What would a cyber security audit find in your business?

Ask most business owners in the North East how secure their IT is and you’ll hear some version of the same answer: we’ve got antivirus, we’ve got a firewall and nothing bad has happened. That last part is doing a lot of work. Plenty of breaches go unnoticed for weeks, and plenty of businesses only find out how exposed they were after the invoice fraud, the locked files or the call from a customer asking why they received a strange email from your account.

A cyber security audit exists to replace that assumption with evidence. It’s a structured look at how your systems, accounts, devices and people actually hold up against the attacks businesses face every day. Done properly, it tells you where you’re exposed, what to fix first and what you can safely leave alone.

The numbers behind the question

The government’s own figures make the case better than any sales pitch. The Cyber Security Breaches Survey 2025/2026, published in April by the Department for Science, Innovation and Technology and the Home Office, found that 43% of UK businesses identified a breach or attack in the previous 12 months. The rate climbs with size: 46% of small businesses reported one, rising to 65% of medium businesses and 69% of large ones.

Phishing remains the dominant threat. It was the most common type of attack, reported by 38% of businesses, and the one most often described as the most disruptive. The share of businesses reporting lost revenue or share value as a result of an attack also rose from 2% to 5%. Those are national figures, but there’s no reason to think Tyneside, Wearside or Teesside businesses are any less of a target. Criminals don’t check postcodes.

What an audit is and what it isn’t

A cyber security audit is a review of your whole setup against a recognised standard of good practice. It’s not the same as a penetration test, where specialists actively try to break into a system, and it’s not the same as a certification like Cyber Essentials, though it’s often the best preparation for one. Think of it as an MOT rather than a crash test: a methodical check of the parts most likely to fail.

It also isn’t a one-off tick box. The value comes from what you do with the findings. An audit that produces a 60 page report nobody reads is money wasted. One that produces a short, prioritised list of fixes with owners and dates is one of the most useful things a business can spend on.

What a proper audit looks at

Every business is different, but a thorough review should cover at least the following areas.

• Accounts and access. Who has access to what, whether former staff still have live logins, whether admin rights are handed out too freely and whether multi-factor authentication is switched on everywhere it should be. With Microsoft retiring text message sign-in codes, this now includes checking you’re ready for Microsoft’s new sign-in changes.
• Updates and unsupported software. Whether devices, servers and applications are patched promptly, and whether anything is running on software the manufacturer no longer supports. Old Windows 10 machines and ageing servers are the usual suspects.
• Backups. Not just whether backups exist, but whether they’re separate from your main systems, protected from ransomware and actually tested. We’ve written about why an untested backup isn’t really a backup.
• Email and phishing defences. How well your email filtering, domain settings and staff awareness stand up to the attacks that cause the most damage.
• Devices. Laptops, phones and tablets, including personal devices used for work, and whether they can be locked or wiped if lost.
• Network and firewall. How your office network is segmented, what’s exposed to the internet and whether remote access is properly secured. This is where cloud managed networking can make ongoing control much simpler.
• Suppliers and third parties. Which outside companies can reach your systems or data, and what you know about their security.
• People and process. Whether staff know how to spot and report a suspicious email, and whether there’s a plan for what happens when something goes wrong. That now includes knowing which AI tools your team is using and what data is going into them.

Why an outside view matters

Internal IT teams and office managers who look after IT often do a very good job. The problem is familiarity. When you set something up yourself, you know how it’s meant to work, which makes it harder to see how it could be abused. An independent reviewer comes without those assumptions.

There’s also a practical point. An outside audit gives you evidence you can show to others. More customers now ask suppliers to fill in security questionnaires before they sign or renew contracts, a trend we covered in why your customers are starting to ask about your IT security. Insurers increasingly want the same assurances before they’ll offer cyber cover. A recent audit with a clear action plan makes those conversations far easier.

What you should get at the end

A useful audit ends with three things. First, a plain English summary of your overall position that a director can read in five minutes. Second, a prioritised list of findings, ranked by risk rather than by how technical they sound. Third, a realistic plan for fixing them, split into quick wins you can sort this month and larger projects that need budgeting.

Many of the most serious findings turn out to be cheap to fix. Switching on multi-factor authentication, removing old accounts and tightening admin rights cost very little. Others, like replacing unsupported servers, need planning. Either way, you’re making decisions with the facts in front of you.

How the audit links to Cyber Essentials

Cyber Essentials is the government-backed scheme that sets out five basic technical controls every organisation should have in place. It’s increasingly a condition of public sector and larger private contracts. The requirements were tightened in April 2026, and some issues that used to earn a note now fail an application outright. Our post on what’s catching people out with Cyber Essentials covers the details.

An audit before you apply means you find those problems on your own terms rather than on the assessor’s.

How often should you have one?

For most small and medium businesses, a full review once a year is sensible, with lighter checks in between. You should also consider one whenever something significant changes: a move to new premises, a merger, a switch of IT provider, a major new system or a new contract with strict security requirements. If you’ve never had one at all, the best time is now.

Free help for North East businesses

Not every step needs a paid consultant. The NCSC Small Business Guide sets out practical, low-cost measures any business can start on straight away. Locally, the police-led North East Cyber Resilience Centre offers free membership to small and medium-sized businesses across the region, with guidance, threat updates and affordable services. The NCSC’s Exercise in a Box tool is also a good way to rehearse how your team would respond to an incident.

If the worst does happen, cyber crime should be reported to Action Fraud, and personal data breaches that pose a risk to people may need to be reported to the Information Commissioner’s Office within 72 hours.

How to prepare for an audit

You don’t need to tidy up before an audit. The point is to see things as they are. That said, a little preparation makes the process quicker and cheaper.

• Pull together a list of the systems and software your business relies on, including cloud services like Microsoft 365, accounting packages and line of business applications.
• Note who your key suppliers are and which of them have access to your systems or data.
• Identify who in the business can make decisions about IT and security, and make sure they’re available.
• Gather any existing policies, even if they’re out of date. Knowing what’s missing is useful too.
• Think about what would hurt most if it stopped working for a day. That shapes where the audit should dig deepest.

The next step

At One IT Support we’ve spent more than 20 years helping businesses across Newcastle and the North East keep their systems secure and running. If you’d like an honest, jargon-free view of where your business stands, get in touch with our team or read more about how our IT service management keeps security under constant review rather than once a year.