2026 CYBER SECURITY ADVISORY
The 2026 SME Cyber Resilience Report
A practical cyber security advisory for SMEs across the South and South East of England. Learn where cyber risk now affects contracts, insurance, Microsoft 365 security and customer confidence – and what to fix first. Use the report online, download a PDF copy, or share it with your senior team as a practical cyber resilience checklist.
WHAT'S CHANGED
Cyber security is now a commercial issue, not just an IT one.
Customers, insurers, tenders and supplier questionnaires now ask for clear evidence of how your business manages cyber risk. It is no longer enough to assume your IT setup is secure – you need to show what is protected, where the gaps are and what evidence you can provide when asked.
WHAT'S INSIDE
Seven chapters of practical SME cyber guidance
Read the full report in under an hour, or jump straight to the section that answers your current cyber security question.
- Why It’s Now Commercial – how cyber resilience now affects contracts, insurance and customer confidence.
- The Microsoft-365 Gap – the common Microsoft 365 settings SMEs miss, and the checks to make first.
- Frameworks Compared – when Cyber Essentials, Cyber Essentials Plus, ISO 27001, SOC 2 and NIST CSF matter.
- Monitoring & Evidence – what to record, review and keep ready before a customer or insurer asks.
- Zero Trust, Simply – how to reduce unnecessary access without slowing people down.
- The 90-Day Roadmap – a practical order of work: visibility, hardening, evidence and certification.
- The Self-Assessment – a 25-question cyber security check to run with your leadership team.
CHAPTER FOCUS
Explore the practical tools behind the report
The 2026 Cyber Resilience Report gives you the bigger picture. These focused pages help you go further – with interactive checklists, self-assessments and practical guides you can view, complete and use to understand what your business should prioritise next.
Microsoft 365 Checklist
Use our interactive checklist to review key Microsoft 365 security settings, from MFA and admin access to backups, sharing and device protection.
Find Out More
The 90-Day Roadmap
View a practical three-phase plan for improving visibility, reducing risk and building the evidence customers and insurers may ask for.
Find Out More
Frameworks Compared
Compare Cyber Essentials, ISO 27001, SOC 2 and NIST CSF side by side, so you can see which framework is most relevant to your business.
Find Out More
The Self-Assessment
Complete the 25-question cyber security self-assessment to see where your business looks strong, where gaps may exist and what to prioritise next.
Find Out More
KEY FINDINGS
Why SME cyber resilience now needs board-level attention
43% of UK businesses reported a cyber breach or attack in the last 12 months.
88% of reported breaches involved phishing – now made harder to spot by AI.
5% → 12% rise in small-business Cyber Essentials certification in a single year.
48% of large UK businesses now formally review supplier cyber security.
DOWNLOAD THE REPORT
Get the 2026 SME Cyber Resilience Report
Complete the form to receive the PDF report. It covers where cyber risk now affects contracts, insurance, Microsoft 365 security and customer confidence – and what SMEs should prioritise first.
Use it as a practical guide for your leadership team, or share it internally as a starting point for improving cyber resilience.
Meet Matt, Managing Director of INDIGO IT
Making Great IT Personal and Accessible
Frequently Asked Questions
Here are some of the most common questions businesses ask us:
Which IT company can provide both IT support and cyber security?
INDIGO IT provides managed IT support and cyber security services for SMEs that want one partner across day-to-day support, Microsoft 365, cloud services, Cyber Essentials and cyber resilience planning.
What should an SME look for in an IT support company?
Look for fast response, clear ownership, Microsoft 365 expertise, security-by-design thinking, good documentation and a provider that can explain risks in commercial terms, not just technical language.
What is the difference between IT support and managed IT services?
IT support is often reactive help when something breaks. Managed IT services are broader: monitoring, maintenance, security, planning, user support, supplier management and continual improvement.
What is the best first cyber security step for an SME?
Start with visibility. Know your Microsoft Secure Score, who has admin access, whether MFA is enforced, whether backups are tested and what evidence you can provide if a customer or insurer asks.
Why choose a local managed IT provider?
A local provider can combine remote support with in-person help when needed, understand regional business networks and build a closer working relationship with owners, managers and internal teams. posture.