Computer crime and cybercrime cover a wider range of offences than most business owners assume, and although the two terms are often used interchangeably, the distinction that matters in practice is between crimes that can only happen through a computer, like hacking into a network, and ordinary crimes, like fraud or harassment, that just happen to use a computer as the tool. For a UK business, both can land on your desk in the same week, often through the same incident.
What Counts As Computer Crime and Cybercrime
The Crown Prosecution Service splits cybercrime into two camps: cyber-dependent crime, where the offence can only exist because of computers (think hacking, spreading malware, or taking down a system with a denial of service attack), and cyber-enabled crime, where a traditional offence like fraud or stalking gets scaled up using digital tools, as set out on the CPS’s own guidance on cyber and online crime. For a small or medium business, the practical effect is the same either way. Money goes missing, customer data leaks, or systems stop working, and someone has to deal with it.
Why Smaller Businesses Get Targeted
There’s a persistent myth that criminals only go after large companies with deep pockets. In practice, smaller firms are often easier targets precisely because they have fewer defences and less time to spend checking for problems. Attackers don’t need to break into a huge bank if they can get a worthwhile payout from a fifteen-person accountancy firm with weaker email security. Most of this activity is automated and opportunistic rather than a targeted campaign against your specific business, which is actually worse news, because it means everyone’s a potential target, all the time.
The Supply Chain Problem
One area that catches businesses out repeatedly is risk sitting outside their own four walls. A business can have solid internal security and still get hit because a supplier, contractor, or software vendor they rely on gets compromised first. Attackers know that going after a smaller supplier is often the quickest route into a bigger, better-defended target further down the chain. If you haven’t looked at how your suppliers handle their own security, it’s worth reading through the issues covered in supplier risk before assuming your own defences are the whole picture.
What Reporting and Accountability Actually Look Like
When an incident happens, there’s often confusion about who’s responsible for what. Serious incidents should be reported to the police through Report Fraud, which replaced Action Fraud as the national reporting service for England, Wales, and Northern Ireland (in Scotland, call Police Scotland on 101). The legal duties sit elsewhere: a personal data breach that puts people’s rights at risk has to be reported to the ICO within 72 hours of becoming aware of it, and regulated sectors have obligations of their own. Beyond reporting, prevention sits with the business itself. No police force or regulator is going to configure your firewall for you, so the responsibility for day-to-day protection, and for having a plan before something goes wrong, stays firmly with the organisation.
Practical Steps That Actually Reduce Risk
Most of the damage from cybercrime comes from basic gaps that have gone unaddressed for months or years, things like unpatched software, weak passwords, or staff who’ve never been shown what a phishing email looks like, rather than from some brilliant, unstoppable attack. A useful starting point is checking where you stand against a recognised baseline. A Cyber Essentials readiness assessment gives a quick way to see whether your current setup would hold up against common, everyday attacks, which is where most incidents start. Fixing the basics closes off most of the easy routes in, and it’s far cheaper than dealing with the aftermath of a breach.
Budget is usually the real sticking point, and it’s reasonable to worry that proper protection only suits larger companies with dedicated IT teams. Our guide to affordable cyber security services for SMEs covers what a sensible budget buys for the many smaller businesses that don’t have a full-time security specialist on staff and need something proportionate rather than enterprise-grade and expensive.
If you’re not sure where your current defences stand, a Cyber Essentials readiness assessment is a good place to start.
