10 Tips to Improve Your Organisation’s Cyber Security

Improving your organisation’s cyber security does not need a huge budget or a team of specialists.

It needs a short list of habits done consistently: know what you own, fix known weaknesses fast, protect logins, train people, back up your data, and rehearse what you will do when something goes wrong.

This guide gives you ten tips, each tied to the latest 2026 evidence. You can work through them in order or jump to the ones your team has not tackled yet.

Why Do These Tips Matter Right Now?

The numbers from 2026 show that attackers are getting faster and breaches are getting more expensive:

Cost: IBM and the Ponemon Institute’s 2026 Cost of a Data Breach Report puts the global average at $4.99 million, up 12% on the year before.
In the United States, the average reached $11.5 million. The report analysed 602 breaches across 17 industries between March 2025 and February 2026.
Entry point: Verizon’s 2026 Data Breach Investigations Report (DBIR), published in May 2026, examined more than 31,000 incidents, including over 22,000 confirmed breaches in 145 countries.
For the first time, exploiting software vulnerabilities (31%) topped stolen credentials (13%) as the most common way in.
How common it is: The UK government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that 43% of UK businesses and 28% of charities had a breach or attack in the previous 12 months.
Phishing was the most common type, affecting 38% of businesses.

The 10 Tips at a Glance

#	Tip	Main risk it reduces
1	Know every device, account and system you own	Hidden, unmanaged assets
2	Find and fix vulnerabilities faster	Exploited software flaws
3	Use multi-factor authentication everywhere	Stolen or guessed passwords
4	Train staff for phone, text and email scams	Social engineering
5	Limit access to what each person needs	Damage after a compromise
6	Back up your data and test the restore	Ransomware and data loss
7	Check the security of your suppliers	Third-party breaches
8	Set clear rules for AI tools	Data leakage and AI-driven attacks
9	Write and rehearse an incident response plan	Slow, costly breach response
10	Build on a recognised baseline and give security an owner	Gaps in governance

Tip 1: Know Every Device, Account and System You Own

You cannot protect what you cannot see. Start with a simple inventory of laptops, phones, servers, cloud accounts, software and the people who have access to each.

Verizon’s 2026 report lists asset visibility first among the basics that still matter most.

Keep the list alive. Review it monthly, remove old accounts when people leave, and flag any device that is not managed by your IT team.

The UK’s Cyber Essentials scheme, run by the National Cyber Security Centre (NCSC), also asks organisations to define the scope of devices and services it covers before they certify.

Tip 2: Find and Fix Vulnerabilities Faster

This is the biggest shift in the 2026 data. Verizon found that only 26% of critical vulnerabilities (those listed in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue) were fully fixed in 2025, down from 38% the year before.

The median time to fix them rose to 43 days from 32. Organisations also had about 50% more critical flaws to patch than in the previous dataset.

Here is how to catch up:

Scan regularly. Use a vulnerability scanner across servers, laptops, cloud systems and websites.
Fix by risk, not by volume. Start with flaws attackers are already using, and with systems facing the internet.
Set deadlines. The NCSC’s Cyber Essentials requirements v3.3 treat security update management as one of five core technical controls. Many organisations aim to apply critical updates within 14 days of release.
Turn on automatic updates wherever your systems allow it.

Tools such as Tenable Nessus and Tenable Vulnerability Management are built for exactly this job, and Tenable also sells a wider exposure management platform, Tenable One.

Other vendors compete in this space too. Before you choose, compare what each plan includes, such as how many assets it covers, whether it scans cloud and web apps, and how it ranks risk.

You can review the Tenable pricing plans alongside other quotes and pick the tier that matches your estate. Run a free trial first if one is on offer.

Tip 3: Use Multi-Factor Authentication Everywhere

Passwords alone are not enough. Multi-factor authentication (MFA) asks for a second proof, such as an app prompt or a security key, so a stolen password cannot open the door by itself.

Verizon’s data shows why gaps linger. Among third-party organisations with missing or poorly set up MFA on cloud accounts, only 23% fixed the problem completely.

Weak passwords and permission errors took even longer, with half of findings taking almost eight months to resolve.

