That era is over.

Attackers now use the same generative AI tools the rest of us do, and they use them to write clean, fluent, convincing emails at scale. The message that references your actual manager by name, in their actual writing style, about a real project? That's not a coincidence anymore. The UK's National Cyber Security Centre has warned that criminals are using automation and AI to run these campaigns across thousands of targets at once, and that ransomware, which very often starts with a single phishing email, remains the most dangerous threat facing UK businesses.

It's working. As we covered in our breakdown of the government's latest Cyber Security Breaches Survey, more than four in ten UK businesses (43%) were hit by a cyber attack or breach in the past year, and phishing is behind the large majority of successful breaches.

The new tricks, beyond email

It isn't just text anymore. The same tools that write a convincing email can clone a voice from a few seconds of audio, or generate a passable video likeness. "Vishing" (a phone call that sounds like your finance director asking for an urgent transfer) is no longer science fiction. The defining feature of this new wave is that it removes the giveaways we were all trained to look for.

Why smaller businesses are squarely in the firing line

There's a comforting myth that hackers only go after big names. The opposite is true. Automated, AI-assisted attacks don't hand-pick victims; they go wide and hit whoever's least defended. Smaller firms tend to have thinner defences, which makes them the easy win.

It doesn't help that the basics are often missing. Research from BT found that around two in five small businesses haven't given their staff any cyber training at all. When the email is this convincing, an untrained team doesn't stand much of a chance.

What actually stops it

The reassuring news is that the defences haven't changed nearly as much as the attacks have. A few layers, applied consistently, stop the overwhelming majority of this:

• Multi-factor authentication everywhere. Even if someone hands over a password, MFA blocks most account takeovers cold.

• Email filtering that catches the obvious before it lands. Fewer suspicious messages reaching inboxes means fewer chances to slip up.

• A simple "verify by a second channel" habit. Any unexpected request to move money or share data gets confirmed by phone or in person, never by replying to the message. This is the single best defence against the voice and video tricks.

• Staff who know what to look for. Not a one-off lecture, but a steady awareness that this is normal now.

• Monitored devices and accounts, so that if something does get through, it's caught fast. Where we fit in

At Foxcube, most of this runs by default. We patch, we enforce MFA, we filter, and we monitor, quietly, in the background, so that the bulk of these attacks never reach your team in the first place. And when something genuinely needs a human eye, you've got UK engineers who'll pick up the phone.

The attacks have got smarter. Your defences should keep pace. If you're not confident yours have, let's have a chat. Call 0115 732 3060 or email hello@foxcube.co.uk.

That's not scaremongering. It's just how end of support works.

What "end of support" actually means

On 14 October 2025, Windows 10 reached end of support. Microsoft didn't switch the machines off; they still boot, still run your software. What stopped is the security updates: no more monthly patches for newly discovered flaws. And since attackers actively hunt for exactly these unpatched systems, every month that passes makes a Windows 10 machine a softer target. It's the same "path of least resistance" problem we wrote about in our breakdown of last year's cyber attack figures.

The one important caveat: Extended Security Updates (ESU)

There is a safety net, and it's worth knowing about. Microsoft's ESU programme lets you keep receiving critical and important security patches after end of support, for a price, and only for a while. If your Windows 10 machines are on ESU, they're still being patched and you're in a far better position. If they're not, they're exposed.

Be clear about what ESU is, though. It delivers critical and important security fixes only: no new features, no performance improvements, and no general technical support from Microsoft. It's a bridge, not a destination.

The dates and the real costs

For businesses, ESU is bought per device, per year, through volume licensing or a Microsoft partner, and the price doubles every year to push you towards upgrading:

That's roughly £337 per device over the full three years, and Year 3 is the end of the road. There is no Year 4; Windows 10 security updates stop permanently in October 2028. (Exact pricing comes through your reseller or CSP and excludes VAT.)

Two catches worth flagging. First, it's cumulative: you can't skip Year 1 and simply buy Year 2. Enrol late and you pay for the earlier year too. Second, the consumer version of ESU (the free/low-cost home option) only runs for one year, to 13 October 2026, and isn't built for a managed business fleet.

Why this October is the real cliff

We're currently in Year 1. The pressure point is October 2026: consumer ESU ends entirely, and business ESU doubles to around £96 per device.

