How to improve cyber security: do these first

Most advice on how to improve cyber security hands you a list of forty things and no order. A small business with no security team can't do forty things this month. It can do six, if it does them in the right order, and the right order is the one attackers have spent 2026 demonstrating.

This guide is that order. Each step maps to one of the five Cyber Essentials technical controls, plus one that comes before all of them: knowing what you expose. For every item and every number, the Cyber Essentials checklist for 2026 is the full list. This post is about which parts to do first, and why.

Why the order changed this year

Two things moved in 2026.

The first is speed. In May the NCSC's chief technology officer warned of a coming "vulnerability patch wave", because AI "is showing the ability to exploit this technical debt at scale and at pace." His advice to organisations was to apply updates to their external attack surfaces first, turn on automatic updates wherever they exist, and replace technology that is out of support. That's a national agency telling you the gap between a fix shipping and someone using the bug against you is shrinking, and that it's shrinking fastest on the things you expose to the internet.

The second is where attackers went. This year's headline intrusions came through the box at the edge: a Check Point VPN flaw that let attackers open a session with no credential at all, and a Citrix NetScaler bug shipped as a denial-of-service fix in June that was planting web shells by August. The Citrix bug went into CISA's Known Exploited Vulnerabilities catalogue, the US government's list of bugs confirmed as used in real attacks, and it's worth checking that list against your own kit every week. Neither attack needed anyone to click anything.

Meanwhile the human route never closed. The UK Cyber Security Breaches Survey 2025/2026, published by DSIT on 30 April 2026, found 43% of UK businesses reported a breach or attack in the previous 12 months. Phishing hit 38% of businesses, and 12% saw someone impersonating the organisation or its staff.

So the order below is ranked on two things: what attackers are using, and where UK businesses are furthest behind.

The gap that decides the order

The same survey asked businesses which basic controls they have. The answers are uneven:

Control	UK businesses with it
Up-to-date malware protection	81%
Network firewalls	74%
Restricted admin rights	73%
Two-factor authentication	47%
A policy to apply security updates within 14 days	34%

Only 24% reported controls in all five Cyber Essentials areas, and 5% hold Cyber Essentials itself (up from 3% the year before).

Read that table from the bottom. Malware protection, the thing most people picture when they think "security", is already done by four in five firms. Fast patching, the thing the NCSC is warning about and the thing that stopped both edge-device attacks above, is done by one in three. If you're short of time, effort spent where the gap is widest buys the most.

That's why this guide ranks antivirus last. It's still required. You probably have it already.

1. Know what you expose

What attackers did this year. Every attack above started with something answering on a public address. Attackers don't work from your asset register. They scan the internet, find what responds, and match it against known bugs. The NCSC's advice starts in the same place: its PHP alert of 21 October 2026 tells organisations to find every PHP installation, internet-facing systems first, before it says anything about updating.

What matters most. Write down every domain, subdomain and public IP address the business uses, and what runs on each. Include the things you forgot: the old booking site, the test server a contractor set up, the router's remote management page. Our post on what counts as your external attack surface explains why the real list is always longer than the one in anyone's head.

How to check. Pull the DNS records for each domain from your registrar or DNS host and look for names nobody can explain. Then check what each address actually serves. The free website security check reads a domain's TLS, certificate and header setup without a port scan, which is a reasonable first look. A full answer needs a port scan of addresses you own (only scan what you own or have written permission to test).

2. Apply security updates within 14 days

What attackers did this year. The Citrix bug is the lesson here. It was rated as a denial of service, so plenty of operators queued it for later. Later was too late. Ratings change after release, and the exploitation window is closing, which is the whole point of the NCSC's patch-wave warning.

What matters most. Two things, both straight from the Cyber Essentials requirements v3.3:

• Install updates within 14 days of release when the vendor calls the fix critical or high risk, when it fixes a vulnerability scoring CVSS v3 7.0 or above, or when the vendor gives no severity at all. If a bundle contains even one critical or high fix, the whole bundle is on the 14-day clock. Turn on automatic updates wherever they exist.
• Remove software the vendor no longer supports, or cut it off from the internet entirely. No patch is coming for it. As our post on end-of-life software covers, this one is a fail the day the vendor stops support.

Under the current Danzell question set, missing the 14-day rule for operating systems and firmware, or for applications, is an automatic fail of the whole Cyber Essentials self-assessment. Firmware is the part people forget. Your firewall and VPN appliance run software too, and those are exactly the devices attackers went after.

How to check. Start with internet-facing devices. For each one, look up the vendor's latest version and its end-of-support date, then compare it with what's running. If the gap is more than 14 days on a high-severity fix, that device goes to the top of this week's list. Then check the update history on laptops and servers, rather than trusting that automatic updates are working.

