With cyber threats extending beyond traditional IT networks, businesses are being urged to review their internet-connected equipment and strengthen their security measures to reduce the risk of disruption. Our blog below outlines the warnings with advice on how you can protect yourself.
What is operational technology and why is it at risk?
Operational technology (OT) refers to the hardware and software used to monitor, control and automate physical equipment and industrial processes. These systems are commonly found in manufacturing, energy, utilities and other sectors.
The NCSC has highlighted a growing threat from cyber attacks targeting these systems, with incidents already causing disruption to UK infrastructure, including a reported attack affecting a small gas-fired power station.
Older equipment, outdated security measures and incorrectly configured systems can leave businesses particularly vulnerable, especially where equipment is connected to the internet without adequate protection.
What is the National Cyber Security Centre (NCSC)?
The National Cyber Security Centre (NCSC) is the UK's national authority on cyber security and forms part of GCHQ. It provides expert advice, guidance and support to help businesses, organisations and individuals protect themselves against cyber threats.
The NCSC works to improve the UK's cyber resilience by identifying emerging threats, responding to cyber incidents and providing practical guidance to help organisations strengthen their security.
NCSC cyber security advice for SMEs
The NCSC is urging organisations not to assume their operational equipment is secure or inaccessible from the internet. Its recommendations include:
- Review connected equipment: Identify all operational technology assets, external connections and potential vulnerabilities, including older systems.
- Restrict internet access: Ensure operational equipment is not directly exposed to the public internet.
- Strengthen passwords and authentication: Replace default passwords, avoid shared accounts and introduce multi-factor authentication (MFA) wherever possible.
- Keep systems updated: Apply appropriate security updates and restrict access to management functions.
- Separate business and operational networks: Prevent a breach of one system from providing easy access to another.
- Monitor network activity: Record and review connections to identify unusual behaviour or potential cyber threats.
- Test backups and recovery procedures: Regularly check that essential systems and data can be restored following an incident.
Businesses using Programmable Logic Controllers (PLCs), Industrial Control Systems (ICS) or Supervisory Control and Data Acquisition (SCADA) systems should pay particular attention to the security of this equipment.
The benefits for SMEs reviewing their cyber security arrangements
Cyber attacks can have serious consequences for businesses of all sizes, potentially resulting in operational downtime, financial losses, data breaches and reputational damage.
For businesses relying on automated processes or connected equipment, an attack could also interrupt production or essential services.
Regular cyber security reviews, employee awareness and effective recovery plans can significantly reduce these risks..
Further cyber security guidance and resources
Businesses can access further information and practical guidance through the National Cyber Security Centre, including advice on securing operational technology and improving cyber resilience, as well as free cyber security advice and resources. Visit www.ncsc.gov.uk.
Businesses interested in learning more about emerging cyber security challenges may wish to attend a free online event hosted by techUK, the UK's technology trade associations, which represents over 1,100 members and works with businesses and government to promote innovation and digital security.
Taking place on Tuesday 3rd November 2026, from 2pm to 3.30pm, the techUK/Ofcom Industry Roundtable – Trust and Assurance Challenges for AI Cyber Defences will explore the growing role of artificial intelligence (AI) in cyber security, including the challenges of ensuring AI-powered defence systems are reliable, secure and compliant with regulations. For further information and registration, visit the techUK event page here.
LWA's commitment to cyber security and Cyber Essentials certification
Our firm recognises the importance of protecting business systems and sensitive information, and as a Cyber Essentials certified firm, we have demonstrated our commitment to implementing recognised cyber security controls to help protect our systems and client information against common cyber threats.
Cyber Essentials is a government-backed certification scheme that helps organisations establish fundamental security measures, including secure configurations, access controls, malware protection, security updates and firewalls.
Although Cyber Essentials certification does not eliminate every cyber risk, it provides businesses with a valuable foundation for improving their security and demonstrating their commitment to protecting information.
For further information on our Cyber Essentials certification, or a chat about protecting your business and managing financial risks, please get in touch with the LWA team on 0161 905 1801 in our South Manchester office, or 01925 830 830 for our Warrington team, or you can email mail@lwaltd.com.