Three changes hitting UK SMEs this week and the simple actions that reduce risk fast

If you run a small or mid-sized business, your IT priorities are usually the same every week: keep people working, keep costs predictable, and avoid nasty surprises. This week’s stories map neatly onto those three goals: security patching, connectivity contract clarity, and AI governance.

None of these require a big “transformation programme”. They do require a bit of focus and a few repeatable habits.

1) Microsoft’s March security updates: why “we’ll do it later” is the expensive option

Microsoft’s March 2026 security releases include fixes for 80+ vulnerabilities, with two zero-day issues highlighted in official alerts. For most SMEs, the detail of each CVE matters less than the pattern: attackers are excellent at targeting organisations that are a few weeks behind.

SMEs are often hit not because they’re specifically targeted, but because they sit in the “easy to compromise” bracket:

Devices aren’t consistently patched (especially laptops that are off-network).
Old software lingers (legacy Office installs, unsupported line-of-business apps).
There isn’t a single place to confirm whether patching actually succeeded.

The practical takeaway: don’t think of patching as a monthly chore. Treat it as a weekly health check with clear ownership.

A simple patching routine that works for SMEs

Automate updates where you can, but also measure compliance. Automation without reporting is just hope.
Prioritise:
- Internet-facing systems and remote access tooling
- Privileged accounts and admin endpoints
- Staff laptops (especially senior leaders and finance)
Keep a short “exception list”: anything that can’t be patched quickly should have compensating controls (extra monitoring, limited access, or isolation).

If you rely on older Office builds or on-prem components, make sure you’re tracking the specific updates that apply.

Where Comtek fits: we can make patching boring in a good way by handling patch policies, reporting, and the follow-up when devices drift out of compliance.

2) Telecoms: the end to surprise mid-contract bill hikes (and why this matters to SMEs)

Cost predictability matters. The government announced a charter with major telecoms providers aimed at ending unexpected mid-contract price rises and improving clarity and social tariff access.

Even if you don’t think of yourself as “telecoms-heavy”, your business likely depends on:

Broadband for cloud apps, Teams/Zoom, and line-of-business systems
Mobile contracts for field staff
VoIP and hosted voice (where broadband quality directly impacts call quality)

The practical takeaway: treat telecoms as an operational risk, not just a utility bill.

What to do this week

List all business broadband/mobile contracts and identify those renewing within 3–6 months.
Check whether pricing is fixed, indexed, or subject to uplift—and whether that’s now clearer under the charter.
For multi-site organisations: confirm each site has the right service level and resilience plan (failover, 4G/5G backup, or secondary line).

Where Comtek fits: we can review your current contract position, compare options, and align connectivity to how your business actually works (including VoIP quality and resilience).

3) AI is increasing both opportunity and risk, so SMEs need guardrails

March’s security conversations continued to focus on AI: it’s useful, but it changes the threat landscape and introduces new governance questions, especially where “agent-like” automation is used.

For SMEs, the real risk isn’t that AI becomes “sentient”. It’s much more mundane:

Staff paste sensitive data into tools that retain it
AI-generated content is used without checks (errors, hallucinations, compliance issues)
Accounts with powerful access are poorly protected (making AI tooling a new pathway for attackers)

The practical takeaway: you don’t need a 40-page policy. You need clear rules and a handful of technical controls.

A lightweight AI policy that works

What’s allowed: which tools, for what tasks
What’s never allowed: customer data, HR data, credentials, financial info, internal-only documents
How outputs are checked: human review required before external use
Who owns it: a named person for approvals and exceptions

Then pair that with baseline security hygiene: MFA everywhere, strong admin controls, and sensible access management.

Where Comtek fits: we can help you put simple AI rules in place and configure Microsoft 365 controls so the productivity wins don’t come with avoidable exposure.