On this page
Do attackers really pick small firms?
Mostly they pick nobody. A criminal who writes one convincing message can send it to a hundred thousand inboxes for next to nothing, then wait to see who answers. A five person studio and a hospital group get the same email. The studio has no one whose job is to doubt it.
The Swiss National Cyber Security Centre says fraud dominates the reports it receives: 27,128 voluntary reports in the first half of 2026 alone. The UK government asks businesses the same question every year. In the latest round, 46% of small businesses (ten to 49 employees) and 42% of micro businesses (one to nine) said they had found an attack in the previous twelve months. Medium and large firms report more, 65% and 69%, so size protects nobody. Small firms are far from exempt.
How often small firms are hit
46%
of small businesses in the UK found an attack or an incident in the past twelve months. For micro businesses it was 42%.
Source: UK government survey of business cyber security, 2025/2026
60%
of the ways attackers first got in, across 4,875 incidents studied in Europe, started with phishing.
Source: ENISA, EU threat report 2025
Phishing is the common way in. Fieldwork for the UK survey ran from August to December 2025, and 38% of all businesses had met phishing, more than any other kind of attack.
Why do small firms stay easy to reach? Not because anyone studied them. Their Macs run on default settings, one person holds the keys to every account, and an odd request from a client gets answered because the answer takes ten seconds. A larger company has layers that catch some of this. A small one has the person who opened the email.
What is phishing?
What phishing is.
A message built to make someone do something they should not: type a password into a fake page, open an attachment, pay an invoice that looks right. It arrives as an email, a text message or a call, often as a voice call from a person who claims to be the IT helpdesk.
The trick is rarely technical. The message only has to look like it belongs in the day.
How do attacks hurt a small firm?
Less often in money than you might expect, and more often in time. The UK survey asked each business what its most disruptive incident cost. The middle answer was £0. Only the top five percent of answers reached £4,000, for small firms and for all businesses alike. Owners gave their own estimates, so read those figures as a feel for the size, not as a bill.
Time shows up in the next set of answers, from businesses that had an incident. Three in ten reported at least one effect. Nineteen percent had to take up new protections afterwards, 16% spent extra staff time on it, and 11% found that staff could not do their normal work for a while.
A small team feels a lost day as a day without a product, a missed delivery to a client, a founder doing clean up instead of selling. And the survey leaves out the most important part. When a client’s files or keys are involved, the question stops being what it cost you. It becomes whether that client stays, and what the next questionnaire asks.
Most incidents cost almost nothing. Be ready for the one that does.
Being ready starts with a written plan, and here small firms trail most. Only 21% of micro businesses in the survey had a formal incident plan, against 76% of large businesses. That gap costs nothing to close. It takes one page.
What is ransomware?
What ransomware is.
Software that locks your files and demands payment to give them back. Paying does not guarantee you get the files back, and a backup you have tested is the better answer.
It usually gets in the way phishing does: someone opens a file or runs a program they should not have.
What does AI change for each side?
For attackers it changes the quality of the message. In January 2024 the UK National Cyber Security Centre judged that AI would almost certainly raise the volume and the impact of attacks over the following two years. It singled out social engineering, the part where a person is talked into something. Phishing often gives itself away through odd spelling and grammar. The centre expected AI to remove those tells, and to make it hard for anyone, whatever their security knowledge, to tell a genuine email or password reset from a fake. It also found the biggest gain among the least skilled criminals, who start from a low base.
The numbers are moving the same way. ENISA, the European Union agency for cybersecurity, passes on a report that more than 80% of social engineering activity seen worldwide by early 2025 already used AI to some extent, and it marks the figure as reported, not measured. On 24 August 2026 the Swiss centre wrote that attackers now use AI systematically to deliver tailored, personal and credible content to their victims.
Defenders get the same technology, and the UK assessment is careful about what that buys. Detection and secure design offset part of the effect, it says, and more work is needed to show how far.
A better written message is harder to doubt. A setting that stays on does not read it.
That is why reading every message more carefully cannot be the whole defence. What still works is dull and mechanical: the Mac has its own safety switches on, a program that behaves like an attack gets stopped, and somebody sees it when a switch drifts. None of that depends on how well the message was written.
