The 3 biggest cyber security risks SMEs should address now.

A finance user, manager or director receives an apparently genuine request to change supplier bank details, redirect an invoice or make a confidential payment quickly.

These messages are effective because they imitate a real supplier, colleague or senior decision-maker and create urgency. The technology may only be one part of the attack. The final target is a business process and a payment decision.

Microsoft 365 often sits at the centre of an SME's email, files, collaboration and identity. Password-only access or inconsistent controls can leave too much resting on one credential.

Multi-factor authentication is an important starting point, but the review should go further. Sign-in policy should reflect the sensitivity of the account, the device being used and the circumstances of the login.

Access-control questions worth asking.

• Is MFA applied consistently across users and administrator accounts?
• Can unmanaged or untrusted devices reach sensitive business data?
• Are high-risk sign-ins blocked or challenged appropriately?
• Are legacy authentication and weaker sign-in methods still available?
• Can the business see unusual sign-in activity and respond to it?

Using broad administrator rights for normal work increases the effect of a mistake, malicious action or compromised account.

This includes people working day to day as Microsoft 365 Global Administrators and users retaining local administrator rights on laptops when the role does not require them. The objective is not to remove the ability to administer systems. It is to separate that ability from routine email, browsing and document work.

Apply least privilege in practical terms.

• Remove day-to-day Global Administrator use.
• Use separate privileged accounts for administrative work.
• Assign the narrowest suitable role for each task.
• Remove unnecessary local administrator rights.
• Review privileged access regularly and after role changes.

A practical SME action plan

Seven sensible actions to prioritise.

These actions provide a focused starting point for reducing common cyber security exposure without turning the programme into a disruptive transformation project.

1. 01
   Verify payment changes outside email.

   Use a known phone number or another trusted communication route.

2. 02
   Enforce MFA across Microsoft 365.

   Include administrator and other high-impact accounts.

3. 03
   Review sign-in and Conditional Access controls.

   Consider devices, locations, risk and business requirements.

4. 04
   Stop routine Global Administrator use.

   Keep broad privilege away from daily email and browsing.

5. 05
   Remove unnecessary local admin rights.

   Retain them only where a defined business or technical need exists.

6. 06
   Separate privileged accounts.

   Use protected accounts only for approved administrative tasks.

7. 07
   Review who has access and why.

   Update permissions as roles, systems and working practices change.