Connected cyber risks: what small businesses can learn from Microsoft’s government warning

What has changed?

Microsoft’s 2026 Digital Defense Report puts government agencies and services at the top of the sectors affected by the cyber threats it observed. Their share of observed activity rose from 17% in 2025 to 27% in 2026. The report covers July 2025 to June 2026; these figures describe Microsoft’s observations, not the percentage of organisations attacked.

The report also describes attackers remaining undetected for longer across several sectors. Organisations acted more quickly after discovering an intrusion, but spotting the initial access remained difficult because attackers increasingly behaved like genuine users.

Phishing — deceptive messages intended to trick people — accounted for 23% of observed intrusions, compared with 7% the previous year. Microsoft also warns that attackers can turn a newly discovered software weakness into a working attack in well under 24 hours.

Why this matters beyond government

Government is an attractive target because it holds sensitive information, delivers essential services and connects with contractors, technology companies and infrastructure providers. That connected structure is the important lesson for smaller businesses, including those in London and Manchester.

Your business does not need to be an attacker’s original target to face disruption. The services and suppliers you depend on form part of your operational security. Equally, a compromised account within your organisation could give an attacker opportunities to move further.

Microsoft found that 52.2% of intrusions involving valid accounts led to further theft of login credentials. An incident that initially looks limited may therefore develop into data theft, ransomware or wider disruption. Planning should consider where an attack could go, rather than only where it started.

Agree responsibilities before an incident

Microsoft’s recommendations are aimed at governments, but several offer a useful starting point for smaller organisations. Begin by identifying your most important services and the accounts, systems and suppliers supporting them.

Then agree who makes decisions during an incident, who contacts your IT provider and suppliers, and who communicates with staff and customers. Establish these relationships in advance rather than trying to find the right person under pressure.

Ask your IT provider how it assesses urgent security warnings and coordinates a response. The report’s emphasis on speed makes clear responsibilities and timely decisions particularly important.

Include suppliers and AI in your planning

Review incident arrangements with the providers supporting your critical work. Discuss how each party will share warnings, report problems and coordinate action if an incident affects more than one organisation. Any information exchange should respect legal and privacy requirements.

If you use AI, include it in your existing security discussions rather than treating it as a separate issue. Microsoft highlights the links between AI applications, their data, underlying technology and suppliers. Ask how security is tested and who is accountable when something goes wrong.

The wider message is that useful threat information needs to flow both ways. Receiving clear warnings and guidance matters just as much as reporting a problem.

Test whether you could keep operating

Run a discussion-based exercise with business leaders and your IT partner. Choose a scenario involving a compromised account or unavailable supplier, then work through decisions, escalation and communications.

Use the exercise to find gaps in your arrangements and clarify how essential work would continue. Microsoft’s central point is practical: resilience means containing damage and maintaining important services, not simply restoring systems afterwards.