Monday morning. Someone in finance notices a payment went somewhere it should not have.

That is how a meaningful proportion of cyber incidents actually begin for SMEs. Not a dramatic system failure, not a ransom note on every screen, but a quiet, unsettling discrepancy that someone happens to notice. A supplier chasing an invoice you are sure you paid. A bank account detail that does not look quite right. An email in a sent folder that nobody remembers writing.

What happens in the hours immediately afterwards shapes every consequence that follows: how much money is recovered, whether the insurer pays, whether the regulator gets involved, and how much damage is done to relationships with customers and suppliers. Yet most SMEs have never thought through what those hours should look like until they are living through them.

How these incidents usually start

Payment diversion fraud is one of the most common ways a cyber incident first shows itself in a business. In an invoice or mandate scam, a business tries to pay a genuine supplier, but a criminal intervenes and persuades it to send the money to an account they control instead. In a CEO scam, the criminal impersonates a director or senior manager to request an urgent payment.

The scale is significant. According to UK Finance’s latest annual fraud report, invoice and mandate scams alone caused £41.3 million of losses across 2,305 cases in 2025. These are rarely opportunistic. UK Finance warns that criminals may target a business over several months, building a picture of who authorises payments, and can even use information on company websites about genuine suppliers.

Here is the part that matters most for the first hours. A redirected payment is very often a symptom, not the incident itself. If a criminal knew exactly when an invoice was due, which supplier to impersonate and how your finance team writes its emails, there is a good chance they have had access to a mailbox, possibly for weeks. The missing money is what you noticed. The compromised account is what you need to investigate.

The instinctive first call is often the wrong one

The instinct for most businesses is to ring the MSP. That is understandable: they run the systems, they know the environment, and they are the people you call when something goes wrong.

But it is often the wrong first call. An MSP may well have a role to play, but they are also, in many cases, part of the environment being investigated. If the attacker got in through a misconfigured system, a missing control or an unmanaged account, the MSP’s own work is part of the question. That creates a potential conflict between their commercial relationship with you and an impartial assessment of what went wrong. This is not a criticism of MSPs. It is the same reason you would not ask the builder to sign off his own structural survey.

There is also a practical risk. A well-meaning engineer who resets passwords, wipes a laptop or “cleans up” a mailbox can destroy exactly the evidence an investigator or insurer needs. Speed matters, but the wrong kind of speed makes things worse.

The first calls should do three things: establish containment, preserve evidence, and get an accurate picture of scope, before anyone starts making changes that could complicate a later investigation or insurance claim.

What the first hours should actually look like

Every incident is different, but the sequence for a suspected payment diversion or account compromise usually looks something like this.

In the first hour

Call your bank immediately. Use the number on the back of your card or your bank’s official fraud line, not one from an email. Report the payment as fraud and ask the bank to contact the receiving bank. The chances of recovering money fall quickly once it has moved on, so this call cannot wait for an internal meeting.

Call your cyber insurer’s incident line, if you have one. Many policies require you to notify them promptly and to use their appointed incident response specialists. Calling them early protects your claim and often gets you expert help faster than you could arrange yourself. Keep that number somewhere you can find it without access to your email.

Stop further payments to any supplier whose bank details have changed recently until they have been verified by phone using a number you already hold.

Do not start deleting or rebuilding anything. Change passwords on the obviously affected accounts if you need to stop ongoing access, but leave investigation and remediation to people who know how to preserve evidence.

In the first day

Understand scope. Which mailboxes were accessed? Were forwarding rules set up? Were other suppliers or customers emailed from your accounts? Was personal data viewed or downloaded? This is where independent incident response expertise earns its keep.

Bring in the right people: the insurer’s panel, your MSP under direction rather than in charge, and legal advice if personal data or significant sums are involved.

Start a written log of what was found, when, by whom and what was done. This becomes the backbone of any insurance claim, regulatory notification or police report.

Report it. In England, Wales and Northern Ireland, fraud and cybercrime are now reported through Report Fraud, the City of London Police service that replaced Action Fraud on 4 December 2025.

Within 72 hours

Decide whether a regulatory notification is required. This is where the clock becomes critical.

The regulatory clock is already running

Under UK GDPR, a personal data breach that is likely to result in a risk to people’s rights and freedoms must be reported to the ICO without undue delay and, where feasible, within 72 hours of the organisation becoming aware of it.

“Becoming aware” has a specific meaning. You are considered aware when you have a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. You can carry out a short initial investigation to establish that, but the clock starts when that certainty is reached, not when the investigation is finished.

