{"id":27946,"date":"2026-05-04T07:00:32","date_gmt":"2026-05-04T05:00:32","guid":{"rendered":"https:\/\/smecyberinsights.co.uk\/?p=27946"},"modified":"2026-05-05T11:29:30","modified_gmt":"2026-05-05T09:29:30","slug":"sans-identity-survey","status":"publish","type":"post","link":"https:\/\/smecyberinsights.co.uk\/index.php\/2026\/05\/04\/sans-identity-survey\/","title":{"rendered":"SME Cybersecurity in 2026: What the SANS Identity Threats Survey Means for UK Small Businesses"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\"Partners1_NordVPN\"<\/figure><\/div>
\"Partners3_R3\"<\/figure><\/div>
\"Partners2_Zoho\"<\/figure><\/div>
\"Partners4_Plesk\"<\/figure><\/div>
\"Red_Button_Slider\"<\/figure><\/div>
\"ogo2\"<\/figure><\/div>
\"Detection.<\/figure><\/div>\t\t\t<\/div>\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"SECURUS\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"SME\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
Image Credit: Freepik<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

Gibraltar:\u00a0 Monday, 04 May 2026 \u2013 07:00 CET<\/p>\n

SME Cybersecurity in 2026: What the SANS Identity Threats Survey Means for UK Small Businesses
\n<\/strong>By: Iain Fraser<\/a>\u00a0\u2013\u00a0Cybersecurity Journalist
\n<\/a>Published in Collaboration with:
\nSecurus Technology Group
\n<\/a>SMECyberInsights.co.uk<\/a>\u00a0– First for SME Cybersecurity
\n<\/a>Google Indexed PZero on: 040526 at 08:36 CET<\/a>
\n#SMECyberInsights #SMECybersecurity #SMECyberInsights #SME #CyberSafe #CyberSecurity #Cybersecurity #CyberEssentials #Identity <\/em>#IdentitySecurity<\/em> #Verification \u00a0<\/em><\/p>\n

\ufeff<\/span>\ufeff<\/span><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

SME Cybersecurity: Why Identity Is Now the Main Security Perimeter<\/strong><\/p>\n

Identity has become the easiest way into a business, and that matters because most UK SMEs no longer operate behind one neat office firewall. Staff work remotely, email sits in Microsoft 365 or Google Workspace, suppliers need access, and cloud apps hold sensitive data. When attackers steal a password or hijack a login session, they often bypass traditional defences altogether.<\/p>\n

That is the core message emerging from the 2026 SANS State of Identity Threats and Defences Survey. The report reflects what many practitioners already see on the ground: identity attacks are rising because they are efficient, scalable, and profitable. For SME Cybersecurity, this is not an abstract enterprise problem. It is a daily operational risk.<\/p>\n

The UK picture supports the urgency. The UK Government’s 2025 Cyber Security Breaches Survey found that 43% of businesses<\/strong> identified a cyber security breach or attack in the last 12 months, with phishing remaining the most common threat vector. For small firms, one compromised Microsoft 365 admin account can lead to invoice fraud, data loss, and business interruption in a matter of hours.\u00a0 UK Cyber Security Breaches Survey 2025<\/a>.<\/p>\n

What Does “Identity as the Security Perimeter” Mean for UK SMEs?<\/strong><\/p>\n

In plain terms, identity<\/em> means the digital proof that a user is who they claim to be. Usually that is a username, password, MFA prompt, device token, or session cookie. The security perimeter used to be your office network. Now, for cyber security for small businesses, the perimeter is every account that can access email, payroll, accounting software, client files, or remote systems.<\/p>\n

This shift hits SMEs hard because smaller firms often rely on:<\/p>\n

* shared admin accounts
\n* outsourced IT with broad privileges
\n* weak joiner, mover, leaver processes
\n* MFA applied inconsistently across systems<\/p>\n

In practice, that creates openings for phishing, business email compromise, and supply chain cyber risk. If an attacker gains access to one trusted identity, they can often move quietly, reset passwords, create mailbox rules, and impersonate senior staff.<\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SME\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

Knowledge Section<\/strong><\/p>\n

What is identity security in an SME context?<\/strong><\/p>\n

Identity security means controlling who can access business systems, how they prove who they are, and what they can do once inside. For SMEs, it usually centres on email, cloud apps, finance platforms, and admin accounts. It is one of the most effective ways to improve SME cyber resilience quickly<\/p>\n

