What does a cyber incident look like in a small business?
A cyber incident in a small business rarely announces itself; it usually looks like an odd glitch that someone mentions in passing. The NCSC lists warning signs such as computers running slowly, people locked out of accounts or files, ransom messages, suspicious emails sent from your own domain and unexpected payment requests.
Take a fictional 14-person accountancy practice, Halden & Rowe. At 4.40pm on a Friday the office manager, Priya, gets this message from a partner: 'my outlook sent loads of emails I didnt write?? 2 clients replied asking about a new bank account for invoices. also shared drive asking me to log in again and my password doesnt work. off to school pickup back at 6'. Nobody owns IT full time, the managed IT provider closes at 5.30pm, and the weekend is coming.
What are the steps of incident response for a small team?
The steps of incident response for a small team are recognise, contain, report, recover and learn, and the first hour is mostly about the first three. The NCSC small business response and recovery guide uses a similar five-step model: prepare, identify, resolve, report and learn.
1. Recognise and start a log
Treat the report as a possible incident, not a nuisance. Open a log with the time, who reported it, what they saw and every action taken. The NCSC suggests noting which services stopped, when it began and how far it reaches.
2. Contain the damage
Stop the spread without destroying evidence. Disconnect an affected device from the network rather than switching it off, because CISA notes that powering down can lose evidence held in memory. Reset the compromised account's password from a clean device and sign it out of all sessions.
3. Call for help early
Ring your IT provider or whoever manages your systems before they close. In the UK, the NCSC tells a business, organisation or charity affected by a cyber incident right now to call Report Fraud on 0300 123 2040 and press option 9. In the US, CISA and the FBI's IC3 accept reports.
4. Report and inform
Report the crime to law enforcement and tell the people affected. If personal data may be exposed in the UK, the ICO says you must notify it where feasible within 72 hours when the breach is likely to put people at risk.
5. Recover and learn
Restore from clean, tested backups, patch what was exploited, and hold a short review once things are calm. Write down what went well and what you would change.
What does a weak and a strong first hour look like?
A weak first hour is quiet and improvised. Priya deletes the strange sent emails, asks the partner to change the password on Monday and says nothing to clients. By Monday the attacker has had the mailbox all weekend, the evidence is gone and one client has paid the fraudster.
A strong first hour is calm and written down. At 4.45pm Priya opens a log and records the partner's message word for word. At 4.50pm she calls the IT provider, who disables the mailbox sign-ins and forces a password reset with multi-factor authentication. At 5.05pm she phones the two clients on numbers from the practice's own records and tells them not to pay any changed bank details. At 5.20pm the provider finds a rule forwarding invoices to an outside address and records it for investigation. Before 6pm she reports the incident and books Monday's review. None of this needs technical skill.
Can AI tools help during incident response?
AI tools can help you prepare and communicate, but they should not make containment decisions or see sensitive evidence. Use them to draft a one-page plan in advance, turn a rough log into a timeline, or draft a customer notice that a person checks. Never paste logs, passwords or personal data into an unapproved tool.
How do you check your incident response worked?
You check your response by confirming that the attacker's access is closed, the people at risk know, and your log could explain every decision to someone who was not there.
Access closed
Passwords reset, sessions ended, suspicious mailbox rules or new admin accounts recorded and handled by your IT provider.
People informed
Affected clients, staff and, where required, regulators or law enforcement have been told through trusted channels.
Evidence kept
Nothing was deleted to tidy up, and the log has times, actions and who made each decision.
Lessons recorded
The review names one change to make, such as multi-factor authentication everywhere.
What are the common incident response mistakes?
The most common mistake is waiting to be sure, because by the time an incident is certain the damage has spread. Others: deleting evidence to tidy up, switching machines off instead of disconnecting them, warning people from the compromised mailbox, keeping quiet with customers, and having no out-of-hours IT number.
Where does this lesson sit in Tosheo.ai?
This lesson belongs to the Cybersecurity category and the cybersecurity course. In Tosheo.ai the hands-on task gives you a messy report like Priya's, asks for the first-hour log and actions, and marks it against a visible rubric. It is awareness training, not a professional incident-response or forensics course, and it does not replace your IT provider.
Sources and scope
NCSC, Small Business Guide: Response and Recovery (checked 19 October 2026) ↗
NCSC, Step 2: identify what is happening (checked 19 October 2026) ↗
CISA, I've been hit by ransomware (checked 19 October 2026) ↗
ICO, report a personal data breach (checked 19 October 2026) ↗
NCSC, mitigating malware and ransomware attacks, on ransom payments (checked 19 October 2026) ↗