Cybersecurity for Small Businesses: Lessons Learned from 2024 and Predictions for 2025
Ariana Grande and Cynthia Erivo held hands a lot, UGG boots made a comeback and fury broke out in the UK towards the shrinkflation of Quality Street boxes. 2024 was a wild year and 2025 doesn’t show signs of mellowing.
With this in mind, I want to briefly reflect on the cybersecurity landscape in 2024 and discuss what we can take from it in order to strengthen and prioritise our defences in 2025. I've done so with small businesses in mind, but I hope you find it useful, no matter your position.
Key Trends from 2024
1. Rise in AI-Powered Attacks
2024 saw a 43% increase in AI-enhanced cyber attacks compared to 2023, according to Check Point Research. A vast number of these sophisticated attacks targeted small businesses, with AI being used to create more convincing phishing emails and social engineering attempts.
2. Ransomware Evolution
The average ransomware payment reached $350,000 in 2024, with small businesses accounting for 46% of all attacks (Coveware Q4 2024 Report).
3. Cloud Security Challenges
With remote work becoming permanent, cloud security incidents increased by 35% in 2024, with misconfiguration errors being the leading cause (IBM Security Report 2024).
As overwhelming as these stats seem, the positive is that we can defend against the vast majority of these attacks. It might just take a little preparation, forward leaning and a little fiddling with your security and privacy settings.
Predictions for 2025
1. Quantum Computing Threats
In short, our passwords are going to be more easily cracked.
If you want the background, quantum computing is a technology that has the potential to solve complex problems exponentially faster than classical computers, particularly in areas like encryption (cryptography) which is what protects our data from being read by people we don’t want to read it.
Experts predict early quantum computing attacks could begin targeting current encryption methods in 2025-2026, putting sensitive data at risk. The National Institute of Standards and Technology (NIST) is developing post-quantum cryptography standards to address it.
2. Internet of Things (IoT) Vulnerabilities
IoT refers to all the things that connect to the internet. Beyond your phone, we’re talking about your Alexa, your printers and if you’re especially boujie, your coffee machine - any smart devices in your home and business, including security cameras, smart thermostats, and industrial IoT sensors.
These devices often have weak default passwords, infrequent security updates, and can serve as entry points for attackers to access larger networks. Small businesses are particularly vulnerable as they often lack dedicated IT staff to properly secure and monitor these devices.
In 2025, connected device attacks are expected to increase by 55% (Gartner Forecast 2025).
3. Supply Chain Attacks & Pressure on Small Businesses
According to recent studies, 60% of cyberattacks now come through the supply chain, with attackers exploiting vulnerabilities in smaller companies that often have less robust security measures. These attacks typically involve compromising software updates, third-party services, or vendor access credentials to infiltrate multiple organisations simultaneously.
Small businesses will face increased scrutiny as supply chain attacks are predicted to double in 2025.
So what should you do? My suggested priorities and actions:
Firstly, don’t panic. There are small but mighty moves you can make that will greatly enhance the security of you and your business. Here are a few that I think should be top of your list.
1. Zero Trust Implementation
It sounds a little personal, but ‘zero trust’ benefits all. Think of traditional security like a castle wall - once someone gets past the wall, they have access to everything inside. Zero trust is different: it's like having a security guard at every door inside the castle who checks everyone's ID, even if they've already been let in. This means:
Every user must prove who they are, every time they try to access something
No one is automatically trusted, even if they're already inside the network
Access is granted only to specific resources people need, not everything
2. Employee Training
With 82% of breaches involving human error (Verizon DBIR), regular security awareness training is crucial.
Regular phishing simulation exercises to test your team’s awarenss
Monthly security updates and best practices workshops
Training on identifying social engineering attempts
Password management and data handling protocols
A positive security culture where everyone feels safe reporting errors or suspicious activity
Training should be interactive, relevant to your team’s daily tasks, and updated regularly to address emerging threats.
3. Multi-Factor Authentication (MFA)
Multi-Factor Authentication (MFA) should be required for all business applications. MFA adds extra security layers beyond passwords by requiring multiple forms of verification:
Something you know (password)
Something you have (phone or security key)
Something you are (fingerprint or face scan)
When implemented properly, MFA reduces the risk of unauthorised access considerably sand is well worth the extra effort.
4. Incident Response Planning
Create and practice a step-by-step plan for handling cyber attacks or data breaches. Consider it a fire drill - everyone needs to know what to do in an emergency. Companies that regularly practice their response plans typically spend far less time and money fixing problems when they happen compared to unprepared companies. Your plan should include:
Who to contact first
How to stop the attack from spreading
Steps to protect customer data
How to communicate with customers and staff
5. Sign up to The Key, a free 5 day course in cybersecurity for small businesses
The new program is designed for those who own and run small businesses, wanting to strengthen their defences but are unsure where to start.
In under 3 hours over the space of one week, the program will guide you to build in solutions to build resilience, professionalise your brand and protect your business and it’s clients.
No matter your tech level, these are the essential, bare minimum kind of defences you need to pay attention to for a successful year ahead.
Remember, cybersecurity is not a one-time investment but a continuous process. Stay informed, stay prepared, and prioritise security in your business strategy for 2025.
Including a look back to 2024 to see what we can learn.