UK Security Warning: State-Backed Cyberattacks Now Targeting SMEs via Supply Chains
The UK's most senior security official warned on 22 April that British businesses face a sustained rise in state-backed cyberattacks — and SMEs are increasingly the entry point, not large corporates.
On 22 April 2026, the UK's most senior security official issued a stark warning: British businesses must prepare for a sustained rise in state-backed cyberattacks. The intervention, reported by Reuters and amplified by the National Cyber Security Centre (NCSC), is being called the sharpest public warning of the year.
The message that caught many off guard: SMEs are now a primary target, not an afterthought. State-aligned attacks increasingly enter through supply chains — a 42-person professional services firm, a 120-employee logistics business, a clinic group. These are the bridgeheads into larger organisations.
The NCSC aligned this warning to its Cyber Essentials v3.3 framework — a practical checklist that any small business can work through. The core steps:
- Use strong, unique passwords and a password manager
- Enable multi-factor authentication on all accounts
- Keep software and devices updated automatically
- Back up data and test that restores work
- Know who has access to your systems and review it regularly
The AI angle: AI tools are now being used both offensively (by attackers to craft convincing phishing) and defensively (to detect anomalies and respond faster). Small businesses using AI-powered security tools — even basic ones built into Microsoft 365 or Google Workspace — are measurably better protected than those relying on manual vigilance alone.
Explore more on AdaHQ
Everything you need to start using AI in your business.