Tech News for SMEs - 12 Oct 2026

This week in two minutes

Key tech news SMEs should care about, in two sentences each. Want more detail? Each full story below is a two minute read, with plain-English advice and actions you can start on today.

Most UK companies aren’t confident in cybersecurity basics. A government survey found 57% of UK businesses aren’t confident doing at least one of nine basic cybersecurity tasks, up from 49% last year. Most problems come from missed basics, and clients increasingly want proof you’ve covered them.

Who controls your AI models, and what power does that give them? UK tech leaders want £20bn of sovereign AI investment, and in June the US Government blocked access to two of Anthropic’s AI models for about three weeks. If your business runs on one AI model, someone else’s decision can switch it off, so you need a plan B.

Security devices are targets too. Citrix NetScaler, a device that manages remote access, has its ninth vulnerability in about a week, and in some setups a single request can knock it offline. Even security kits have flaws, so someone needs to be patching and watching it, including on a Saturday night.

That old Windows 10 machine is about to cost you double. Extended security updates for Windows 10 renew this month at twice last year’s price. Every old machine you keep is a growing bill and a growing risk, so give each one a plan and a date.

Can AI governance keep pace with AI use? Larger UK firms are putting senior leaders in charge of AI, while 76% of firms worldwide say their rules can’t keep up with staff use. You’re accountable for personal data whether or not you approved the AI tool, so someone needs to own the rules.

The UK is a top target, and attackers are getting faster. Microsoft says the UK is the most targeted country in Europe for state-linked attacks, and AI lets attackers put an attack together in minutes. The way in is still your people, with voice phishing up over 500%, so training and a double-check rule matter more than ever.

New Chromebooks lose two years of support as Googlebooks arrive. Google has cut its promised support for new Chromebooks from ten years to eight as its Gemini-powered Googlebook replacement arrives. Budget for eight years, and wait for clear business details on licensing and management before you buy Googlebooks.

AI is helping defenders as well as attackers. A rented phishing service called BigBear 2.0 stole logins from hundreds of organisations, including some protected by two-factor, while AI-powered tools can now spot unusual sign-ins. Two-factor isn’t the whole answer any more, and many businesses already pay for smart security tools that nobody checks.

Rework is eating AI’s time savings. A Templafy survey found 96% of UK respondents still edit AI-generated documents, and over half say checking leaves little time saved. If your AI tools don’t save time once the checking is counted, you may be paying for speed you aren’t getting.

Most UK companies aren’t confident in cybersecurity basics

A new UK government study has shown that 57% of companies aren’t confident of doing at least one of nine basic cybersecurity tasks, such as storing data securely, choosing secure device settings, or switching on automatic updates. That’s around 808,000 companies, up from 699,000 in the last survey. The biggest sticking point, at 38%, is dealing with malware such as viruses or software stealing your data while you use your device. The researchers point out that the increase may be from companies scrutinising their controls more off the back of recent high profile breaches, but it’s a worrying stat regardless.

In many SMEs, cybersecurity is only part of someone’s job. This means basics slip, updates aren’t applied, and problems build up over time. Meanwhile, attackers are churning out malware faster and faster with the help of AI.

Think of mobile devices that are taken to building sites, warehouses, client sites, or staff’s homes. A lost phone with no lock or encryption that has access to your email, Teams, or accounting software, is a major risk. How many staff have their email on their personal phone, for which you can’t control the security settings?

This matters, as more and more companies require evidence of security before they will work with you. No controls could mean no contract.

What to do next:

1. Check every device that touches company data has a screen lock, a strong passcode, automatic updates switched on, and encryption enabled. Especially devices that leave your office.
2. Ask your Managed Service Provider if they can remotely wipe a device that is lost or stolen, and whether important data is backed up so that it can be moved to a new device.
3. Ask yourself: Who owns security here? If the answer is unclear, that’s where you need to start.

Bonus: Consider Cyber Essentials, a government-backed certificate that shows you have the basics covered.

Who controls your AI models, and what power does that give them?

An open letter from UK tech leaders to Andy Burnham and AI minister Kaniska Narayan asks for £20bn (yes, that’s a B) of investment over five years into sovereign AI. One signatory said that no mission-critical public service or critical infrastructure should depend on a single model, provider, or cloud stack.

I’m guessing none of my readers are building data centres, but there are lessons to learn here. In June, the US Government blocked access to two of Anthropic’s AI models for three weeks. Whoever controls the models you’re using has immense power over your business.

For casual chat usage, that’s probably not a huge issue. You can switch to a different model, a different provider, or just wait until it blows over. However if you build processes in your business, or features for your customers, which require access to AI models, you need to protect yourself.