3. Turn on MFA everywhere it exists

What attackers did this year. Phishing is still the most common breach UK businesses report, per the survey figures above. A stolen password with no second factor is a working login. Fewer than half of UK businesses (47%) use two-factor authentication, which makes this the second-widest gap in the table.

What matters most. Multi-factor authentication on every cloud service where it's offered: email, file storage, accounting, payroll, the domain registrar. Under Cyber Essentials v3.3, a cloud service without MFA where MFA is available is an automatic fail, and cloud services can't be excluded from scope. Then give admins a separate account used only for admin work, never for email or browsing, so a phished inbox doesn't come with admin rights attached.

How to check. Every major cloud suite has an admin view listing which users have MFA registered. Open it and look for the gaps; there's usually a shared mailbox or a director who was "going to do it later". Then list everyone with admin rights and ask whether each one still needs them.

4. Close the admin doors in your firewall

What attackers did this year. Remote access boxes and management interfaces were the entry point for the year's edge-device attacks. A management page that answers the whole internet is a login screen waiting for the next bypass.

What matters most. The requirements say unauthenticated inbound connections are blocked by default, and every inbound rule is approved and documented with a business need. A firewall's admin interface stays off the internet unless there's a documented need and it's protected by MFA or an IP allow list plus a properly managed password. Remove rules nobody can justify.

How to check. Export the inbound rules and put a name and a reason next to each one. Any rule without both is a candidate for deletion. Our list of ports that should never face the internet covers the services (remote desktop, databases, container control planes) that turn up most often where they shouldn't.

5. Strip the defaults

What attackers did this year. Nothing clever: default passwords, guest accounts and services nobody switched off.

What matters most. Change every default or guessable password, starting with routers, firewalls, printers and anything else that shipped with one. Remove accounts and software that aren't needed, including network services. Disable auto-run. Make sure devices lock after no more than 10 failed unlock attempts, or throttle guesses.

How to check. Walk the device list from step 1 and ask, for each one: has the default password been changed, and does anything on it run that nobody uses? Then compare your user accounts with your current staff list. Leavers' accounts that still work are the usual find.

6. Confirm malware protection is actually on

What attackers did this year. Malware still arrives by email and download. But 81% of businesses already have protection, so for most readers this step is checking rather than buying.

What matters most. Every device in scope has anti-malware that updates in line with the vendor's advice, stops malicious code running and blocks connections to malicious websites. The alternative the scheme allows is application allow-listing, where only approved, signed applications can run.

How to check. Look at the protection status on a sample of laptops, not the dashboard summary. A device whose definitions stopped updating three months ago reports as "installed" just as happily as one that's working.

What a scan can and can't tell you

Steps 1, 2 and 4 are visible from the outside. That's the part CyberSpec covers: it continuously scans the assets you've verified you own and flags what a Cyber Essentials assessor would likely fail, such as end-of-life software or a known vulnerability scoring CVSS 7.0 or above, along with how long each problem has been open against the 14-day rule. It doesn't certify anything, and it can't see your MFA settings, your passwords or the inside of your network, so steps 3, 5 and 6 stay with you.

That matters for Cyber Essentials Plus too. The assessor's external scan fails any internet-facing service with a vulnerability scoring 7.0 or more, with no 14-day allowance. The CE Plus scan post walks through the rest of that test, and the Cyber Essentials overview explains how the scheme fits together.

Your first week

1. Monday: list every domain, subdomain and public IP address, and what runs on each. Run each domain through the free check.
2. Tuesday: for each internet-facing device, record the running version, the vendor's latest version and the end-of-support date. Patch anything with a critical or high fix older than 14 days.
3. Wednesday: turn on automatic updates everywhere they exist, including firewall and router firmware. Plan the removal of anything out of support.
4. Thursday: open each cloud service's admin console, enable MFA for every user, and split admin accounts from day-to-day ones.
5. Friday: export the firewall's inbound rules, delete the ones nobody can justify, and take admin interfaces off the internet.
6. Next week: change default passwords, remove leavers' accounts and unused software, and spot-check malware protection on a few real devices.

Then put a date in the calendar to do steps 1 and 2 again. The list you made on Monday will be out of date within a month, and the vendors will have shipped more fixes by then.

Sources: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026); DSIT Cyber Security Breaches Survey 2025/2026 (30 April 2026); NCSC Preparing for a 'vulnerability patch wave' (May 2026); NCSC Small Business Guide and 10 Steps to Cyber Security; CISA Known Exploited Vulnerabilities catalogue.