Data-Centric Security: Why Protecting Your Network Is No Longer Enough

Why Attackers Now Go Straight for Your Data

Most businesses still think about security in terms of their network. Firewalls, antivirus and a locked-down office connection. Those things still matter. But they are no longer where the real risk sits.

Your data now lives in far more places than your office. It sits in Microsoft 365, in your CRM, in your HR and payroll platforms, in backups and with dozens of suppliers. Attackers know this. They no longer need to break through your firewall if they can log in somewhere else.

What does “data-centric security” mean?

Data-centric security means protecting the information itself, wherever it is stored or used. Instead of asking “is our network secure?”, you ask “do we know where our sensitive data is, who can reach it, and how we would get it back?”

It shifts the focus from the building to the asset. That matters, because the asset now travels.

How common are data breaches for UK businesses?

Very common. The UK Government’s Cyber Security Breaches Survey 2025 found that 43% of UK businesses and 30% of charities reported a breach or attack in the previous 12 months. Phishing was the most common type by a wide margin.

The same survey found that larger organisations were hit even more often. Size does not protect you. It just changes what attackers go after.

Where to start

If you want an outside view of your risk, our cyber security services London team can help. You can also see the full range of our IT security services for London businesses.

Why the Network Perimeter Has Largely Disappeared

Ten years ago, most company data sat on a server in a back room. Protect the office and you protected the data. That model no longer fits how businesses work.

Where does business data actually live now?

For a typical London SME, sensitive data is likely to be spread across:

• Microsoft 365 mailboxes, OneDrive and SharePoint
• A CRM or practice management system
• HR, payroll and finance platforms
• Laptops and phones used at home or on the move
• Backup services and archive storage
• Supplier and partner systems that hold copies of your records

Each of these is a door. Many of them are opened with nothing more than a username, a password and an MFA prompt.

Does a firewall still matter?

Yes. A good firewall still blocks a huge amount of malicious traffic and protects your office and connected devices. But it cannot see a login to a cloud app from a stolen laptop in another country. It should be one layer among several, not the whole plan.

What about remote and hybrid staff?

Hybrid working spreads data further. Staff open files on home Wi-Fi, personal devices and public networks. Our guide to remote and hybrid workforce security covers this in more detail.

Your Suppliers Can Be Your Weakest Point

Many recent breaches did not start inside the victim’s own systems. They started at a supplier. A software provider, a shipping partner or a CRM platform was compromised, and its customers were exposed along with it.

Why is supply chain risk so hard to manage?

Because you cannot see inside your suppliers’ systems. You hand over data and trust that it is looked after. The 2025 breaches survey found that only 15% of UK businesses reviewed the risks posed by their immediate suppliers, and just 6% looked at their wider supply chain.

That gap is exactly what attackers exploit.

Is supplier risk a security problem or a procurement problem?

It is both. Procurement decides who you work with. Security needs a say in what data each supplier receives and what happens if they are breached. Treating it as paperwork alone leaves a real gap.

What should you ask your suppliers?

• What of our data do you hold, and where is it stored?
• Do you hold a recognised certification such as Cyber Essentials or ISO 27001?
• How quickly will you tell us if you suffer a breach?
• Can you delete our data when we stop working together?
• Who on your side can access our information?

Only share what each supplier genuinely needs. Data you never hand over cannot be stolen from them.

People Are Still the Easiest Way In

Technology has improved, so attackers have shifted to targeting people. Several high-profile UK attacks in 2025 reportedly began with criminals phoning an IT helpdesk, pretending to be a member of staff, and talking their way into a password or MFA reset.

Can attackers get around MFA?

Yes, in some cases. MFA is still essential and stops most automated attacks. But a determined attacker can trick someone into approving a prompt, reading out a code or resetting an account. Some phishing kits can also steal a session after a user has signed in.

That is why we recommend phishing-resistant sign-in methods where possible. Our article on passkeys for business explains how they help, and our MFA solutions for business London cover the wider setup.

How do you protect against helpdesk impersonation?

• Never reset a password or MFA method based on a phone call alone
• Verify identity through a second channel, such as a known manager or a callback to a number on file
• Require extra checks for any request involving admin accounts
• Log and review every reset

Does staff training actually help?