The problem doesn’t have to be geopolitical, either. One company I worked with had a customer-facing feature with a cloud-hosted model behind it. Hardware issues at the cloud host caused this feature to become significantly slower. We swapped the model to another to restore the service. This wasn’t trivial and required a number of changes, but we set it up so that future changes would be much simpler.

For many, AI is currently a nice to have. But when your business starts to run processes on it, it becomes a business continuity and disaster recovery problem, costing you real revenue when it goes wrong.

What to do next:

1. Understand which processes include AI, even if that’s just ChatGPT, and ask yourself what happens if that falls away.
2. I recommend you use AI to speed up your processes, but ask whoever builds it: what happens if this model is unavailable, and how long would it take to switch? 
3. Pick your most important AI powered process and test switching the model powering it.

Security devices are targets too

Humans are often considered to be the weakest link in security, which is why phishing and password guessing are common attacks. But some attackers just look for cracks in the security of the devices designed to keep them out. Case in point: Citrix NetScaler - a device used to manage remote access - has just announced the ninth vulnerability in about a week, three of which are known to have been exploited by attackers.

In this particular case, a single specially crafted request to your NetScaler can take the entire device offline in certain setups, stopping your own staff from getting to systems on your network. A patch now exists, and it should be urgently applied.

Not all SMEs run NetScalers, but the lesson here is much broader. No security is impenetrable, and with enough persistence from attackers, even devices designed for security can be breached.

A concept we talk about is defence in depth, which means that there are multiple layers of security. If one system is breached, attackers don’t automatically have access to everything.

The fix landed on a Saturday night, when for many SMEs nobody is watching for alerts, or patching devices. Citrix also wouldn’t say how many customers were impacted or what attackers did next, so it’s up to the companies themselves to look for any signs of intrusion or damage.

What to do next:

1. Ask your IT professionals or MSP whether they’re running Citrix NetScaler, and if so whether it is fully patched.
2. Ask what else stands between an attacker and your data if the first layer of defence is breached.
3. Make sure your network kit is still supported by the vendor, someone is monitoring for new patches, and patches are applied quickly.

That old Windows 10 machine is about to cost you double

If you are still running Windows 10 machines, you may want to reconsider. Support for Windows 10 ended in October last year. Customers who purchased Extended Security Updates (ESU) will continue to get security updates for a fee. When that renews this month, it will cost you double what it did last year. After October 2028, security updates for Windows 10 will stop completely.

According to Statcounter most machines have been upgraded, but over a quarter of Windows machines still run Windows 10. I get it, you have a machine in a corner that runs a piece of software, or uses a device that just won’t work on Windows 11. Perhaps it’s time to look at that and find alternatives.

What to do next:

1. Count your Windows 10 machines, and which you are already paying for ESU for.
2. Give each machine a plan and a date to upgrade, replace or retire. Replace any software or hardware that can’t run on Windows 11 with modern alternatives.
3. For anything that has to stay, ask your IT provider how you can isolate it so that it’s not exposed to any future security risks.

Can AI governance keep pace with AI use?

KPMG’s Global AI Pulse survey shows that larger UK companies are handing accountability for AI decisions to senior leaders, with 64% saying it rests with C-suite level or above. A separate report from Informatica shows that 76% of firms worldwide say AI governance can’t keep up with employee AI use. The ICO has been clear: Organisations stay accountable for personal data and must meet UK GDPR principles, whether or not AI tools are officially approved.

SMEs don’t have to implement a large AI strategy like larger organisations, but they must ensure they comply with the same rules. Imagine an employee pasting a client contract or a spreadsheet of personal details into a free AI chatbot to summarise it. Someone in the organisation has to own the company’s AI use, decide which tools are allowed, what data can and can’t go into them, and ensure staff understand the rules.

What to do next:

1. Name an owner for AI in the business, document it and ensure staff know that this is the person to ask about AI use.
2. Ask your staff where AI is actually used, with no blame. Find out whether it’s a company or personal account, and what information is passed into the AI.
3. Write a one-page AI policy detailing which tools are allowed, what must never go in (client information, contracts, financial details, passwords), and who to ask.

The UK is a top target, and attackers are getting faster

According to the Microsoft Digital Defense Report 2026, the UK is fifth in the world for customers hit by cyber attacks, and the most targeted in Europe for nation-state attacks. Attackers are able to plan and put together an attack in minutes rather than days, thanks to AI.

The way in hasn’t changed. Phishing rose globally from 7% to 23% of intrusions Microsoft’s incident responders investigated. Voice phishing, where the target is called on the phone or on a platform like Teams, increased over 500% year on year. Meanwhile, ransomware attack detections in the UK are up by 66%.