Put MFA first on:

Email and cloud services
Admin and finance accounts
Remote access and VPNs
Any supplier portal that holds your data

Where possible, move to phishing-resistant options such as passkeys or hardware security keys, and give staff a password manager so they stop reusing passwords.

Tip 4: Train Your People for Modern Scams

Attackers still go after people. Verizon reports that a human element was present in 62% of breaches, and social engineering was the third most common breach pattern at 16%.

Phishing remained a leading entry point, and pretexting, where an attacker builds a believable story to win trust, reached 6% of breaches.

The delivery method is changing. In phishing simulations, successful click rates on mobile-centric attacks, such as voice calls and text messages, ran about 40% higher than via email.

IBM’s 2026 data tells a similar story: phishing, including voice and SMS versions, was linked to the highest average breach cost at $5.29 million.

Make training practical:

Teach staff to verify unexpected requests for money or access by calling back on a known number.
Run short, regular simulations that include texts and phone calls, not just email.
Give people an easy way to report something suspicious, and thank them when they do.

Tip 5: Limit Access to What Each Person Needs

If an attacker gets into one account, the damage depends on what that account can reach. Apply the principle of least privilege:

Give people only the access their job needs.
Use separate admin accounts for admin tasks, and never for everyday email or browsing.
Remove access promptly when someone changes roles or leaves.
Review who has admin rights every quarter.

User access control is one of the five technical controls in NCSC’s Cyber Essentials requirements, alongside firewalls, secure configuration, security update management and malware protection.

Tip 6: Back Up Your Data and Test the Restore

Ransomware grew again in Verizon’s 2026 data and now shows up in 48% of breaches, up from 44%.

The good news is that 69% of ransomware victims did not pay, and the median payment fell to $139,875 from $150,000. Good backups give you that option.

A strong backup routine looks like this:

Keep at least one copy offline or in a protected “write once” store that ransomware cannot encrypt.
Back up business-critical systems and cloud data, not just laptops.
Test restores at least twice a year. A backup you have never restored is a guess.
Write down how long recovery would take and agree whether the business can live with it.

Tip 7: Check the Security of Your Suppliers

Your risk includes the companies you rely on. Verizon found that third parties were involved in 48% of breaches, a 60% increase on the previous year’s dataset.

For small and medium-sized businesses in its data, the figure was 55%.

You do not need a huge programme to start:

List your key suppliers and what data or access each one has.
Ask for evidence of basic controls, such as Cyber Essentials certification or an independent audit.
Put security requirements and breach notification terms in contracts.
Remove supplier access you no longer need.

The UK survey makes the same point, urging organisations to map their processors and build security into procurement.

Tip 8: Set Clear Rules for AI Tools

AI is now part of both the attack and the defence. Verizon found that threat actors use generative AI at many stages, from picking targets to writing malware, with the median actor using AI help in 15 documented techniques.

IBM reported that AI-enabled breaches added roughly $1 million to the average cost.

Staff use matters too. In Verizon’s data, 45% of employees were regular AI users on corporate devices, up from 15% a year earlier, and 67% of users accessed AI services through non-corporate accounts.

Source code was the most common data type sent to external AI tools. The UK survey adds a gap:

While 31% of businesses were using, adopting or considering AI, only 24% of those had measures to manage the related cyber risks.

Put simple rules in place:

List which AI tools are approved and which data types may never be pasted into them.
Provide an approved company account so staff do not use personal ones.
Use data loss prevention tools to catch sensitive uploads.
Update your policies when you adopt new AI features.

IBM also found that organisations using AI and automation widely in security operations saved about $1.93 million per breach and contained incidents 65 days faster than those using none.

Tip 9: Write and Rehearse an Incident Response Plan

Speed matters once an attack begins. IBM reports that the average time to identify and contain a breach rose to 247 days in 2026, the first rise in five years.

Breaches that lasted more than 200 days cost an average of $5.65 million, against $4.32 million for those contained sooner.

Yet many organisations have no plan. In the UK survey, only 25% of businesses had a formal incident response plan, according to summaries of the findings.