That distinction matters enormously in practice. If a criminal has been inside a finance mailbox, that mailbox will almost certainly contain personal data about staff, customers or suppliers. The question of whether you are notifying the ICO is therefore one you may need to answer while you are still working out what actually happened. And weekends do not pause the clock: if you become aware on a Friday evening, you should still aim to notify by Monday evening.

The good news is that you do not need all the answers within 72 hours. You can submit an initial notification with the information you have and follow up with more detail as it becomes available. What you cannot do is ignore the deadline. If you report late, you must explain why.

Don’t assume the bank will refund you

Many business owners have heard that banks now have to reimburse victims of authorised push payment fraud. That is true, but only for some.

Since 7 October 2024, mandatory reimbursement rules set by the Payment Systems Regulator cover individuals, micro-enterprises and smaller charities, up to a maximum of £85,000. A micro-enterprise means a business that employs fewer than 10 people and has annual turnover under £2 million.

A business with 25 or 35 staff is outside that scheme. Banks will still look at claims case by case, but there is no automatic right to a refund. For most growing SMEs, recovery depends on how quickly the bank is contacted, whether the money can be traced, and whether you have suitable insurance cover.

Why so many businesses get this wrong

The pattern is not a lack of competence. It is a lack of preparation. According to the government’s Cyber Security Breaches Survey, only a quarter of UK businesses have a formal incident response plan. Even the basics are patchy: assigned roles during an incident exist in 39% of businesses, and written guidance on who to notify in 34%.

Without a plan, decisions get made by whoever happens to be in the office, under pressure, with incomplete information. People call who they always call. Systems get “fixed” before anyone asks what they can tell you. Deadlines slip because nobody knew they existed.

Preparing for the first hours costs a conversation

Board-level awareness of what these first hours should look like, before an incident happens, is one of the most valuable and least expensive pieces of preparation an SME can do. In practice, it means agreeing a few simple things in advance:

None of this requires expensive technology. It costs a conversation. The alternative costs a great deal more.

If you are not sure who in your business would make the first call, or what that call should be, it is worth talking it through before you need to.

At 15 people, informal IT works fine. At 35, it starts costing you money you cannot see.

There is a specific point in a growing business where the IT setup that carried you from ten people to twenty-five simply stops working. Almost nobody sees it coming, because nothing dramatic happens to mark the moment. No system crashes. No single bad day. It is a slow build-up of friction that gets absorbed, mostly by the founder or MD, until it becomes normal.

I see the same pattern again and again. The business has grown well. Revenue is up, the team has doubled, maybe there is a second office or a hybrid workforce. But the way technology is run has not changed since the days when everyone sat round one table and the most technical person in the room “did the IT”.

Why it happens between 25 and 35 people

In the early days, informal IT is the right answer. Decisions are fast, everyone knows everyone, and the cost of getting something slightly wrong is small. The founder picks a few tools, an MSP handles the laptops and the email, and it works.

The problem is that complexity does not grow in a straight line with headcount. Every new person adds accounts, devices, permissions, data and another way for things to go wrong. Every new team tends to bring its own tools. Research from BetterCloud shows how quickly this happens: young companies of one to two years old typically start with around 29 SaaS apps, and by the time they are three to six years old that figure has jumped to about 103. Nobody sat down and decided to run a hundred systems. It just happened, one sensible decision at a time.

Around the 25 to 35 mark, the volume of change finally exceeds what one busy founder and a reactive support contract can absorb. The exact point varies depending on how technical the founding team is and how fast growth has been, but the symptoms are remarkably consistent.

The five warning signs

1. Onboarding takes days, not hours

When access provisioning is manual and undocumented, every new starter becomes a small project. Someone has to remember which systems they need, who has admin rights to each one, and what the laptop should have on it. Inevitably something is missed.

This is not unusual, but it is expensive. One industry study found that 43% of new hires waited more than a week for basic workstation logistics and tools, and 18% waited over two months for the tools they needed. Even a short delay adds up. As one estimate puts it, two days of onboarding delay for a well-paid employee means roughly two days of paid time with nothing to show for it, and across 20 hires in a growth year that becomes a significant direct loss, before you count the time spent by whoever is doing the provisioning.

For a business hiring steadily, that is real money leaking out every month. It also sends new starters the wrong message in their first week.

The flip side matters just as much. Offboarding is usually worse than onboarding. If you cannot say with confidence that every leaver lost access to every system on their last day, you have a security problem as well as an admin one.

