Small companies in Lancashire are the 'low hanging fruit' for greedy cyber criminals
All companies are at risk from cyber attacks, says Clive Grunshaw.
A pioneering new cyber attack simulation has been launched in Lancashire to help businesses prepare for the growing threat of online cyber crime.
And the organisers warn that no company is too small to become a target
Lancashire businesses are being given the opportunity to test how they would respond to a cyber-attack before facing one in real life through a training programme believed to be the first of its kind in the UK.
Funded by Lancashire Police and Crime Commissioner Clive Grunshaw using money recovered through the proceeds of crime, the Cyber Attack Hydra Simulation has been created specifically for businesses by the University of Lancashire.
The training is being offered free of charge to Lancashire businesses, ensuring organisations of all sizes can access practical support and preventative learning without cost becoming a barrier.
The initiative aims to help small and medium-sized businesses prepare for the difficult decisions they could face during a cyber incident, placing participants in a realistic, time-pressured scenario that mirrors the challenges organisations encounter when systems are compromised.
Rather than focusing on technical IT skills, the simulation explores how business owners and senior leaders respond under pressure, covering areas including leadership, communications, business continuity and risk management.
The programme comes as cyber crime continues to pose an increasing threat to organisations of every size. According to the Government's Cyber Security Breaches Survey 2025, 43 per cent of businesses experienced a cyber breach or attack in a 12 month period.
Speaking about the initiative, Mr Grunshaw said the training was designed to help businesses prepare for incidents that could otherwise have devastating consequences.
"Hydra has been developed by government agencies and the police, as a response to cyber attacks, for how they should respond when they come under cyber attacks. But it's now been adapted so it can be used by businesses," he said.
"In the UK, we've had some big examples such as Marks & Spencer that have come under attack, but it's not just big businesses. Any business, medium or small, can come under attack."
Mr Grunshaw explained that participants are placed into realistic scenarios where they must respond as events unfold.
"They go through a real-life scenario of what will happen to them with their business and then what implications that will have, how their accounts could be frozen, how their customers' details could be stolen, and how they should respond as quickly as possible to prevent that happening."
The Commissioner said his office had funded 12 training days, where around 20 businesses take part in sessions. He described feedback from those who had already participated as "extremely positive".
He said the growing use of technology meant cyber crime was becoming increasingly common and warned that smaller businesses often mistakenly believe they are unlikely to be targeted.
"The smaller businesses can become the low-hanging fruit," he said.
"Criminals will go wherever they can make money. Wherever they can find easy money, that's where they will be.
"Businesses are at the heart of our community. It's not just about protecting them, it's about protecting the communities in Lancashire as well."
The training is being delivered by the University of Lancashire, which has adapted the Hydra decision-making framework from its traditional role supporting emergency services and strategic command teams.
Clive Tattum, Dean of the University's School of Law and Policing, said the project had grown from long-standing partnerships with Lancashire Police and the Police and Crime Commissioner's Office.
"We've been working with them for a while to see what we can do to support small businesses," he said.
"Hydra traditionally is around law enforcement. I've used it as an ex-practitioner in terms of decision-making, and we thought it would be really good if we could transfer that over to small businesses.
"A lot of small businesses don't have the finances to bring in specialist cyber expertise. By working together, we can strengthen resilience across Lancashire and help organisations better protect themselves against this continually evolving threat."
He added that the university had invested heavily in cyber education over the past decade and wanted to ensure its expertise could benefit businesses across Lancashire.
"Today's more about dealing with it as it's happened and seeing what businesses would do, putting them through the Hydra facility, which is an immersive learning tool," he said.
While high-profile ransomware attacks often make national headlines, organisers say businesses are far more likely to encounter phishing emails, online scams and other opportunistic attacks.
Detective Inspector Dan Giannasi, Director of the North West Cyber Resilience Centre, said many organisations still underestimate the risks they face.
"One of the things we see most often is people not thinking they're at risk of cyber crime because they think they're too small or they don't think they're important enough to be hit," he said.
"The reality is criminals are just targeting any business and any organisation because they're just after opportunities. They're just after money."
He said preparation was one of the biggest factors in reducing the impact of an attack.
"Often some of the mistakes are because there is a lack of preparation. There's a lack of planning for those sorts of things and not knowing what you do if you can’t access systems."
Businesses taking part in the simulation can also receive aftercare packages and follow-up support from the North West Cyber Resilience Centre, helping them identify weaknesses and providing practical guidance on improving their cyber resilience.
Detective Inspector Simon Gray, who’s responsible for Lancashire Police's cyber crime and digital investigation teams, said technological advances meant cyber security should now be considered as important as physical security.
"We live in an age now where technology is advancing rapidly," he said.
"Anybody can be a victim. Offenders target hundreds and thousands of people, and it could be just that one individual that becomes the vulnerability.
"Small businesses often operate on tight budgets and cybersecurity doesn't always appear at the top of the priority list, but unfortunately it's those vulnerabilities that get exploited."
Among those to have already experienced the simulation is Karen Livesey, a director at No Whispers Community Interest Company, admitted she almost dismissed the invitation for the training scheme because she assumed the training was intended for much larger organisations.
"When I initially saw the email, I thought it was aimed at very big companies," she said.
"But when I read the finer details, I realised it was aimed at small companies, charities and community interest companies. Cyber crime is becoming more and more common and when I thought about it, I knew I needed to go because I don’t know everything."
Describing the experience, she said: "It was mind-blowing. It was challenging. It was entertaining and impressionable. It made everything feel very real because we had to make decisions in real-time and the scenario changed more than once, so it was very fast-paced.”
The exercise has already prompted changes within her organisation, including further staff and volunteer training and a review of its cyber security arrangements.
"I think the biggest thing I took away was understanding that criminals can and do target small companies," she said.
"We're going to continue working with the University of Lancashire's Cyber Crime unit, for further training with my volunteers, as well as look at our website and review our response strategies.
"You don't know what you don't know, so why not go and find out? I'd strongly recommend people coming to this because it was brilliant."