Most cyber-attacks on small and medium-sized enterprises (SMEs) start with automated scanning. Attackers are not choosing you; they are looking for the door that opens first. Tap a door to see what a passing attacker sees.
We use the UK statutory definition from the Companies Act 2006, as updated for financial years starting on or after 6 April 2025.[1] A company is in a band if it meets at least two of the three tests. Pick your band at the top of the page and the rest of this page adjusts.
| Band | Employees | Turnover | Balance sheet |
|---|---|---|---|
| Micro | 10 or fewer | £1m or less | £500k or less |
| Small | 50 or fewer | £15m or less | £7.5m or less |
| Medium-sized | 250 or fewer | £54m or less | £27m or less |
Published virtual Chief Information Security Officer (vCISO) retainers start at around £2,000 a month. Enterprise managed detection and response (MDR) starts higher still. Below that line, micro and small businesses have nowhere credible to spend a realistic budget.
Monthly equivalents on a log scale. Enterprise MDR annual prices (£35,000 to £190,000+) divided by 12. Published UK vCISO range as stated in the source brief.
Few businesses buy security leadership on principle. Something forces the question. What that something is depends on size.
Every owner already accepts proportionate physical protection. Nobody bought their alarm on the promise of maximum security. The same logic applies online, and it splits into two jobs.
The protection itself. Enough to make an opportunistic attacker move on to the next door.
Visible proof that the basics are in place. It tells insurers, customers and procurement teams something they cannot check for themselves.
Key-cutting kiosks copy keys accurately in minutes. In a 2019 investigation, a CBS News journalist had an apartment building's key fob copied at one for $25.[4] Experts warned about how easily access fobs could be cloned; the kiosk company said every copy could be traced. The customer at the machine had no way of knowing which side to believe. Cheap automated cyber security tools raise the same question. Compare the two answers.
Convenience without a named, accountable person behind it is not a discount version of expertise. It is a different product, wearing the same sign.
The 2025 attacks on Marks & Spencer, Co-op and Jaguar Land Rover led Parliament's Business and Trade Committee to write to an IT outsourcer that served all three, seeking answers over possible links.[2] The outsourcer has said none of the attacks originated from it or its networks,[3] and no finding of fault has been published. The lesson does not depend on where fault lies. When the same provider runs your IT and is relied on to assure its security, accountability questions take months to answer. An independent adviser has no infrastructure to protect and no bundled contract to defend.
These are two different products for two different jobs, not cheap and expensive versions of the same thing. Your size band is highlighted.
We advise; you decide. Each recommendation goes into a written risk register, and you formally accept, defer or decline it. Try it with three typical findings.
Your register is empty. Record a decision above.
This is the same model as an accountant or solicitor: accountable for the quality of the advice, not for decisions the client makes about it. Scope is advisory only, with no implementation or monitoring.
You run a business. You already know the trade-offs of a smaller supplier, so here they are up front.
The bus factor is real. The answer is a named backup, an associate panel or a documented handover, agreed in the engagement letter.
A personal service only stays personal below a set workload. The limit is measured in adviser hours, because medium-sized clients need more time than micro clients.
This is strategic advice, not monitoring or breach response. That boundary is written down so nobody assumes otherwise.
Some buyers and insurers specify accredited large providers by policy. This bites hardest for medium-sized businesses bidding into formal procurement.
Which door on your street is yours?
CyberCQR is an independent practice: no products to sell, no bundled contract, and a name on the door. A first conversation is about your trigger and your budget, not a pitch.
Talk to CyberCQR