It does, when it is regular and practical. People who know what a pretext call or a fake login page looks like are far more likely to stop and check. Our cyber security training for employees is built around real attack examples. You can also read about the 12 types of social engineering attacks your team should recognise.

Practical Steps to Protect Your Data, Not Just Your Systems

You do not need a large security team to take a data-first approach. Most of the value comes from a handful of habits done well.

1. Know where your sensitive data is

List the systems that hold personal, financial or commercially sensitive information. Include cloud apps and supplier platforms. You cannot protect what you have not found.

Unapproved apps and AI tools are a common blind spot. Our shadow IT and shadow AI security services help you find them.

2. Limit who can access it

Give people access to what they need for their role, and nothing more. Review permissions when someone changes role or leaves. Remove old accounts quickly.

3. Assume a password will be stolen

Plan as if credentials will leak at some point. Strong MFA, conditional access rules and alerts on unusual sign-ins all reduce the damage when it happens. A zero trust security approach is built on exactly this idea.

4. Watch for warning signs

Attacks are easier to contain when they are spotted early. Continuous monitoring, such as our MDR services London, looks for suspicious behaviour around the clock. Dark web monitoring for business can alert you when company credentials appear for sale.

5. Back up your data and test the restore

A backup you have never tested is a hope, not a plan. Keep copies separate from your main systems so ransomware cannot reach them, and run restore tests regularly. Our disaster recovery services London are designed around this.

What Happens If You Do Suffer a Breach?

Even well-protected businesses can be breached. How you respond makes a big difference to the outcome.

Do you have to report a data breach to the ICO?

Under UK GDPR, if a personal data breach is likely to put people’s rights and freedoms at risk, you generally need to report it to the Information Commissioner’s Office within 72 hours of becoming aware of it. If the risk to individuals is high, you may also need to tell the people affected.

This is general guidance, not legal advice. Check your specific obligations with your data protection lead or a legal adviser.

What should you do first?

• Contain the incident, for example by resetting compromised accounts
• Preserve evidence such as logs and alerts
• Work out what data was involved and whose it was
• Bring in your IT or security provider straight away
• Decide whether the breach needs to be reported

What if the breach happened at a supplier?

You may still have obligations if your customers’ data was involved. Find out exactly what was exposed, record your decisions, and keep affected customers informed where appropriate.

Is Your Business Learning From Other People’s Breaches?

Breach headlines appear almost every week. The patterns repeat: stolen logins, a compromised supplier, a convincing phone call. The businesses that cope best use these stories as a checklist, not just news.

Are small businesses really a target?

Yes. Attackers often use automated tools that do not care how big you are. Smaller firms can also be a route into the larger clients they work with. That makes them attractive, not invisible.

How does Cyber Essentials fit in?

Cyber Essentials covers many of the basics that stop common attacks, including patching, access control and MFA. It is a strong foundation, and the rules have tightened recently, as our guide Cyber Essentials Has Changed explains. Our Cyber Essentials Certification London service can help you get there.

To find out whether your company logins are already exposed, read our plain-English guide to what dark web monitoring is.

For practical ideas on protecting data in the cloud, see 5 ways to scale cloud security without adding complexity.

To see which sectors attackers are focusing on, read how cyber attacks are targeting UK industries in 2026.

Protect the Data, Not Just the Building

Your network still matters. But your data is what attackers want, and it now lives well beyond your office walls. Knowing where it is, controlling who can reach it and being ready to recover it are what stop a breach becoming a crisis.

How Speedster IT can help

Speedster IT helps London businesses find their sensitive data, tighten access, monitor for threats and recover quickly when something goes wrong. Start with a Free Cyber Security IT Audit.

Call us on 0204 511 9111, email hello@speedster-it.com or get in touch today.

Louise

With over 15 years at Speedster IT, I’ve built a career around helping businesses navigate the evolving world of technology. I publish all the content for the IT Support London Blog and Cyber Security Blog, where I share practical insights on infrastructure upgrades, cybersecurity trends, and smart IT strategies for growing companies.