2. Nobody has a complete list of your systems

Ask most growing businesses for an authoritative list of every system they run, who owns it, what data sits in it and what it costs, and you will get a pause. The list exists in pieces: in the finance system as card payments, in people’s heads, in an MSP’s asset register that only covers the hardware.

This matters for three reasons. First, cost: unused and duplicate subscriptions are common, and Zylo’s research found that 53% of licences go unused within 30 days. Second, risk: you cannot protect data you do not know you hold. Third, resilience: if a key person leaves, the admin rights and institutional knowledge for a critical system can leave with them.

3. The MSP has become reactive

Many MSP relationships start well. When the business is small and simple, tickets in and fixes out is exactly what is needed. But as the business grows, you need someone thinking ahead: planning for the next office move, the next 20 hires, the renewal of your main line-of-business system, the security controls your biggest customer is now asking about.

That forward-looking work is rarely in a standard support contract, and it is not the MSP’s job to set your technology direction. So it falls into a gap. The MSP waits to be asked, the business does not know what to ask, and the relationship drifts into pure break-fix. When something does go wrong, the MSP calls the founder.

4. Security gaps open up because nobody owns the question

This is the most serious sign, and the one most often hidden. In a growing business, security is everyone’s problem and therefore no one’s. The MSP assumes the business will tell them what it needs. The business assumes the MSP has it covered.

The UK data backs this up. According to the government’s latest Cyber Security Breaches Survey, 43% of UK businesses identified a cyber security breach or attack in the previous 12 months. Crucially, the rate climbs with size: 65% of medium businesses reported a breach, compared with 42% of micro and 46% of small businesses. A business crossing from 25 to 50 people is moving directly into that higher-risk bracket, often without changing how it manages security at all.

Yet ownership remains thin. Only 31% of businesses have someone at board or senior management level with explicit responsibility for cyber security. Only a quarter have a formal incident response plan, meaning most businesses that suffered a breach responded without a defined approach. And just 5% of UK businesses hold Cyber Essentials certification, while fewer than half use two-factor authentication.

Supplier risk is a growing blind spot too, and highly relevant when you depend on an MSP and dozens of SaaS providers. The survey found only 22% of small businesses review risks from their immediate suppliers, and 10% review their wider supply chain.

The consequences are getting more serious. The proportion of businesses reporting loss of revenue or share value after a breach rose from 2% to 5%. Increasingly, the question is not just about attacks either. Larger customers, insurers and investors now ask pointed questions about your controls during procurement, renewals and due diligence. A business that cannot answer them loses deals, pays more for cover or takes a hit on valuation.

5. The founder is still the IT department

Underneath all of this sits the most expensive symptom of all. The founder or MD is still the person who gets pulled into IT decisions, often several hours a week. Approving a new tool. Chasing the MSP. Resetting the admin password on the website. Answering the security questionnaire from a prospective customer at 10pm.

Individually, each of these takes a few minutes. Together, they take a real slice of the most valuable time in the business, and they pull attention away from sales, people and strategy at exactly the point where growth demands it most. Because the cost never appears on an invoice, it rarely gets challenged.

This is a governance problem, not a technology problem

The instinct at this point is often to buy something: a new platform, a bigger support contract, another tool. Sometimes that helps. But the root cause is almost never a lack of technology. It is a lack of ownership, visibility and decision-making structure around the technology you already have.

The businesses that navigate this stage well do a few simple things:

None of this requires a full-time IT director on a large salary. For most businesses at this size, fractional or part-time oversight is enough to set direction, hold suppliers to account and take the founder out of the loop.

The key is timing. Bringing in oversight before the friction becomes a crisis is far cheaper than doing it after a breach, a failed audit or a lost contract.

Is this you?

A quick self-check. If you answer “no” or “not sure” to more than a couple of these, you are probably at the inflection point:

If new starters are waiting days for access, or you are still the person the MSP calls when something breaks, it is worth a conversation.

In a significant proportion of UK SMEs, the primary point of contact for the managed service provider is the Managing Director.

Not because the MD has particular IT expertise. Not because IT is their core responsibility. But because nobody else in the business has the seniority to hold the supplier accountable, and the supplier knows it.

This dynamic has real commercial consequences, for the quality of the service received, for the MD’s available time, and for the business’s ability to make good technology decisions.

How it develops

The pattern is consistent. The business engages an MSP. The MSP relationship is managed informally, issues raised on an ad hoc basis, no structured service reviews, no performance metrics tracked. When something goes wrong that cannot be resolved at staff level, it escalates to the MD.

Over time the MD becomes the de facto IT manager. They are the person the MSP calls when something needs a decision. They are the person who signs off on proposals for new technology. They are the person who handles renewals and, occasionally, complaints.