What can a small team borrow from a big one?
A large company covers its Macs with people and paperwork. A small team can cover the Mac part of that ground with software that does the same job on a timer. Cybee, which runs on Macs with an Apple chip, M1 or newer, on macOS 15 or newer, works this way.
Every Mac audits itself three minutes after it joins and then every 12 hours. You pick one of three levels of safer settings: Essential changes nothing, Balanced and Fortress turn on more of the Mac’s own switches. A setting that drifts is put back and recorded. A setting nobody agreed to is never changed, and everything is reversible.
what a large company haswhat a small team can have today
-
Someone who checks the settings
Automatic checks, every 12 hours on every Mac.
-
A policy binder
Settings applied at the level you pick, and put back when they drift.
-
An audit trail
A Trust Passport: a dated record of how your Macs are protected, shared by link.
-
Someone who knows which tools people use
A list of the AI tools on each Mac, with two alerts.
The Trust Passport records technical observations on the Macs it lists, with dates. A fingerprint at its foot shows the page is unchanged since Cybee sealed it. It does not check the facts a second time, and it is not an audit or a certification.
Protection and the safer settings are free on every Mac. The sealed Trust Passport belongs to the paid plan, called the Cybee subscription.
What are the 118 checks?
What the 118 checks are.
The CIS Benchmark for macOS is a public list of the safest settings for a Mac, kept up to date by an industry group. It sorts them into two levels. Cybee audits every Mac against all 118 checks, such as whether disk encryption and the screen lock are on.
Cybee has no formal relationship with CIS. It uses the public list as the source of every check.
Where does your AI assistant fit in?
There is no separate screen to log in to. Your AI assistant builds any view you ask for: you type a question in the AI assistant your team already uses, such as Claude or Cursor, and Cybee answers from the dated record on your Macs. The answer is the same in every AI assistant, and it comes as a short card or as plain text.
you ask your AI assistant
ClaudeAre our Macs set up safely?
Cybee answers from the dated record
Macs4 of 4 assessed.
checks117 of 118 hold.
alerts0 open.
open itemScreen lock is off on Mira’s MacBook Air since Thursday 14:02.
what it showsWhat was true at 09:41. Not a promise about tomorrow.
next stepMira says yes, then Cybee turns it on.
The AI part of Cybee stops there. There is no AI model in Cybee’s backend that decides what is malicious. Detection, safer settings and fixes run on the Mac itself, and Cybee acts on the Mac first: it quarantines a file, stops a program or puts a setting back.
The AI assistants your team uses are a risk of their own, because one can run commands and reach other tools. Cybee lists the AI tools on each Mac and the outside tool servers each one trusts, so a forgotten connection does not stay hidden. It raises two alerts: when an AI agent tries to run a destructive command, and when it tries to disable or alter security tooling. It alerts. It does not stop the agent, and it does not limit what an agent can reach.
What still needs a person?
Plenty. Cybee covers the technical controls on your Macs. It does not cover your accounts, your backups, your phones or your policies, and a record of the Macs does not answer for them.
The UK National Cyber Security Centre’s small business guide names three places to start: backups, protecting your devices and accounts, and spotting scams. For the accounts, turn on a second step at sign in for email and every cloud tool that holds client work. For backups, restore one file from a backup this month, so you know it works before the day you need it.
And write the plan. One page: who to call first, who tells the client, which accounts to lock if a laptop goes missing. Keep it where anyone on the team can find it. A plan that exists beats a better one that does not.
What to remember.
Pick one Mac this week and ask what is open on it. Write the one page plan the same afternoon, while nothing is wrong.
Sources and product scope.
Written by Cybee for small teams. Every outside figure comes from a page opened on 28 October 2026. The product statements come from our own documentation.
- UK government: cyber security survey of businesses 2025/2026, published 30 April 2026
- ENISA: EU threat report 2025, press release of 1 October 2025
- UK NCSC: the near term impact of AI on the cyber threat, January 2024
- Swiss National Cyber Security Centre: semi annual report 2026/1, 24 August 2026
- UK NCSC: Small Business Guide
- Cybee: the three levels of safer settings
Turn the checks on for your Macs.
See what each of the three levels changes on a Mac, and how to put every change back.
