy to forget the personal element – someone has worked hard to set up this business and provide for their staff and families and this has suddenly gone.

“If it is someone who has spent years building up a business and is suddenly left with nothing, they could lose their house, their car – and have to start looking for a job that pays similar wages when they are in their 50s or 60s.”

As well as having updated cyber security protocols in place, DI Ohren says people must be careful with what they share on social media, which could also compromise themselves and their business.

“It is incredible how much data you can find without really trying. You can get someone’s name, age, address, the company they work for and job title just from a social media profile,” she said.

“With social media posts and check-ins, they give away even more sensitive data, such as their location, the car they drive, pictures of their house, their children’s names, where they go to school and where they play football or go swimming. It’s chilling to think that in a matter of minutes, someone can have that level of detail about your family’s movement from what you are making publicly available.

“We want people to know what they can do to reduce cyber threats as well as what to do if there is a problem – what’s our plan to keep the business running and everything else secure while we deal with this threat?

“It’s about planning, procedures and contingency – if you aren’t prepared, you could lose everything.

“Criminals have done their homework and know that while a corporate business will have heavy cyber security, 80% of cyberattacks start with the supply chain – which means that national and international brands are only as strong as the weakest link.”