A usable plan fits on a few pages and covers:

Who leads and who has authority to shut systems down
Who to call: IT, legal, insurers, regulators, and a forensic firm if you have one
How to communicate with staff, customers and the press
How to restore from backups

Run a tabletop exercise once or twice a year. Walk through a ransomware scenario and see where decisions stall.

Tip 10: Build on a Recognised Baseline and Give Security an Owner

Strong security needs someone accountable and a standard to measure against.

The UK survey found that board-level responsibility for cyber security existed in 31% of businesses, up from 27%, while 72% said it was a high priority for senior management. Turning priority into ownership is the next step.

Choose a framework and work toward it. In the UK, Cyber Essentials is the NCSC’s recommended baseline, built on five technical controls:

Firewalls, secure configuration, security update management, user access control and malware protection.

The NCSC’s latest requirements document is version 3.3. You can read it in the NCSC Cyber Essentials requirements.

Organisations in other regions can use frameworks such as the NIST Cybersecurity Framework or the CIS Critical Security Controls.

Name a person responsible for security, report on it to leadership each quarter, and track a few simple numbers, such as how fast you patch critical flaws and how many staff use MFA.

How to Budget for Security Improvements

Most of these tips cost time more than money. A few need software or services, such as vulnerability scanning, backup storage and training. To keep spending sensible:

Rank your gaps by risk and fix the cheap, high-impact ones first, such as MFA and patching.
Get at least two quotes for any paid tool, and ask what is excluded.
Check renewal prices, not just the first-year price.
Time larger purchases around vendor promotions where you can.

Black Friday falls on November 27 in 2026, and security vendors sometimes run sales around it.

If vulnerability management is on your list, look at the $958 off Tenable Black Friday deal and check which products and plans it applies to, the term length and the end date before you buy.

Do not delay critical fixes while you wait for a discount.

A 30-Day Quick-Start Plan

Week 1: Visibility

Build your asset and account inventory.
Identify your most sensitive data and who can access it.

Week 2: Fast wins

Turn on MFA for email, cloud services and admin accounts.
Remove unused accounts and review admin rights.

Week 3: Fix and protect

Run a vulnerability scan and patch the highest-risk items.
Check that backups work and that one copy is offline or protected.

Week 4: People and process

Brief staff on phone, text and email scams.
Publish an AI use policy and draft your incident response plan.

Frequently Asked Questions

What is the most important cyber security step for a small organisation?

Start with MFA on email and cloud accounts, regular updates, and tested backups. These three steps close the most common routes in. Verizon’s 2026 data shows small and medium-sized businesses face the same top threats as larger ones, often with fewer resources.

How often should we patch systems?

Apply critical and high-risk security updates as soon as you can, ideally within 14 days of release, and sooner for flaws that are known to be exploited. Automatic updates help for most everyday software.

Is cyber insurance enough?

No. Insurance may help with costs but does not stop an attack or restore your systems. Insurers often ask about controls such as MFA and backups anyway, so the tips above support your cover too.

Do we need a vulnerability scanner?

If you run servers, cloud services or a website, a scanner helps you find flaws before attackers do. Smaller organisations with simple setups may start with built-in update tools and a basic scan, then move up as they grow.

How can we make staff training stick?

Keep it short, repeat it often, and use real examples, including voice and text scams. Reward people for reporting suspicious messages instead of blaming those who click.

Where can UK organisations get free guidance?

The NCSC publishes free advice for businesses, an Early Warning service for alerts, and information on Cyber Essentials certification.

Final Thoughts

You cannot remove every cyber risk, but you can make your organisation a much harder target. Start with the basics:

See what you own, patch quickly, protect logins, train your people, back up your data and plan for the worst day.

Then keep checking your progress, because attackers will keep changing their methods.

Sources

Verizon, “2026 Data Breach Investigations Report: Executive Summary,” May 2026. https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
Baker Donelson, “Ten Takeaways from IBM’s 2026 Cost of a Data Breach Report.”. https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report
GOV.UK (DSIT and Home Office), “Cyber Security Breaches Survey 2025/2026,” published 30 April 2026. https://gov.uk/government/statistics/cyber-security-breaches-survey-20252026
NCSC, “Cyber Essentials: Requirements for IT Infrastructure,” version 3.3. https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf