We did not go looking for a neat pattern, but one emerged anyway. Across the businesses we have reviewed - trades, shops, practices, care providers - the same three weaknesses come up far more often than anything sector-specific. They are not exotic attacks. They are ordinary housekeeping that quietly slipped, and they are worth naming plainly because they are all fixable.

The first is leavers. Almost everywhere we look, someone who has left still has access to something: an email account, a shared drive, an invoicing tool. It is nobody's malice, just that removing access is the step that gets forgotten when someone is busy leaving. Every dormant account is a door that was never locked.

The second is backups. Plenty of businesses have backups; far fewer have ever tested that they restore. A backup you have never restored from is a hope, not a safeguard. The moment you discover it was silently failing is always the worst possible moment. The third is shared logins - one username and password used by several people, so nobody can be held accountable and nothing can be traced when it goes wrong.

The honest reading is encouraging. These are not signs that small businesses are careless. They are the predictable places where ordinary busyness leaks, and each has a short fix: a leavers checklist, one tested restore, individual accounts with a second factor. Do those three and you are past the point where most of the incidents we see would ever have started.