The supplier is often comfortable with this arrangement. An MD without technical IT knowledge, managing the relationship informally, alongside all the other demands on their time, is significantly easier to manage than a structured, informed client with clear performance expectations.

Why it is a problem

It consumes MD time that should be spent elsewhere – Senior leadership time is the scarcest resource in most SMEs. An MD spending two to four hours per month on IT issues, supplier conversations and technology decisions is an MD not spending that time on clients, strategy and growth. The opportunity cost is real.

It produces poor commercial outcomes – An MD without technical IT knowledge and without the time to develop it is not well-positioned to challenge a supplier’s technical recommendations, negotiate contract terms effectively, or identify when a proposed solution is unnecessary or overpriced. Suppliers, consciously or not, take advantage of this asymmetry.

It means nobody is asking the strategic questions – The MD managing IT supplier issues reactively is not thinking about IT governance, cyber risk, technology strategy or whether the current setup is appropriate for where the business is heading. Those questions go unasked.

It creates a single point of failure – If the MD is the only person with knowledge of the IT supplier relationship and the systems it supports, that knowledge does not exist anywhere in the business in a structured form. When the MD is unavailable or when they eventually move on, the institutional knowledge goes with them.

The alternative

The alternative is not necessarily hiring a full-time IT director. For most SMEs the economics do not justify that hire. The alternative is ensuring that IT supplier management is handled by someone who has the technical knowledge to evaluate performance, the commercial seniority to hold the supplier accountable, and the time to do both properly.

In practice, this means either developing internal capability, which requires hiring or training or bringing in independent IT oversight on a fractional basis.

The fractional model means the person sits above the MSP relationship on the client’s behalf. He conducts the service reviews. He manages the renewal negotiations. He escalates issues at the right level and with the right technical and commercial context. He attends board meetings and reports on IT and cyber risk in terms the board can act on.

The MD gets their time back. The supplier operates in a properly managed relationship. And the business gets better IT outcomes at a lower cost than the informal management model was producing.

The conversation about independent IT leadership in an SME almost always starts with cost. How much does a fractional IT director cost? Is it justified for a business of our size? What would we actually get for the money?

These are reasonable questions. But they are only half the equation. The other half, the cost of not having adequate IT leadership is rarely calculated with the same rigour. When it is, the case for independent oversight becomes significantly clearer.

What independent IT leadership actually costs

A fractional IT director engagement for a UK SME typically involves one to three days of senior advisory time per month. At market rates for genuinely senior, experienced IT leadership, not a junior consultant operating under a senior title, this represents a meaningful but proportionate investment.

The cost varies based on the complexity of the IT environment, the number of suppliers being managed, the frequency of board reporting required and whether the engagement includes specific project work alongside ongoing oversight.

For most SMEs, the annual cost of a well-structured fractional IT director engagement is significantly less than the fully-loaded cost of a single month of a full-time IT Director hire.

What poor IT governance actually costs

This is the calculation most businesses have not done. The costs of inadequate IT governance are real, recurring and typically much larger than the cost of the advisory that would have prevented them. They fall into several categories.

*Overspend on IT

As we have discussed elsewhere, IT spend without independent oversight typically drifts upward by 10 to 20 percent per year above what a well-managed IT cost base would look like. For a business spending £60,000 per year on IT, that is £6,000 to £12,000 per year in recoverable waste. Over three years without independent oversight, that accumulates to between £18,000 and £36,000.

*Suboptimal MSP performance

An MSP operating without independent client-side oversight delivers less than one operating under proper accountability. This is not a judgement, it is a commercial reality. The cost of suboptimal IT performance is harder to quantify but it manifests as lost productivity, slower resolution of issues, delayed projects and technology that is not fit for purpose.

*Cyber incident costs

The average cost of a cyber incident for a UK SME including remediation, lost productivity, potential regulatory fines and reputational damage, runs into tens of thousands of pounds at minimum and can significantly exceed that. Many of the controls that prevent or mitigate incidents, patch management, access control, backup testing, staff awareness are governance matters that independent IT oversight ensures are in place.

*Failed compliance

A business that loses a contract because it cannot evidence Cyber Essentials certification, or that faces ICO action following a data breach that was preventable, or that has a cyber insurance claim declined because its security practices did not meet policy conditions, each of these represents a cost that dwarfs the advisory that would have prevented it.

*Management time

IT issues that should be handled operationally consuming founder or MD time is a cost that rarely appears in any calculation but is consistently significant. Senior leadership time spent managing IT problems, mediating supplier disputes or trying to understand what their MSP is telling them is time not spent on the things that grow the business.

