Take these steps to guard against cyber attack threat

Against this backdrop, the UK Government has issued a stark warning to business leaders about the growing frequency and sophistication of cyber attacks. Although that warning was directed at the UK’s largest companies, the message is relevant far beyond the FTSE 350.

For Scotland’s economy, which is dominated by small and medium-sized enterprises, family-owned firms and growing scale-ups, cyber incidents can be just as damaging. At least 5 per cent of all crimes recorded by the police in Scotland last year were estimated to be cybercrimes, and disrupted operations, lost data, financial losses and reputational harm do not discriminate by company size.

This is no longer something that can be left solely to IT teams or treated as a technical afterthought.

There are three practical priorities that Scottish business owners and leaders should focus on now.

Make cyber a leadership priority

Cyber risk needs to be treated with the same seriousness as financial, legal and operational risk. That starts with clear ownership at the top of the organisation.

In larger organisations, this may involve formal board or committee oversight. In smaller businesses, it may fall to the owner, managing director or senior leadership team.

Leaders need a clear understanding of which systems and data are critical to the business, what the most likely threats are, and how well prepared the organisation would be if an attack occurred.

This does not require deep technical expertise. But it does require asking the right questions, challenging assumptions and avoiding complacency.

Use the Cyber Governance Code of Practice

The UK Government’s Cyber Governance Code of Practice is often discussed in the context of boards and large corporates, but its principles apply to organisations of all sizes.

The Code focuses on five key areas: risk management, strategy, people and culture, incident response, and assurance. Together, they provide a practical framework that leaders can adapt to their organisation’s scale and risk profile.

A central message is that cyber security should support business objectives, not sit apart from them. It should be aligned with growth plans, regulatory obligations and tolerance for risk.

People and culture are especially important. Findings from the UK Cyber Security Breaches Survey consistently show that a significant proportion of businesses experience cyber incidents each year, with phishing and other socially engineered attacks remaining among the most common causes.

Preparedness also matters. Leaders should understand how their organisation would respond to a cyber incident, who would make decisions, how customers and suppliers would be informed, and how operations would recover.

At KPMG, we support organisations across Scotland to assess their cyber maturity against the Cyber Governance Code and recognised international frameworks, helping leaders take proportionate, practical steps to strengthen resilience.

Strengthen supply chain resilience

For many Scottish businesses, cyber risk does not originate internally. Increasingly, attacks are carried out through third-party suppliers such as IT providers, software platforms or outsourced services.

Business leaders need visibility over which suppliers are critical to their operations and what level of cyber risk those relationships introduce. This does not require complex audits in every case, but it does mean asking basic questions, setting clear expectations and avoiding blind trust.

It also means considering how the business would cope if a key supplier suffered a cyber incident. Even simple contingency planning can significantly reduce the impact.

Recent Government warnings, alongside the creation of a new UK-wide cybercrime and fraud taskforce involving Police Scotland, underline how seriously these risks are now being taken.

But no national initiative can protect individual organisations on its own. Resilience still depends on how seriously leaders take the risk, how well people are prepared, and how quickly organisations can respond when something goes wrong.

Neil Coutts, Director in Cyber Security and Technology Risk at KPMG UK