I feel state-linked attacks are unlikely to target most UK SMEs, but there are risks in being caught up in the fallout as well. You may supply the government, NHS, energy suppliers, or a variety of other critical national infrastructure. Hackers may decide that you’re an easier way in, rather than going directly.

What to do next:

1. Ensure your team receives training on cybersecurity, including phishing attacks. Agree a rule that any request for passwords, access or payments is checked by calling a number you already know.
2. Ask your IT provider how quickly they could identify and respond to an attack. Who is watching out of hours, and what happens if someone gets in on Friday evening?
3. Ensure safety nets are in place to limit the damage if a password is stolen, such as a code on your phone, and that backups can’t be reached by ransomware.

New Chromebooks lose two years of support as Googlebooks arrive

Google promised ten years of updates for new Chromebooks. A support page now says that if you buy one today, updates will stop in 2034, which is eight years away. Google’s replacement, the Googlebook, runs a new operating system with its Gemini AI built in. Google says many newer business Chromebooks will be able to move across to it, but the details will come later, and the move will need a new licence for the management tools. Existing ChromeOS licences won’t carry over.

As The Register points out, few Chromebooks bought now will still be in use in 2034, so the two lost years matter less than the direction. It also reckons Google wants staying on Chromebooks to feel unattractive, and the new licence requirement fits that. Googlebooks have recently gone on sale from Acer, Asus, Dell, HP and Lenovo, starting at £999. These are consumer machines for now and Chromebooks are still being made. It’s the same lesson as the AI model story: the supplier can change the terms after you’ve bought. 

If you run Chromebooks, there’s no need to panic, but there are dates to know.

What to do next:

1. If you’re buying this year, plan for eight years, not ten, and ask your supplier what the upgrade path and licence costs to Googlebook will be.
2. Hold off buying Googlebooks for the business until there are business models and clear details on management and licensing.
3. With Gemini built into the operating system, ask Google or your supplier what data the AI can see and where it’s processed. Check that fits your AI policy and your UK GDPR duties before you roll any out.

AI is helping defenders as well as attackers

Earlier, I suggested a code on your phone as a safety net against stolen passwords. It still is, but it’s no longer the whole answer. Researchers this summer got inside a rented phishing service called BigBear 2.0 and found over 5,000 stolen logins from hundreds of organisations, including 474 that bypassed that extra layer of security. It works by sitting between you and the real Microsoft login page and copying the proof that you’ve logged in. You get in normally, but the criminal walks in behind you. Criminals can rent this service without any technical skill.

AI is being used in a lot of attacks, but the good news is that AI is helping keep you safe as well. Many security tools now learn what’s normal behaviour for each user and device, and alert when an access request seems odd. Take for example an access request from abroad, just minutes after you have signed in from your desk. Many businesses already pay for security tooling, but don’t fully utilise it. An alert that nobody looks at, is as good as no alert at all. This is defence in depth again, not just the password, but also a system monitoring for odd behaviour.

What to do next:

1. Ask your IT provider for a list of the security tools you already pay for, and which smart features are switched on.
2. Ask to see the last few security alerts for your company, and what was done about them.
3. Check that alerts are on for unusual sign-ins to your email, and ask about passkeys or security keys (logins that can’t be stolen by a fake page) for admin and finance accounts.

Rework is eating AI’s time savings

New research from Templafy, a company that sells document software, surveyed 2,000 knowledge workers in the UK and US. Among UK respondents, 54% use AI to create business documents at least once a day, and 96% still edit what it produces. Just over half say checking the output leaves little time actually saved, and 35% say editing can take longer than writing the document themselves. Nearly one in five (18%) spend six or more hours a week reviewing and fixing AI-generated documents. Templafy calls it an “AI productivity tax”.

The most common fixes are facts, numbers and claims (40%), generic wording (36%) and formatting (35%). And it’s not only internal documents: 32% have used AI for presentations and pitch decks in the last three months. Part of the problem is context. 42% say their AI tools can’t access approved company content, and 51% say they skip approved company templates because asking AI is faster. It’s quicker to ask, but slower to finish.

Time saved drafting isn’t the same as time saved overall. If you’re paying for AI tools, it’s worth knowing whether they still save time once the checking is counted. Whoever owns AI in your business, as we covered earlier, is the natural person to ask.

What to do next:

1. Ask the people using one AI tool whether it saves them time once checking and fixing are counted.
2. Give AI your own material, such as approved templates, past documents you’re proud of and a short style guide, so it starts closer to right. Keep it within your AI policy.
3. Agree that a person checks every fact and number in anything customer-facing before it goes out.