The actual calculation

Take your current annual IT spend. Apply a conservative 10 percent waste factor. Add a modest estimate for the management time currently consumed by IT issues. Add a probability-weighted estimate of the cost of a significant cyber incident. Add the commercial value of any contract opportunities that require Cyber Essentials or security evidence you cannot currently provide.

For most SMEs, that number is significantly larger than the cost of independent IT oversight. The question is not whether independent IT leadership costs money. It is whether the cost of not having it is larger – which, in almost every case, it is.

The fractional model – where a senior executive provides part-time leadership to a business that does not need or cannot afford a full-time hire – is well established in finance and HR. Most SMEs understand the concept of a part-time FD or a fractional HR director.

In IT and cyber, the model is less widely understood, despite being a near-perfect fit for the governance challenge facing most UK SMEs.

The problem the fractional model solves

Most businesses below 100 to 150 people reach a point where their IT and cyber risk has become too significant to manage informally, but where hiring a full-time IT Director is not commercially justified.

A full-time IT Director in the UK costs between £80,000 and £130,000 per year in salary, before pension, national insurance, benefits and the overhead of a permanent hire. For a 30 or 50-person business, that is a significant commitment – and in most cases, the role does not require full-time attention.

What the business actually needs is senior IT and cyber leadership for perhaps one to three days per month. Someone who attends board meetings and provides honest risk reporting. Someone who manages the MSP relationship and holds suppliers to account. Someone who sets IT policy, oversees technology spend, and provides independent counsel when the business faces significant IT decisions.

That is exactly what a fractional IT director provides.

What a fractional IT director actually does day to day

The scope varies by business, but typically covers:

Board-level reporting – attending relevant board or leadership meetings to provide a clear, plain-English update on IT performance, cyber risk and technology strategy. Not a technical briefing – a commercial one.

Supplier management – acting as the informed, senior point of contact for the MSP and other IT suppliers. Conducting service reviews, challenging performance, and managing contracts on behalf of the business.

Risk oversight – maintaining an ongoing view of the organisation’s cyber and IT risk posture, and ensuring that risk is being actively managed rather than accumulated.

Technology decisions – providing independent advice when the business is evaluating new systems, considering significant IT investments, or responding to supplier proposals. The fractional IT director has no commercial interest in any particular solution – their interest is in what is right for the business.

Incident support – providing leadership and coordination in the event of a significant IT or cyber incident, when having a calm, experienced hand can make a material difference to the outcome.

Policy and compliance – ensuring that appropriate IT and cyber policies exist, are current, and are being followed. Advising on regulatory and contractual obligations around data and security.

How it differs from your MSP

This is probably the most important distinction to understand.

Your MSP is responsible for delivering IT services – keeping your systems running, resolving issues, managing infrastructure. A good MSP does this well. But your MSP has a commercial relationship with you that creates inherent conflicts of interest. They are not going to recommend you consolidate your licences if that reduces their revenue. They are not going to advise you to switch providers. They are not going to tell the board that the service they provide is underperforming.

A fractional IT director sits above the MSP, not alongside them. Their job is to represent the interests of the business – not the supplier. They hold the MSP accountable, challenge costs, and provide the independent perspective that no supplier relationship can provide.

Is it right for your business?

A fractional IT director is likely to be the right fit if:

– You have an MSP but no senior IT leadership above them

– Your board has limited visibility of IT and cyber risk

– You have experienced IT problems that felt avoidable with better oversight

– You are growing and your IT complexity is increasing

– You are facing a specific challenge – a contract renewal, a cyber incident, a compliance requirement – where independent expertise would help

– You want the benefits of senior IT leadership without the cost of a full-time hire

It is probably not the right fit if you already have a capable internal IT director or head of technology who is providing genuine leadership – in that case, what you may need is a specific advisory project rather than ongoing fractional support.

What to look for in a fractional IT director

Not all fractional IT directors are equal. The key qualities to look for are:

Commercial depth – do they understand business, not just technology? Can they translate IT risk into commercial consequence and speak to a board in terms that land?

Independence – do they have any commercial relationships with IT suppliers that could compromise their advice? A fractional IT director should be genuinely independent.

SME experience – enterprise IT leadership and SME IT leadership are not the same thing. The constraints, priorities and commercial dynamics are different. Look for someone who has worked with businesses of your size and complexity. **Honest communication** – the value of a fractional IT director is in part their willingness to tell you things your suppliers won’t. That requires a degree of directness that not every consultant possesses.