Most business leaders know cyber threats are real. They've seen the headlines. They've sat through the briefings. And most of them still haven't done much about it, not because they don't care, but because the risk has always felt abstract.
"We're too small to be a target." "We'd probably be fine." "It won't happen to us."
The problem is that cyber incidents don't just happen to large enterprises with household names. According to the National Cyber Security Centre, small and medium businesses now account for the majority of reported cyber incidents in the UK. Architecture practices, marketing agencies, design studios, engineering consultancies (the kind of firms Lyon Tech works with every day) are being targeted precisely because attackers know they're less likely to have robust defences in place.
What tends to shift the conversation isn't a statistic. It's a number with a pound sign in front of it.
Why we built this
We built a free cyber risk calculator to give businesses a credible, personalised answer to that question, in under two minutes, with no technical knowledge required.
It asks seven questions about how your firm is set up: your sector, your size, your IT support arrangements, your backup situation, whether you use multi-factor authentication, the sensitivity of the data you hold, and whether you have cyber insurance. From those answers, it produces a headline cost estimate and a breakdown across four categories: downtime and lost productivity, data recovery and IT remediation, regulatory exposure, and reputational impact.
The figures are grounded in real UK SME incident data from the NCSC, the Hiscox Cyber Readiness Report, and ICO enforcement records. They're illustrative rather than guaranteed (no calculator can predict the exact cost of a specific incident) but they're calibrated to be realistic, and most firms find the number meaningfully higher than they expected.
What the calculator shows you
Beyond the headline figure, the results page highlights where your biggest exposure sits and what that means specifically for your sector. An architecture firm's risk profile looks different to a marketing agency's - different data types, different software environments, different recovery timelines - and the calculator reflects that.
It also shows the effect of the decisions you're already making. Firms with tested, regular backups and full multi-factor authentication across their systems see materially lower estimates than firms running on ad hoc IT support with no backup confidence. That gap is the point: it shows what good IT practice is actually worth in financial terms, not just in theory.
Take the quiz
What to do with your result
If your number is lower than expected, that's genuinely good news: it means the basics are in place and your risk is being managed.
If it's higher, or if the questions surfaced gaps you hadn't thought about, that's worth acting on. The most common issues we see are firms with backups they've never tested, partial MFA rollouts that leave key systems exposed, and no clear plan for what happens in the first 24 hours of an incident.
None of those are difficult or expensive to fix. But they do need someone to look at them properly.
A free IT security review
If you'd like a more detailed picture of where your firm stands (not a calculator estimate but an actual assessment of your environment) Lyon Tech can help.
Our engineers will go through the areas the calculator covers and more: your endpoint security, your access controls, your backup and recovery setup, and your broader vulnerability to the kinds of attacks that are most common in your sector.
Most firms find gaps they didn't know existed. Some find they're in better shape than they thought. Either way, you'll leave with a clear picture and practical recommendations.
