What are the 5 types of cyber security? A plain-English guide for UK businesses

Cyber security isn’t one thing. It’s five overlapping disciplines, and a real defence covers all five. Get one wrong and the whole stack weakens.

This guide breaks down the five types of cyber security, what each one actually does, and how a properly configured Microsoft 365 environment plus managed-IT support brings them all together for a UK SMB.

1. Network security

Network security protects the digital roads your data travels on, the office Wi-Fi, the business broadband, the VPN, the cloud-to-cloud connections. If an attacker can sit on the network, they can intercept, redirect or block what’s flowing across it.

Key network security measures

• Firewalls control what traffic enters and leaves the network. Block what doesn’t need to be there.
• Intrusion detection and prevention systems (IDS/IPS) monitor for suspicious traffic patterns and either alert or block.
• Virtual private networks (VPNs) encrypt traffic between staff and corporate resources. Increasingly replaced by Zero Trust Network Access for SMBs.
• Network segmentation separates guest Wi-Fi from staff Wi-Fi from server VLAN. A compromise in one area doesn’t immediately become a compromise everywhere.

2. Application security

Application security covers the software your business runs on, the operating system, the line-of-business apps, the website, the cloud services. Vulnerabilities in any of these become entry points.

Key application security measures

• Patching and updates. Most applications fix vulnerabilities in updates. Apply them within 14 days of release.
• Secure configuration. Defaults are rarely secure. Review settings on every app you deploy.
• Input validation and code review for any custom-built software.
• Web application firewall (WAF) for any internet-exposed application.

3. Information security

Information security is about protecting the data itself, regardless of where it lives. The goal: confidentiality, integrity, availability (the classic CIA triad).

Key information security measures

• Encryption at rest (on disk) and in transit (over the network). BitLocker, TLS, encrypted backups.
• Access controls based on the principle of least privilege. Staff only get access to the data they need.
• Data loss prevention (DLP) rules that detect and stop sensitive data leaving the organisation in risky ways.
• Sensitivity labels that classify content (Confidential, Highly Confidential, etc.) and enforce protection automatically.
• Backups tested regularly, stored separately from live systems, immutable where possible.

4. Operational security

Operational security (OPSEC) covers the processes, the people, the day-to-day decisions that protect or expose information. It’s about how the business actually runs.

Key operational security measures

• Documented incident response plan covering detection, containment, eradication, recovery, lessons learned.
• Access provisioning and deprovisioning processes. New starter on day one, access removed within an hour of leaver notification.
• Change management. No production changes without approval and rollback plan.
• Vendor and supply chain risk management. Knowing who has access to what, and what controls they operate.
• Regular audits and reviews. Annual cyber-insurance renewal is a forcing function for many SMBs; better to do it proactively.

5. Team member (people) security

The biggest single security weakness in any organisation is its people. Phishing, social engineering, accidental data leaks, weak passwords. People-related issues account for the majority of breaches.

Key team member security measures

• Cyber awareness training at least quarterly, with simulated phishing campaigns to keep skills sharp.
• Password managers deployed as standard so staff don’t reuse weak passwords across sites.
• Multi-factor authentication on every account that supports it.
• Clear acceptable-use policies covering personal devices, public Wi-Fi, email, social media, AI tools.
• Reporting culture where staff are rewarded (not blamed) for flagging suspicious emails.

How a managed-IT setup brings them together

For an SMB, you don’t need separate vendors and tools for each of the five types. A properly configured Microsoft 365 Business Premium tenant plus a managed-IT provider covers the lot.

• Microsoft Defender for Endpoint covers network and application layer threats.
• Microsoft Purview covers information security (DLP, sensitivity labels, encryption).
• Conditional Access and Intune cover access control and device compliance.
• Documented MSP processes cover operational security.
• Quarterly training and phishing simulations cover the people layer.

Want these five layers set up and quietly managed for your firm? We provide managed IT support in Lichfield and across the West Midlands.

Quick check: where does your business stand on cyber security?

The questions in our free 2-minute Cyber Security Health Check are the eleven we ask every new client first. Score yourself, see the per-category breakdown, get the three highest-impact fixes for your specific gaps. No marketing list.

Take the 2-minute Cyber Health Check

Frequently asked questions

Initial IT covers all five types of cyber security as standard for every managed-IT client. Lichfield, Staffordshire and the West Midlands.