What to do if you’ve had a cyber near miss: 9 practical steps
The best time to prevent a cyber attack is before it happens. The next best time is when you realise how close you came to one.
What does a near miss look like?
Scenario 1:
Imagine your finance team receives an email from a supplier asking them to update its bank details. The message looks convincing, and a payment is prepared. Before authorising it, a colleague calls the supplier using a number already on file. The request is fraudulent.
No money has left the business. That is a near miss.
Scenario 2:
An employee follows a link to what appears to be a Microsoft sign-in page. They enter their password, then become suspicious and report it. Your IT provider secures the account.
That may feel like a near miss because no obvious damage has occurred. However, if someone accessed the mailbox, an incident has already happened. The absence of visible harm does not prove that nothing was taken.
In both situations, there is a natural temptation to breathe a sigh of relief and get back to work.
But stopping the immediate problem does not always end the risk. What happened may have exposed a weakness, revealed useful information or given someone the opportunity to try again.
Calling something a near miss should be the starting point for an investigation, rather than its conclusion.
9 steps to handling a cyber near miss
Make incident reporting easy - and non-judgemental
Take immediate action
Keep good records
Establish the facts quickly
Scenario plan what might come next
Give warnings people can act on
Decide whether the incident is reportable, and report it
Turn the warning into a lasting improvement
Make incident reporting easy - and rewarding
These steps provide a framework, rather than a strict sequence. Some actions, particularly containment and assessing reporting obligations, need to happen in parallel.
1. Make incident reporting easy – and non-judgemental
Depending on where you are in your journey, making reporting easy and non-judgemental before you experience a near miss will help you to catch problems before they turn into a full-blown incident. If you already do this, great – it could not be more critical, because you may never know how narrow your escape was unless someone reports it.
If you don’t, see step 9.
2. Take immediate action
The first priority is to prevent further harm. The action depends on what happened.
For the fraudulent payment request, stop the payment and any related bank-detail changes. Confirm the position with the supplier through a trusted contact. Preserve the message and check whether colleagues received similar requests. If money has already been sent, contact your bank immediately.
For a potentially compromised account, involve your IT provider promptly. Alongside changing the password, they may need to revoke active sessions, check recovery settings and remove unauthorised forwarding rules. They should investigate what the account accessed or sent. A password change alone may leave other routes of access in place.
3. Keep good records
Keep a record of what happened, when it was discovered and what action was taken. Preserve relevant emails and logs so that the investigation has something reliable to work with, and so that you have good evidence should you conclude the incident is reportable.
4. Establish the facts quickly
Whether you are dealing with a serious system outage or a near miss, it's important to make an objective assessment.
For example, in scenario 1, you should ask: why was the request convincing? Did the sender know the supplier’s name, the amount due or when payment was expected? Because those details may point to a wider problem.
In scenario 2, the important question is whether someone actually accessed the account and, if so, what information they could have seen or used.
Ask yourself:
What information or access was exposed?
Distinguish between an email address, a password and access to an entire mailbox. They create different opportunities.How did the attack happen?
Remember that you may be the subject of the attack, but you may not be the source of information.
5. Scenario plan what might come next
You cannot predict every move. But you can ask yourself:
What would that help someone do?
Could they impersonate a supplier, identify a payment date, approach a client or produce a convincing request for more information?Who could be affected?
Look beyond the person who received the original email. Finance staff, customers and suppliers may now be the more attractive targets.What would interrupt the next attempt?
That might mean independently verifying bank changes, warning particular contacts, checking related accounts or monitoring for suspicious sign-ins.
An email address alone does not give someone access to a mailbox. But it does give them somewhere to send their next attempt.
The risk increases when an address comes with context: a name, job title, customer relationship, invoice or recent conversation. Criminals can combine that information with public sources to make an approach more believable.
Consider these possible follow-on attempts:
A convincing supplier impersonation. Someone who knows you are expecting an invoice sends a replacement with different bank details.
A targeted sign-in request. A customer receives a message referring to a real project and asking them to open a “secure document”.
A fake support call. An employee is contacted by someone claiming to be helping with the recent security incident and asking for access or a verification code.
An attack on your contacts. If a mailbox was accessed, existing conversations may help someone impersonate your business when approaching clients or suppliers.
These are possible consequences, rather than proof that they will happen. The important point is that information which appears harmless in isolation can make a later deception more credible.
6. Give warnings people can act on
“Be vigilant” offers little help.
“We have received a fraudulent request to change this supplier’s bank details; verify any further requests using the number in our supplier records” is much more useful.
7. Decide whether the incident is reportable, and report it
If personal data may have been compromised, assess the consequences for the people concerned and document your reporting decision, using ICO guidance.
Where a personal data breach is likely to “result in a risk to individuals' rights and freedoms”, it must be reported to the ICO without undue delay and, where feasible, within 72 hours of awareness. Breaches likely to create a high risk to individuals also require direct notification without undue delay.
You should not wait for actual harm before assessing these duties, or for the investigation to be complete before making a report where one is required.
8. Turn the warning into a lasting improvement
Never make strategic decisions in the middle of an operational incident. Your immediate focus is on containment. Once it is contained, you can review why it nearly succeeded and what stopped it.
Was there a reliable control, or did someone happen to notice? Could another colleague have made the payment? Would the same approach work tomorrow?
Agree a small number of improvements, give each an owner and check they work. That might be a stronger payment-verification process, tighter account access or a clearer way to report suspicious activity.
The NCSC specifically recommends checking important email requests through a second communication method. E.g. by text to a verified number or even by ringing them directly.
9. Make incident reporting easy – and rewarding
A culture that rewards openness and honesty is non-negotiable to keep you safe. We’re all human, we all make mistakes. And a colleague who raises a concern quickly gives the business a chance to contain it. If people fear being blamed, they’re less likely to speak up next time.
If your reporting process didn't work as well as it should, now is the time to improve it.
A near miss gives you an opportunity to strengthen the business before the consequences become more serious. Its value depends on what you do with it.