Why are identity attacks increasing against small businesses?<\/strong><\/p>\n

Identity attacks are increasing because passwords, session tokens, and MFA prompts are easier to exploit than well-defended networks. Many SMEs use cloud services, outsourced IT, and shared permissions, which gives attackers more routes in. Phishing protection for SMEs is therefore a core defence, not a nice-to-have.<\/p>\n

How does Cyber Essentials help with identity-related risk?<\/strong><\/p>\n

Cyber Essentials helps by enforcing practical controls around access control, secure configuration, patching, malware protection, and firewalls. It does not solve every identity threat, but it reduces the chance that a stolen account leads to wider compromise. For many UK SMEs, it is the right baseline.<\/p>\n

Which Identity Risks Should SMEs Prioritise First?<\/strong><\/p>\n

The biggest identity risks for UK small business cyber threats are usually the least glamorous ones:<\/p>\n

1. Phishing and MFA fatigue<\/strong>
\nUsers are tricked into revealing credentials or approving repeated login prompts.<\/p>\n

2. Privileged account misuse<\/strong>
\nToo many users have admin rights, or one shared account controls everything.<\/p>\n

3. Poor offboarding<\/strong>
\nFormer staff or contractors retain access long after they leave.<\/p>\n

4. Weak supplier access controls<\/strong>
\nThird parties connect remotely with excessive permissions.<\/p>\n

5. Session hijacking and token theft<\/strong>
\nAttackers steal active login sessions, which can reduce the protection MFA provides.<\/p>\n

The NCSC guidance on phishing attacks<\/a> and Cyber Essentials<\/a> both point in the same direction: reduce unnecessary access, harden authentication, and make account compromise harder to turn into a wider incident.<\/p>\n

What Practical Identity Controls Improve SME Cyber Resilience?<\/strong><\/p>\n

The good news is that high-impact improvements do not require a large security team. For sme cyber security best practices, start here:<\/p>\n

1. Turn on MFA everywhere that matters first<\/strong>
\nPrioritise email, finance systems, remote access, and admin accounts. Use phishing-resistant options where possible.<\/p>\n

2. Remove shared and unnecessary admin accounts<\/strong>
\nGive each person their own account. Limit admin rights to named users only.<\/p>\n

3. Review leavers and dormant accounts monthly<\/strong>
\nThis is one of the simplest UK GDPR security measures to tighten quickly. The ICO’s security guidance<\/a> is clear that access should be appropriate and controlled.<\/p>\n

4. Adopt Cyber Essentials controls<\/strong>
\nThe scheme gives SMEs a practical baseline for secure configuration, access control, malware protection, patching, and firewalls. It is often the fastest route to better endpoint security for small business environments.<\/p>\n

5. Create a basic cyber incident response process<\/strong>
\nDocument who disables accounts, who contacts your IT provider, and how you report a personal data breach if needed. The ICO personal data breach guidance<\/a> is particularly relevant if email or customer data is exposed.<\/p>\n

For most SMEs, identity security is now business continuity. Secure the account, and you often stop the breach from spreading.<\/p>\n

The SANS survey reinforces a simple truth: attackers target identities because identities open doors. For UK SMEs, the smartest response is not more complexity. It is tighter access control, stronger MFA, cleaner admin practices, and alignment with NCSC<\/a>, Cyber Essentials<\/a>, and ICO<\/a> guidance.<\/p>\n

Start with a 30-minute identity access review this week; check who has admin rights, where MFA is missing, and which old accounts still exist.<\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"SECURUS\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

SECURUS Communications Ltd<\/strong><\/p>\n

Securus<\/a> <\/strong>is a managed communications Operator, providing next-generation network infrastructure and value added services to Managed Hosting providers and the ‘cloud generation’\u200b of enterprises. Securus<\/a> <\/strong>priority is to offer communication services that represent excellent value for money and are backed by exceptional levels of support.<\/p>\n

Contact Securus<\/strong>
\nSecurus Communications Ltd
\nStation Road, Landmark house, Hook, England RG27 9HA, GB
\nT: Enquiries:\u00a003451 283457<\/span><\/a>\u00a0| Service Desk: 03451 283458<\/a>
\nSecurus on LinkedIn<\/a> | Securus on “X”<\/a> | https:\/\/securuscomms.com<\/a><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t

\n\t\t\t\t\t<\/span>\n\t\t\t\t\tLatest Posts from SECURUS Communications<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t<\/h2>\n\t\t\t<\/div>
\n\n
\n
\n\n
\n \n \n \"AI-Powered <\/a>\n\n \n