With increasing day-to-day business activities moving online, there are untold benefits in digitalising processes, including reduced costs and overheads, streamlined operations and broader market access.
However, an increasingly digital operation has challenges and drawbacks that must be addressed. One of the biggest concerns is the risk of a cybersecurity incident, which could compromise data security and damage a business’s reputation.
Cyber security incidents can take many forms, including attacks like data breaches, malware or ransomware infections. Whatever their form, they have the potential to cause an immense amount of damage in terms of costs, productivity and reputational damage, which is why an incident response playbook is so essential.
But first, it is worth highlighting the scale of the problem facing UK businesses to understand why these tools are so necessary.
The threat of cyber security breaches to UK businesses over the last 12 months highlights the seriousness of the risks to those with a significant digital presence. According to Reuters, cyber-attacks cost British companies around £44 billion in lost revenue in 2024 alone, and this figure looks set to increase in 2025. And the breadth of cyber security risks is similarly frightening, with just over half of all UK businesses reporting at least one breach during this period. In total, UK businesses faced over 750,000 malicious attempts to breach their online security and IT systems in 2024, which equates to one attempt every 42 seconds. Weekly Cyber Security News.
These statistics highlight the size and scale of the problem facing UK businesses, and most cyber security experts predict things will get worse before they get better. As reported in The Financial Times, Richard Horne, the head of the UK’s National Cyber Security Centre (NCSC), highlighted the escalating cyber threat landscape in 2025, stating: “The UK is facing a growing ‘widening gap’ in combating cyber threats.” He went on to emphasise how the growth of AI and accessible technology has led to a tripling of cyber security attacks on UK businesses over the past year, including attacks on public institutions such as hospitals and even the British Library.
In fact, the UK is the second most globally targeted country for cyber-attacks, behind only the United States.
It can be very tempting for small and medium-sized businesses to assume the real risks of cyber security breaches faced by large organisations that store vast amounts of data and deal with huge sums of money. But the reality of cybercrime is that smaller businesses are just as much at risk. Not every cybercriminal is going after the big targets, especially as they know organisations with more spending power may also have more advanced security systems. That may explain why 81% of cyber-attacks and data breaches occurred against small and medium-sized businesses in 2024. Just under half, 45%, of all SMEs in the UK were victims of phishing attacks and ransomware attacks on SMEs increased by 70% over the year.
Given the scale of the risks facing small businesses, it is surprising that many businesses are still oblivious to the dangers of not taking their protection and incident response playbook seriously. According to Reuters, only 61% of businesses used anti-virus software and only 55% utilised network firewalls. Perhaps more shocking was the fact that only 22% of UK businesses had a formal cybersecurity incident response plan in place. That means just under four out of five UK businesses have no procedural strategy for dealing with incidents when they occur.
Preparing an incident response playbook is essential for mitigating the effects of a cyber-attack, including malware infections, DDoS attacks or various other security violations. The main goal of an incident response playbook is to allow the business’s security teams to respond quickly and effectively when an attack does occur. In short, businesses must be prepared and know what to do before an attack happens so they do not respond after the fact when time may be essential for minimising damage.
There are several key elements of an incident response playbook, including preparation, detection and analysis, containment and recovery and, finally, post-incident activity. It’s worth taking a closer look at each stage to understand what businesses must do before, during and after an attack.
Preparation
The preparation stage is the most important as it revolves around preventing attacks from happening in the first instance. Businesses must understand and manage their vulnerability and employ the various cyber security tools at their disposal. These include malware prevention, escalation scenarios and ensuring communication pathways are open to all stakeholders. The plan must detail which team members are part of the incident response and clearly define their role, contact information, and when they should be contacted. Each team member needs to fully understand their role and responsibility in the event of a breach. When an incident happens, the response team must work quickly and efficiently to shut down and contain the breach. Regular risk assessments, security checks, and malware prevention should also form a part of a broader information security policy that underpins your response playbook.
Detection and analysis
Detection and analysis involve collecting data and identifying the indicators that show when an attack is taking place. Analysis takes place afterwards, when documentation, investigation and notification are required. Businesses will need to try to understand the scope of what has happened and then take appropriate measures in response. Security incidents can be detected in different ways. Signs of an attack can either be ‘precursors’, which show the signs before they happen, or ‘indicators’, which show that an attack is in progress. For example, a business may notice a high number of failed login attempts, or your antivirus software may send out an alert that infections have taken place within the network. Once an incident occurs, businesses must analyse processes to ensure they have triggered the correct responses. It also means being able to prioritise which threats are the most pressing and significant. The correct parties, such as law enforcement, customers or partners, also need to be notified at the relevant times.
Containment and recovery
This is the period after an incident has occurred when a business attempts to regain control of its data and systems. Traces of the attack need to be identified and cleaned up, and the recovery process, where normal business operations are restored, should begin. When deciding on a containment strategy, businesses should consider the following:
It may also be a good idea to consult with data security or data forensics teams to ensure the breach is fully contained. When a breach occurs, businesses can’t afford to take risks, and all vulnerabilities must be addressed.
