October is Cyber Security Awareness Month, but for businesses across Durham and the North East, cyber security cannot be something we think about for just one month of the year.
Cyber threats continue to evolve, and criminals are becoming better at disguising attacks as ordinary emails, supplier requests, Microsoft 365 notifications and even messages from senior colleagues. That does not mean businesses should panic. It means they need to understand where the biggest risks are and make sure the right protections are in place.
Cyber Security Awareness Month gives every organisation a useful opportunity to pause, review its current approach and ask a simple question: if an attack happened tomorrow, how confident would we be in our ability to prevent it, contain it and recover?
The cyber threats facing UK businesses in 2026
Most businesses will never be targeted by a highly sophisticated, bespoke cyber operation. They are far more likely to face attacks that exploit common weaknesses: a reused password, an unpatched device, an employee who is rushed into approving a payment or an account without multi-factor authentication.
These attacks are often automated and carried out at scale. Criminals do not need to know anything about your organisation before they begin. They scan for weaknesses, send convincing messages and wait for someone to respond.
Here are some of the main threats businesses should be aware of this Cyber Security Awareness Month.
Phishing and increasingly convincing social engineering
Phishing remains one of the most common ways criminals gain access to business systems. It may arrive as an email, text message, Teams chat or phone call and appear to come from a customer, supplier, bank, delivery company or colleague.
Generative AI is making these messages easier to create and harder to spot. Poor spelling and strange wording are no longer reliable warning signs. Attackers can produce polished messages quickly, imitate a person’s tone and use information from websites or social media to make their approach more believable.
Employees should be encouraged to pause when a request involves money, passwords, sensitive information or an unexpected change of bank details. A quick check using a trusted telephone number can prevent a serious incident.
Business email compromise and account takeover
When a criminal obtains an employee’s Microsoft 365 login details, they may be able to read email conversations, access files and send credible messages from a genuine company account. They might monitor correspondence until an invoice is due, then substitute their own bank details. They may also use the compromised account to target customers and suppliers.
Multi-factor authentication provides an important additional barrier, but it needs to be configured correctly. Businesses should also review sign-in activity, restrict unnecessary administrator privileges and make sure former employees’ access is removed promptly.
Ransomware and data theft
Ransomware remains a major business risk. Modern attacks do not always stop at encrypting files. Criminals may steal information first and threaten to publish it, adding regulatory and reputational pressure to the operational disruption.
Backups are essential, but simply having a backup is not enough. Copies should be protected from the main network, monitored and tested regularly. Businesses also need a clear incident response plan so people know who makes decisions, who contacts customers and suppliers, and how critical services will continue.
Unpatched software and unsupported systems
Security updates close weaknesses that attackers can exploit. When devices, servers, firewalls or applications are not patched promptly, a known vulnerability can become an easy route into the business.
The same applies to software that has reached end of support. Once a manufacturer stops issuing security updates, the risk grows over time. Maintaining an accurate asset list, applying updates consistently and planning replacements before products reach end of life are basic but vital controls.
Supply chain attacks
Your own controls may be strong, but your organisation also depends on software providers, outsourced services and suppliers with access to systems or data. An attacker may target a smaller or less protected company as a route into a wider network.
Businesses should understand which third parties have access, what information they hold and how that access can be withdrawn. Cyber Essentials certification is also increasingly used within supply chains to provide evidence that fundamental protections are in place.
AI-related data leakage and shadow IT
AI can deliver genuine productivity gains, but employees may paste confidential client, commercial or personal information into public AI tools without understanding how that data will be handled. Others may install unapproved applications or browser extensions to make everyday work easier.
This is not a reason to ban AI. It is a reason to create a clear policy, approve suitable tools, configure them securely and train employees on what they can and cannot share. AI adoption and cyber security planning should happen together.
Why awareness training still matters
Technology can filter malicious email, block suspicious activity and protect devices, but it cannot remove every risk. People remain an important part of a company’s defence.
Effective cyber awareness training should be regular, relevant and practical. A once-a-year presentation is unlikely to change behaviour. Short sessions, realistic phishing simulations and clear reporting procedures help employees recognise threats and respond correctly.
The aim is not to blame someone who clicks the wrong link. Employees should feel able to report a possible mistake immediately. The sooner an IT or cyber security team knows about an incident, the more opportunity it has to limit the damage.
What should Durham businesses prioritise?
Cyber security can feel like a long and expensive list of products, but the strongest starting point is often good cyber hygiene. During Cyber Security Awareness Month, businesses should review whether they:
- use multi-factor authentication for email, cloud services and remote access;
- apply security updates promptly across devices, software and network equipment;
- remove unsupported systems and unused user accounts;
- use separate administrator accounts and limit privileged access;
- protect, monitor and regularly test backups;
- provide ongoing cyber awareness training;
- have an incident response and business continuity plan;
- understand the access given to suppliers and third parties;
- have clear rules for AI tools, personal devices and data sharing; and
- meet the controls required for Cyber Essentials or Cyber Essentials Plus.
These measures reduce exposure to many of the attacks that affect small and medium-sized organisations. They also provide a clearer foundation for compliance, cyber insurance applications and customer assurance.
Why work with an NCSC-assured Cyber Advisor?
The National Cyber Security Centre’s Cyber Advisor scheme was created to give organisations access to reliable, practical and cost-effective advice.
NCSC-assured Cyber Advisors help businesses understand and implement the five technical controls at the heart of Cyber Essentials: firewalls, secure configuration, security update management, user access control and malware protection.
Concept IT is an assured Cyber Advisor organisation, helping businesses in Durham, Newcastle and across the North East assess their current position, identify gaps and take practical steps to improve. This can include support towards Cyber Essentials certification, but the value goes beyond passing an assessment. It gives businesses a recognised framework for reducing common cyber risks and making informed decisions about their security.
Make October the start of better cyber security
Cyber Security Awareness Month should not be about creating fear or buying technology for the sake of it. It should encourage useful conversations: Do our employees know how to report a suspicious message? Are our backups genuinely recoverable? Could one compromised account expose the whole business? Would we know what to do during an incident?
If those questions are difficult to answer, October is a good time to find out.
Concept IT provides cyber security and IT support to businesses and charities across Durham, Newcastle and the wider North East. As an NCSC-assured Cyber Advisor organisation, we can review your current protections, help you understand your priorities and support your journey towards Cyber Essentials or Cyber Essentials Plus.
Speak to Concept IT to arrange a cyber security review and turn awareness into practical action.