BUSINESS CONTINUITY
Small Business Cyber Resilience: Survive an AI-Accelerated Attack
For a small business, cyber resilience means being able to continue, communicate and recover when email, files, payments or a key cloud service is compromised. AI raises the pace of attack, but the strongest defences are still disciplined basics.
This page focuses on protection, continuity and recovery. It does not provide instructions for carrying out cyber intrusion.
The immediate answer
For a small business, protect the systems that keep the company trading: email, banking, customer data, accounting, website and operational software. Give each one an owner, secure logins, keep tested backups separated from day-to-day systems, and maintain a one-page continuity plan that staff can use even if normal communications are unavailable.
Identify the five systems that keep money moving
List the accounts and services whose loss would stop the business: primary email, banking, accounting, customer records, domain or website, point-of-sale, booking or operational software. Assign an owner to each one and record how it is recovered. NCSC guidance for small organisations focuses heavily on securing email and important accounts because access to these systems can cascade into wider compromise. Do this before buying specialist security products.
Use stronger login methods on business-critical accounts
Enable passkeys where supported. Where they are not available, use unique strong passwords stored in a reputable credential manager and enable two-step verification. Remove accounts belonging to former staff and reduce administrator access to the people who genuinely need it. Shared passwords create confusion during an incident because nobody can tell who used the account, and changing the password can lock out the very staff trying to recover.
Design backups around ransomware, not convenience
Back up customer records, finance data, documents, configuration and anything else needed to resume trading. Keep multiple copies in different locations and ensure at least one recovery route is protected from the same credentials and network used day to day. An always-connected drive can be affected by the same malware that damages the live files. Test restores and document the process so the business is not learning recovery under pressure.
Give staff a simple way to stop suspicious requests
AI-generated phishing can be polished and highly personalised. Staff need permission to challenge unusual payment instructions, credential requests and changes to bank details even when they appear to come from a director. Use an independent verification step for money movement. Make reporting easy: one internal contact or process for suspicious messages is better than expecting every employee to diagnose the threat themselves.
Write a one-page cyber continuity plan
The plan should say who makes decisions, who contacts the bank or IT provider, how staff communicate if email is unavailable, which systems can be shut down, which services must continue and where current backups are located. Include customer and regulator notification responsibilities that apply to your business, but do not improvise legal conclusions during the event. Keep a printed copy accessible to the people who would actually use it.
Recover in priority order and record the incident
Restore clean systems in the order required to trade safely. Preserve logs and evidence where possible, change compromised credentials, revoke unknown sessions and review payment activity. Do not reconnect every device simply because one service appears to work again. After recovery, document what failed and update the continuity plan. The purpose of resilience is not to claim the business cannot be breached; it is to make the next incident less destructive.
Continue from here
Build this topic into a wider plan, then see how the same dependency could fail in an AI-collapse scenario.
Evidence desk
The defensive guidance on this page uses current UK cyber-security advice. Where the page discusses AI-driven escalation or autonomous attack chains, that material is labelled as scenario analysis rather than presented as a guaranteed future event.
OFFLINE FALLBACK
Cyber resilience is part of household resilience.
The 72-hour field manual covers power, communications, money, food, water and the paper information you need when digital systems stop cooperating.
Continue
More Cyber & Digital Resilience guides → · Cyber and preparedness tools →