Risks
25 topics, organised by theme.
Each topic below is something we see regularly in SMEs of all sizes. You won't need all 25 — most businesses find 3 or 4 that are directly relevant. Browse by theme, or use search.
Theme 1 · 4 topics
Visibility
Knowing what you actually have.
Business-critical system audit
Do you know what technology your business actually depends on?
Hidden business risk in legacy systems
Could one old system stop your business trading?
Legacy technology modernisation
Are you relying on software nobody understands anymore?
Spreadsheet risk review
Are old spreadsheets quietly running your business?
Theme 2 · 5 topics
Access & data safety
Who can do what with company data.
Access control and accountability
Are ex-employees or old suppliers still able to access your systems?
Password and account safety
Could one weak password expose your company?
Protecting business data
Could a simple mistake delete or corrupt important data?
Data protection and compliance readiness
Do you know where your sensitive data is stored?
Manufacturing system resilience
Could one old PC stop your production line?
Theme 3 · 3 topics
Resilience & recovery
When things go wrong.
Theme 4 · 5 topics
Suppliers, AI & tools
Who's building what.
Independent review of IT suppliers
Are you paying for IT support but still carrying serious risk?
Staff-built systems and AI-created tools
Are staff building business-critical tools without you knowing?
Safe and productive AI adoption
Is AI creating hidden risk inside your business?
Website and portal risk review
Are your customer portals and websites safe?
Change control for growing businesses
Are changes being made safely, or just made?
Theme 5 · 3 topics
Decisions & evidence
Proof, priorities, spend.
Theme 6 · 5 topics
Foundations (NCSC baseline)
Phishing, mobile, malware, patching, training.
Phishing & social engineering
Can your staff spot a phishing email when it matters?
Mobile and remote work security
Are phones, tablets and home laptops your weakest link?
Malware and endpoint protection
Is your antivirus actually protecting you?
Patching & vulnerability management
Are you running months-old, patched-everywhere-else software?
Staff training & security culture