Here is an uncomfortable truth that affects almost every workshop, garage, manufacturing firm and trades business in the UK right now. When you ask business owners whether data security matters, the answer is always yes. Almost seven in ten say it is their single biggest concern when updating or changing their IT. And they mean it.
But then ask a different question — “Could you pass an external security check tomorrow?” — and the mood shifts. Only about a third feel genuinely confident they could. That is a massive gap between what people believe and what they could actually prove. And for businesses where uptime is everything, it is a gap that can cost real money when something goes wrong.
How Did Things Get So Complicated?
Nobody wakes up one morning and decides to make their IT a mess. It builds up slowly, one sensible decision at a time.
A few years ago, you moved your email to Microsoft 365. Then you started using a cloud-based accounting package. Maybe you added a job management app, or a cloud platform for sharing files between the workshop and the office. Each one solved a genuine problem and made life easier at the time.
But while those new tools were going in, the old ones stayed put. The server in the back office that holds years of job records. The PC in the workshop that still runs an older version of software because nobody wanted to risk breaking it. The spare laptop that one of the engineers uses occasionally. They all still work, so nobody thinks about them much.
The trouble is, each of those systems holds data. Each one has login details associated with it. And each one may have access permissions that were set up years ago by someone who no longer works for you. Over time, your data ends up spread across multiple locations — and nobody has a clear map of where everything is.
The Questions You Need to Be Able to Answer
If someone were to sit you down and ask a few basic questions about your data, how would you get on?
- Where exactly is your important business data stored? Could you list every system, every cloud service, every device that holds job records, customer details, financial information or supplier data?
- Who can access that data right now? Not who was given access three years ago — but who can actually log in and see it today? Have you checked recently?
- Are old systems still holding data they no longer need? That server you stopped using for new work twelve months ago — does it still have customer records on it?
- Do you know how data moves between your systems? When a file goes from your job management software to your accounts package or your email, do you know whether that transfer is protected?
Most business owners in manufacturing and the trades would struggle with at least one of those questions. That is not because they are careless — it is because the technology has moved faster than the housekeeping.
Old Logins and Forgotten Permissions: The Quiet Threat
One of the biggest risks hiding in most businesses is access that should have been revoked but never was. It happens in every industry, but it is particularly common in workshops and manufacturing businesses where staff turnover is frequent and IT administration gets squeezed around other priorities.
A new starter joins and gets set up with login credentials. An apprentice finishes and moves on — but their login stays active. A contractor comes in for a three-month project and keeps their access afterwards because nobody thought to remove it. Over time, you end up with a growing list of people who can get into your systems, even though many of them should not be able to.
This is not a minor admin issue. It is a genuine security vulnerability. Old, forgotten credentials are exactly what attackers look for. We covered a real-world example in our article about why MFA matters more than ever, where stolen passwords that were years old were used to break into business systems — simply because nobody had turned them off or added multi-factor authentication.
Legacy Systems: They Work, but Are They Safe?
If you have got a piece of equipment on the workshop floor that still runs perfectly after fifteen years, that is great engineering. But when IT systems last that long without being updated, it is a different story.
Legacy systems — old servers, outdated software, machines running operating systems that no longer receive security updates — are a common feature in manufacturing and trades businesses. They often run critical processes: stock management, job scheduling, CNC machine interfaces or invoicing. Replacing them feels risky and expensive, so they stay.
The problem is that these systems are often the weakest link in your security chain. They may not support modern protection methods. They may have known vulnerabilities that will never be patched. They may be connected to your network in ways that give an attacker a route into everything else.
And there is a staffing angle too. Research shows that more than half of organisations struggle to find people with the skills to manage today’s technology properly. In a workshop environment, where the IT is usually handled by whoever is most comfortable with computers, that skills gap can leave critical systems running on autopilot with nobody truly understanding what is happening under the bonnet.
AI Tools Are Coming — But Your Foundations Need to Be Solid First
There is a lot of buzz around AI right now. Tools that can automate quoting, predict stock shortages, streamline invoicing or spot patterns in production data. Some of these tools are genuinely useful, and many workshops and manufacturers are already starting to explore them.
But AI tools rely on your data being clean, well-organised and properly secured. If your data is scattered across systems with inconsistent access controls, or if legacy platforms are feeding outdated information into new tools, the AI will only amplify the problem. It will make decisions based on bad data — faster.
Getting your data foundations right is not just a security exercise. It is the essential groundwork for making AI work for your business rather than against it.
Phishing Has Changed Too
It is worth mentioning that the threats trying to get at your data have evolved as well. The days of obvious scam emails with spelling mistakes and dodgy links are fading. Modern phishing attacks can look polished, professional and entirely convincing — even to experienced staff. We covered this in detail in our article about how next-gen phishing is changing the rules, and it reinforces why relying on people alone to spot threats is no longer enough. Layered security — including strong email filtering, endpoint protection and multi-factor authentication — gives you a safety net even when a convincing email gets through.
Practical Steps to Tighten Up Without Slowing Down
None of this means you need to rip everything out and start again. What it means is that a bit of structured housekeeping goes a long way. Here are the practical steps that make the biggest difference:
- Map your data: Make a list of every system, device and cloud service that holds business data. Include the old ones. Include the ones you “don’t really use any more.” If it is switched on and connected, it counts.
- Review access permissions: Go through your user accounts and remove anyone who should not have access. Disable old logins. Check that current staff only have access to the systems they actually need for their role.
- Turn on multi-factor authentication: This is the single most effective step you can take. If someone’s password is stolen, MFA stops it being used. It takes seconds to set up and could save you weeks of disruption.
- Assess your legacy systems: Identify anything running on unsupported software or operating systems. Work out a realistic plan to replace or isolate those systems so they do not become a route into everything else.
- Check your browser security: Your team’s web browsers quietly collect a surprising amount of information about your business. Saved passwords, session data, browsing patterns — all of it could be exposed in a breach. As we explained in our article on why browser security is important, taking a few minutes to review browser settings and permissions can significantly reduce everyday risk.
- Get a second opinion: Sometimes you are too close to your own setup to see the gaps. An external review by someone who understands manufacturing and trades IT can highlight risks you have been walking past every day without noticing.
Keep Your Business Moving — Securely
Data security is not about ticking boxes or passing audits for the sake of it. For workshops, garages and manufacturers, it is about one thing: keeping the business running. A security incident does not just mean lost data — it means locked systems, missed deadlines, stalled production and unhappy customers.
The good news is that closing the gap between feeling secure and actually being secure does not have to be complicated, expensive or disruptive. It just takes a bit of focused attention — and the willingness to ask yourself the honest questions.
If you would like us to take a look at your setup, check where the gaps are and give you a straightforward plan to close them, get in touch. No jargon, no hard sell — just practical help to keep your operation moving safely. Contact EC Computers today.