Put numbers on it. If you've got fifteen Windows 10 machines, the cost of standing still jumps from roughly £720 this year to about £1,445 next year, for security patches alone, on machines that are otherwise frozen in time. Across the full three years that's nearly £5,000 to keep fifteen ageing PCs on life support, money that, in a lot of cases, would go a long way towards replacing or upgrading them.

The honest answer: ESU buys time, it doesn't fix the problem

For most businesses, the right move is to get onto Windows 11. Many existing machines will upgrade for free if they meet the hardware requirements: TPM 2.0, Secure Boot and a supported processor. Some older machines won't qualify, and for those the real cost isn't ESU, it's replacement. Either way, that decision is far better made on a planned roadmap than under pressure the week a machine gets hit.

There's a compliance angle too. Running an unsupported operating system can quietly undermine your security obligations; it's the sort of thing that fails a Cyber Essentials assessment and sits awkwardly against the data protection duties we wrote about ahead of the 19 June deadline. "We were still on Windows 10" is not a sentence you want to be explaining to a client, an insurer, or the Information Commission.

What we'd do for you

This is squarely an MSP job, and one we handle end to end. We'll audit every machine and tell you which can move straight to Windows 11, which need ESU as a short bridge, and which are genuinely due for replacement. We'll enrol the stragglers so nothing sits exposed in the meantime, and plan the migration around your business, all on one flat monthly price, no surprises.

If you're not sure how many Windows 10 machines you've still got, or whether they're even patched, that's exactly what our free IT assessment is for. Call 0115 732 3060 or email hello@foxcube.co.uk.

There's a date coming up that most small businesses haven't heard of, let alone prepared for: 19 June 2026.

Under the Data (Use and Access) Act 2025 - the UK's updated data protection framework - all UK businesses that handle personal data must have a formal internal complaints procedure in place by this date.

If you've got a contact form on your website, a client database, or a mailing list of any kind, this applies to you.

Here's what you need to know - in plain English, without the legal jargon.

What is the Data (Use and Access) Act 2025?

The Data (Use and Access) Act 2025 (usually shortened to DUAA) received Royal Assent on 19 June 2025. It's the UK Government's update to data protection law following Brexit - amending, but not replacing, UK GDPR and the Data Protection Act 2018.

The stated goal is to reduce red tape for businesses while keeping individual data rights protected. For most small businesses, the majority of the changes are either irrelevant or quietly beneficial less bureaucracy around legitimate interests, more flexibility on data subject access requests, and clearer guidance on automated decision-making.

But there are a few things that require action. The most time-sensitive is the complaints procedure requirement.

What changes on 19 June 2026?

From 19 June 2026, individuals gain an express statutory right to complain directly to your organisation about how you've handled their personal data before going to the Information Commissioner's Office (ICO).

This means you need a formal internal process for receiving and responding to those complaints. Specifically:

• A way for people to submit a data protection complaint to you directly
• A commitment to acknowledge complaints within a reasonable timeframe (30 days is the practical standard)
• An investigation process
• A written response explaining the outcome
• A record of complaints received and how they were resolved

The ICO has confirmed it will take a measured approach to enforcement during the transition period but compliance should be treated as an immediate priority, not something to revisit later in the year.

Do I need to publish a complaints policy?

No, there's no requirement to publish your internal complaints procedure publicly. It's an internal document.

What you do need to do is update your privacy notice to tell people they have the right to raise a data protection complaint directly with you, and how to do it. A single email address is sufficient as a complaints route.

What else has already changed?

The 19 June 2026 deadline is the most urgent item, but several other DUAA provisions came into force on 5 February 2026. The ones most relevant to small businesses:

Cookie consent flexibility For certain analytics tools, the strict requirement for prior consent has been relaxed slightly. However, the ICO has simultaneously increased the maximum fines for cookie violations to align with UK GDPR levels up to £17.5 million or 4% of global turnover, up from the previous £500,000 cap. The message: more flexibility, but higher stakes if you get it wrong.

Data subject access requests (DSARs) If someone asks to see the data you hold about them, you now only need to conduct a "reasonable and proportionate" search rather than an exhaustive one. You can also pause the 30-day clock while waiting for the individual to clarify their request. Practically useful for small businesses that receive complex DSARs.

Legitimate interests A new "recognised legitimate interests" basis has been introduced for specific activities like national security and crime prevention largely irrelevant for most SMEs, but it signals a broader direction of travel towards making data protection less burdensome for businesses.

