If you run a small business, it can feel as though cyber criminals have bigger fish to fry. New UK figures suggest otherwise.
Every day, automated tools are quietly trying the doors and windows of ordinary British businesses, thousands of times over. Most of those attempts fail. The ones that succeed usually find something left open by mistake.
The numbers
Business internet provider Beaming published its latest Cyber Threat Analysis on 8 October 2026. Across the UK businesses it monitors, it detected an average of 203,585 attack attempts per business between July and September 2026. That works out at 2,213 attempts per business, every day.
Beaming says that is up 7.0% on the same quarter last year and 6.7% on the previous quarter. The most targeted of its eight service categories was remote control services, at around 193 attempts per business each day, followed by web services.
Beaming calls Q3 a record. It's worth noting that its own 2025 report gave slightly higher daily averages for Q1 (2,234) and Q4 2025 (2,221). So the honest reading is that the pressure is consistently very high, rather than suddenly spiking. Either way, it's a lot of knocking.
What "remote control services" means
Remote control services are the tools that let someone use a computer from somewhere else. The best-known is Microsoft's Remote Desktop (RDP), which many small firms rely on so staff or an IT supplier can log in from outside the office. Other remote support and screen-sharing tools work in a similar way.
They're useful, but if one is left facing the open internet, it becomes a front door with a login box. Automated tools scan for those doors around the clock and try stolen or guessable passwords. The NCSC has described RDP as the most commonly exploited remote access tool used by ransomware gangs, often using credentials collected through phishing or earlier data breaches.
Who is behind it?
Mostly, machines. Beaming tracks where attack traffic comes from, and saw the number of attacking IP addresses linked to Brazil rise 47.7% in a quarter, though China and the USA stayed above it.
Beaming is careful to point out that this shows where the attack infrastructure sits, not where the criminals are. For a small business the location matters less than the lesson: nobody has to pick you out. Your systems just have to be reachable.
What this means for UK small businesses
This is the background noise every connected business now lives with. The government's Cyber Security Breaches Survey 2025/26 found that 42% of micro businesses and 46% of small businesses identified a breach or attack in the past year. Only 36% of businesses said they use a VPN for staff connecting remotely, and only 5% hold Cyber Essentials.
The good news is that automated attacks are mostly opportunistic. They go after the easy wins: an exposed remote desktop, a default password, a missed update. Close those, and the vast majority of those 2,213 daily knocks simply bounce off.
What to do this week
Find out what's exposed. Ask your IT provider, or check yourself, which of your systems can be reached directly from the internet. Remote desktop and remote support tools should be top of the list.
Put remote access behind a front door. Staff and suppliers should connect through a VPN or a secure remote access service with multi-factor authentication, not straight to an exposed remote desktop.
Turn on multi-factor authentication everywhere you can. It stops most password-guessing attacks in their tracks, even when a password has leaked.
Switch off what you don't use. Old remote support tools, test servers and forgotten logins are exactly what automated scanners find first.
Keep things updated and check your backups. Beaming's advice is to keep systems up to date, review access and test your recovery arrangements, so that if something does get through you can bounce back quickly.
Sophia Says
"Two thousand knocks a day sounds frightening, but I find it oddly reassuring. It tells us these attacks aren't personal. Nobody is sitting there studying your accounts firm or your dental practice. A machine is rattling every handle on the street, and it moves on the moment the door holds. The businesses that get hurt are nearly always the ones with a remote desktop someone switched on years ago and forgot about."
"That's exactly what HackRisk is built to find. I look at your business from the outside, the way those scanners do, and show you every door that's reachable: exposed remote access, out-of-date software, logins already leaked online. Then I tell you, in plain English, which ones to close first. You fix the handful that matter, and the rest of those daily knocks become someone else's problem."
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Exposed remote desktops and forgotten systems: our Recon Scan maps what your business has visible on the internet, including services you didn't know were open.
Out-of-date software that scanners target: our Vulnerability Scan checks those systems for known weaknesses and ranks them by risk.
Leaked passwords used to log in: a Dark Web Scan tells you if staff credentials are already circulating, before they're tried against your remote access.
IT suppliers with remote access to you: Supply Chain Risk shows whether the firms that can reach into your systems are keeping their own doors locked.
Get your free HackRisk report
See your business the way an automated scanner does. Get your free HackRisk report and find out which doors to close first.