Post-incident
Once all the immediate containment and recovery is complete and regular service is resumed as much as possible, it is time to implement effective evaluation and learning mechanisms to try and improve future incident response. Any areas of weakness, such as gaps in security systems, should be identified and rectified, and lessons implemented in future training programmes. It may be a good idea to revisit the response plan and assess what areas worked well and where improvement can be made. The notification process must also begin, with all relevant and affected parties being informed so that they can take steps to protect themselves.
A well-designed response plan can distinguish between an incident being easily contained and a major security event that leads to long-term financial and reputational damage to the business. That’s why it is essential businesses know what goes into a response plan and action this before any incidents occur. Businesses looking to develop an effective response plan should implement the following steps:
Create a policy
Develop an incident remediation and response policy to serve as a foundational document for handling all incident activities. This will give all responders the knowledge and authority to act correctly when the time comes. Any policy should be reviewed and approved by senior executives and should outline the hierarchy of priorities during an incident.
Form an incident response team
There should ideally be a single person in overall charge of incident response, acting as a team leader to oversee the policy. However, under this person, a well-defined team should handle specific areas of the response. For large organisations, this could involve covering different geographical areas or even outsourcing some areas of incident response. However the team is defined, it needs to be well trained through regular exercises to ensure it is ready for future incidents.
Develop specific responses
Within a wider playbook, there must be more specific response scenarios for all types of incidents. For example, if an employee’s phone is stolen, certain protocol steps need to be followed, such as:
● Issuing a remote wipe
● Verifying encryption
● Filing a stolen device report
● Issuing new devices
Creating these basic playbook steps for more minor incidents can prevent them from turning into larger ones.
Create a communications plan
This should address how all team members and groups need to work together during an incident and outline when external authorities need to be contacted, including law enforcement.
Of course, not all businesses have the expertise, capability or manpower to implement an effective incident response plan in-house or from scratch. In addition, although the above response playbook provides a general guide, it is also true that every business is different and requires a custom approach to deal with cyber security events quickly and confidently. That’s why we have created our incident response planning services here at ToraGuard.
Knowing how to approach and manage these security incidents is crucial when a breach happens. Attacks are becoming more varied and sophisticated, and staying up to date with effective response tactics can be difficult, especially for small or medium-sized businesses. Businesses must create tailored and robust incident response plans that minimise damage and maintain trust with stakeholders.
Here’s what comprehensive incident response planning looks like:
Conducting a risk assessment
The first phase of creating an effective incident response plan is understanding the risks and dangers facing the business. That involves identifying potential threats and vulnerabilities specific to the industry and individual business. These should be then categorised according to their severity and addressed in order of priority. Often, it is only by engaging the services of third-party providers that threats can be exposed and understood, as it can be difficult for businesses to gain a clear and objective picture of their security status.
Defining response processes
Comprehensive guidance in developing a structured plan to limit the impact of any cyber incident may be required. This includes defining response processes and identifying critical safeguards. It will also help to outline the roles and responsibilities of relevant stakeholders so that everyone knows what they need to do, and when, following any incident. It is also essential to put in place effective safeguards and triage measures, which will mitigate the scale of the damage while it is investigated.
Establishing communication protocols
Businesses must establish clear and concise communication protocols, which involves creating chains of command and pre-prepared communication drafts for various scenarios. This will help ensure they can respond confidently and quickly, no matter what security incident occurs and what levels of pressure are applied.
Stress testing plans
All too often, in the world of incident response, good intentions crumble under the pressure of an actual incident. An incident response playbook is only worthwhile if it is actionable and effective. That’s why it is essential to stress-test all plans using simulated scenarios and engineered attack exercises. This level of testing will help to check preparedness and identify any weaknesses in security measures. It will also ensure that all team members know and understand their roles and allow a vital opportunity to refine processes for maximum strength before the real thing occurs.
As more and more businesses come under threat of cyber-attacks and the consequences of these attacks become more serious, no business can afford to leave anything up to chance. Implementing an incident response plan is essential, but it may be worth investing in dedicated incident response support to be truly secure. Taking the time and expense of creating a tailored response plan could save the business considerable time, energy, and expense further down the line. With the number of businesses facing cyber security incidents each year, this investment is becoming less of a gamble and more of a sure thing.
To find out more about how ToraGuard’s incident response planning services are helping businesses around the UK to cope with the increasing threat and inevitability of cyber-attacks, get in touch with our team. Our dedicated team of security experts work with businesses to create tailored response plans, testing them thoroughly so that they can withstand varied and sophisticated attacks.
Practically every aspect of business depends on IT. However, this growing dependence has often happened without fully considering the new and evolving risks we now face.
Cybercriminals are becoming increasingly sophisticated, leveraging advanced tactics to breach corporate networks. As a result, traditional perimeter-based security models are no longer sufficient.
How can we help?
Please get in touch using the form below.