What does this mean for your privacy policy?

If your privacy policy was written before June 2025, it almost certainly doesn't mention the right to complain directly to you. You need to add this.

Your updated privacy policy should include:

• How people can submit a data protection complaint directly to your organisation (email address)
• A commitment to acknowledge within 30 days
• Their ongoing right to escalate to the ICO if they're not satisfied with your response

If you're a Foxcube IT client, your managed IT support plan includes a review of your data protection documentation on request. If you're not a client and would like a second pair of eyes on your privacy policy, get in touch.

The practical checklist

Here's what a small business needs to do before 19 June 2026:

1. Write an internal complaints procedure A short document (one or two pages) covering: how complaints are received, who's responsible, how they're acknowledged and investigated, how responses are communicated, and how complaints are recorded. Keep it simple this doesn't need to be a legal document.

2. Update your privacy notice Add a section explaining that individuals can complain directly to you about data protection matters, with an email address and a note that they can escalate to the ICO if unsatisfied.

3. Make sure someone owns it In a small business, data protection complaints are usually the responsibility of the owner or a nominated director. Make sure that's clearly defined internally even if it's just a line in the procedure document.

4. Train your team If you have staff, they need to know what to do if a data protection complaint comes in. This doesn't need to be a formal training session, a five-minute conversation and a copy of the procedure is sufficient for most small businesses.

The bigger picture

The DUAA is broadly good news for small businesses. It doesn't add significant new obligations on top of UK GDPR in fact it reduces several. The complaints procedure requirement is the main new action item, and for most small businesses it's a one-off task that takes an afternoon.

The businesses that will get caught out are the ones that do nothing. The ICO has expanded powers under the new Act, and the information landscape is shifting clients, prospects and insurers are increasingly asking questions about data protection practices.

Getting this sorted now puts you ahead of the vast majority of small businesses, and costs nothing but a bit of time.

Need help?

If you're a small business in Nottingham or across the UK and you're not sure whether your data protection practices are up to date, we're happy to take a look as part of our free IT assessment.

Book a free IT assessment →

Sources: Data (Use and Access) Act 2025; ICO guidance on DUAA complaints procedure; Mayer Brown, Farrer & Co, Michelmores legal analysis; CMS Law DUAA update May 2026.

This article is for general information purposes only and does not constitute legal advice. For specific legal guidance on data protection compliance, consult a qualified solicitor.

The UK Government's Cyber Security Breaches Survey 2025/2026 landed last month. The headline figure — 43% of UK businesses suffered a cyber attack or breach in the past 12 months — sounds alarming. But the detail behind it is more alarming still.

We've broken it down in plain English, without the jargon, so you can understand what it actually means for your business.

The numbers you need to know

43% of UK businesses experienced a cyber breach or attack in the past year. That's roughly 612,000 businesses. For context, that's not 43% of large enterprises with dedicated security teams — that's businesses of all sizes, including yours.

50% of small businesses (10–49 employees) reported at least one breach or attack. If your business has fewer than 50 people, you're statistically more likely than not to have been targeted.

Phishing is still the dominant attack method, accounting for the vast majority of incidents. An employee receives an email that looks legitimate, clicks a link, enters their credentials — and that's it. Game over.

The average cost of a cyber attack for a small UK business is now £3,398. That's the direct cost. Add downtime, lost productivity, reputational damage and the cost of fixing the problem, and the real figure is considerably higher.

28% of UK SMEs say a single attack could put them out of business entirely.

The M&S, Co-op and Harrods wake-up call

If you need a more vivid illustration, look no further than what happened to three of the UK's best-known retailers this spring. Marks & Spencer, Co-op and Harrods all suffered significant ransomware incidents within weeks of each other. M&S alone reported disruption to online orders and systems that cost them tens of millions.

These aren't businesses that skimped on IT. They have dedicated security teams, enterprise budgets and years of experience.

If it can happen to them, it can happen to a ten-person professional services firm in Nottingham.

The difference is that large organisations can absorb the blow. Most small businesses cannot.

Why small businesses are the target

There's a common misconception that cyber criminals are only interested in large, high-value targets. The reality is the opposite.

Automated tools scan thousands of businesses simultaneously looking for the path of least resistance. Small businesses consistently represent that path — fewer security controls, less staff training, and often no dedicated IT support at all.

96% of UK businesses that suffer a cyber attack are small or medium-sized. Not because attackers specifically want them — but because they're easier to breach.

Criminals aren't after your data specifically. They're after access, credentials, and the ability to encrypt your systems and demand a ransom. A small business is just as valuable a target for ransomware as a large one, if its backups aren't working and its owner is desperate to get their files back.

The new compliance pressure: 19 June 2026

Here's a date your business needs in the diary: 19 June 2026.

Under the Data (Use and Access) Act 2025 — the UK's updated data protection framework which received Royal Assent last year — all UK businesses must have a formal internal process for handling data protection complaints in place by this date.

The Act also significantly increases the maximum fines for serious data breaches under PECR (the rules governing electronic communications and marketing), bringing them in line with UK GDPR levels — up to £17.5 million or 4% of global turnover.

This isn't theoretical. The Information Commission (the successor to the ICO under the new Act) has expanded powers and is actively enforcing. A data breach that previously might have resulted in a warning could now result in a substantial fine.

What actually works

The good news is that the vast majority of successful cyber attacks exploit basic, fixable weaknesses. The NCSC's own research suggests that 97% of successful attacks could have been prevented with modern, properly configured security controls.

Here's what makes the biggest difference:

Multi-factor authentication (MFA) — Requiring a second form of verification to log in blocks the majority of credential-based attacks. If someone steals your password, MFA means they still can't get in. This is the single highest-impact control you can put in place and it costs almost nothing.

Staff awareness — Most breaches start with a human click. Regular, practical training on how to spot phishing emails dramatically reduces the risk. This doesn't need to be expensive or time-consuming — even a 30-minute session once a quarter makes a measurable difference.

Patching and updates — Unpatched software is one of the most common attack vectors. Keeping operating systems and applications up to date closes the doors that attackers rely on. Managed IT support handles this automatically.

Working backups — If the worst happens and your systems are encrypted by ransomware, a recent, tested backup is the difference between a bad day and a business-ending one. The key word is tested — backups that haven't been verified don't count.

Endpoint protection — Basic antivirus is no longer sufficient. Modern Endpoint Detection and Response (EDR) tools monitor device behaviour in real time and can catch threats that traditional antivirus misses.

Where Cyber Essentials fits in

Cyber Essentials is the UK Government-backed certification scheme that covers the five most important technical controls — secure configuration, access control, software updates, malware protection and firewalls. It's been shown to prevent around 80% of common cyber attacks.

It's also increasingly required by clients and public sector procurement — particularly if you're tendering for government contracts or working with regulated industries like legal, financial services or healthcare.

At Foxcube IT, we guide businesses through the Cyber Essentials process as part of our managed IT support — helping you understand what's required, get the controls in place, and work towards certification.

The honest reality for small businesses in Nottingham

We work with small businesses across Nottingham, and the pattern we see is consistent: most businesses know they should be doing more on cyber security, but it keeps getting deprioritised because there are always more urgent things to deal with.

That's completely understandable. It's also exactly why 43% of businesses got hit last year.

The businesses that don't get hit aren't necessarily more technically sophisticated. They're the ones that have taken a handful of basic, consistent steps — MFA, patching, backups, training — and maintained them. That's it.

If you're not sure where your business stands, or you want an honest view of what your current setup is missing, we offer a free IT assessment. No pressure, no obligation — just a straightforward conversation about what you've got and what, if anything, needs attention.

What to do next

1. Check whether MFA is enabled on your Microsoft 365 accounts, email and any cloud services your team uses. If it's not, switch it on today.

2. Check your backups — when were they last tested? Do you actually know you could restore from them?

3. Talk to your team about phishing. Show them what a suspicious email looks like. It takes ten minutes and it works.

4. Get a free assessment from Foxcube IT — we'll tell you honestly where your gaps are and what they'd cost to fix.

Get a free IT assessment →

Foxcube IT provides managed IT support for small businesses across Nottingham, Nottinghamshire and the UK. We offer flat-rate plans with no contracts, onsite visits where needed, and a team that genuinely knows your setup.

Sources: UK Government Cyber Security Breaches Survey 2025/2026 (DSIT & Home Office); StationX Small Business Cybersecurity Statistics 2026; NCSC Small Business Guide; Data (Use and Access) Act 2025.