For most UK firms with fewer than 250 staff, the best cloud data security is not one provider but two purchases that work together. Start with a security suite that protects identities, devices and email, which for a Microsoft 365 business is usually Business Premium at £16.90 per user per month. Then add a separate, immutable backup service that you have tested against the NCSC's ransomware-resistant backup principles, because resilience is proved by recovery, not by a brand name.
If you want the top-rated names, Veeam, Rubrik and Druva each say they were named Leaders in Gartner's 2026 Magic Quadrant for Backup and Data Protection Platforms. Those ratings are a sound way to build a shortlist, but no analyst report ranks one provider as the most resilient against every attack.
Which cloud data security tool suits a UK firm with fewer than 250 staff
The question "who is the best cloud data security provider" bundles together two different jobs. One is prevention: stopping phishing, account takeover and malware on laptops. The other is recovery: getting your files, mailboxes and systems back after something goes wrong. No single product on a small firm's budget does both jobs equally well, so the sensible shortlist splits in two.
For prevention, Microsoft says Microsoft 365 Business Premium is designed for businesses with up to 300 employees, which covers the whole 1 to 249 band. It bundles Defender for Business, Defender for Office 365 Plan 1, Entra ID P1 and Intune P1. For recovery, the choice is between Microsoft's own pay-as-you-go Microsoft 365 Backup and an independent service such as Veeam Data Cloud. The rest of this guide covers what each costs, how to test them and where your data ends up.
What UK firms of this size are facing in 2026
The government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that 43% of UK businesses identified a cyber security breach or attack in the previous 12 months. Around 19% were victims of at least one cyber crime, and the risk climbs with size.
Share of UK businesses hit by cyber crime, by size
Percentage of UK businesses in each size band that were victims of at least one cyber crime in the previous 12 months.
View the data
| Category | % victims of cyber crime |
|---|---|
| Micro (1 to 9) | 17 |
| Small (10 to 49) | 24 |
| Medium (50 to 249) | 41 |
| Large (250+) | 48 |
The same survey shows where small firms are already strong and where they are not. Backing up data securely via a cloud service was in place at 74% of businesses, but two-factor authentication was at only 47%. The pattern for a buyer is clear enough. Most firms have a backup of some kind, but fewer have the identity controls that stop an attacker reaching it.
Which basic cyber controls UK businesses have in place
Percentage of all UK businesses reporting each technical control.
View the data
| Category | % of businesses |
|---|---|
| Updated malware protection | 81 |
| Cloud backup | 74 |
| Password policies | 74 |
| Network firewalls | 74 |
| Restricted admin rights | 73 |
| Two-factor authentication | 47 |
What Microsoft 365 Business Premium covers and what it costs in pounds
Microsoft's UK small and medium business pricing page lists every price below per user per month, paid yearly on an annual subscription, and states that the price does not include VAT. Business Premium sits at £16.90, against £10.80 for Business Standard. The security parts can also be bought one at a time, and each is marked as included in Business Premium.
Microsoft UK list prices for small business security
Published UK list price per user per month, paid yearly, excluding VAT, checked on 14 November 2026.
View the data
| Category | £ per user per month |
|---|---|
| Business Premium | £16.90 |
| Business Standard | £10.80 |
| Intune P1 | £6.20 |
| Entra ID P1 | £5.40 |
| Defender for Business | £2.30 |
| Defender for Office 365 P1 | £1.54 |
For a 25-person firm, Business Premium works out at £5,070 a year before VAT, against £3,240 for Business Standard, a difference of £1,830 a year. That gap buys device management through Intune, conditional access through Entra ID P1, endpoint protection through Defender for Business and extra email protection through Defender for Office 365. Bought separately on top of Business Standard, those four components would list at £15.44 per user per month, so the bundle is the cheaper route if you need most of them.
A firm that already runs a different identity and device stack can buy Defender for Business alone at £2.30 per user per month. Microsoft describes it as device security for businesses with up to 300 employees, covering Windows, macOS, iOS and Android. It is an endpoint product, not a replacement for the full suite.
Why a separate backup is the other half of cyber resilience
A security suite reduces the chance of an attack succeeding. It does not give you a clean copy of your data to restore from if one does. The NCSC's ransomware-resistant backups guidance notes that attackers often target backups early in a destructive ransomware attack, and that backups stored on premises or in the cloud are not resistant to ransomware by default.
For Microsoft 365 data, there are two main routes. Microsoft 365 Backup is a pay-as-you-go service that Microsoft lists at 0.15 US dollars per GiB per month of protected content, so the bill tracks the size of your mailboxes and sites. The independent route keeps backups outside your production tenant. Veeam Data Cloud for Microsoft 365 is priced per user per month, billed annually, with unlimited backup storage. Its Foundation plan lists at 3.50 US dollars for 10 to 50 users and 3.15 US dollars for 51 to 250 users. Advanced adds Entra ID data resilience, and Premium adds disaster recovery with no throttling. Veeam says prices may vary by region and are sold in local currencies through Microsoft Marketplace and resellers, so ask for a dated quote in pounds.
If you also back up servers or virtual machines, Veeam Vault is Veeam's managed cloud storage target. Veeam says backups in Vault are immutable by default, encrypted with AES 256-bit keys that only you hold, and that the Foundation edition has a minimum retention of 30 days. Foundation is subject to a fair use policy, under which Veeam may bill read and restore usage above 20% of the subscribed capacity in a year. Price a full recovery, not just the storage.
What independent ratings say about cloud data protection companies
The most cited independent rating for this market is Gartner's Magic Quadrant for Backup and Data Protection Platforms, dated 29 June 2026. The full report sits behind Gartner's paywall, so the placements below come from the vendors' own announcements. Rubrik says it was named a Leader and placed furthest in Vision for the seventh year in a row. Druva says it was named a Leader for the second consecutive year. Veeam's own announcement says it was named a Leader for the 10th time in a row and placed highest in Ability to Execute for the seventh time.
These three suit different estates. Veeam covers Microsoft 365 and, through Vault, servers and virtual machines. Rubrik describes its focus as cyber resilience against sophisticated cyber threats. Druva describes a fully managed SaaS service that keeps backup data and credentials apart from the customer's primary network, so there is no backup infrastructure to run, which suits a firm without its own IT team.
Treat a rating as a starting point, not a verdict. Gartner's standard disclaimer, quoted in Druva's release, says it does not advise technology users to select only the vendors with the highest ratings. A Leader placement reflects a vendor's completeness of vision and ability to execute across the whole market. It does not tell you how fast that vendor will restore your own mailboxes, which is why the next test matters more.
How to test a provider's cyber resilience
The most useful test for a small firm is the NCSC's principles for ransomware-resistant cloud backups, published on 22 November 2024. The NCSC says the principles are for vendors and for system owners, and that customers can use them to review existing backups and form questions for future suppliers. Turn the five principles into five questions for every shortlisted provider.
| NCSC principle | Question to ask the provider |
|---|---|
| Backups resist destructive actions | Can anyone, including our own admin accounts, delete or alter a backup before its retention period ends? |
| Customers cannot be locked out | How do we reach our backups if every corporate account and device is unavailable? |
| Restore from an older version | Is retention set by time rather than by number of copies, and can we restore a version of our choice? |
| Robust key management | Where are the encryption keys held, and is there an out-of-band copy? |
| Alerts on privileged actions | Which alerts fire on mass deletion or retention changes, and can they reach us outside our own systems? |
The NCSC adds that a solution meeting these principles only works in practice if the system owner regularly tests and monitors the health of the backup data. Ask each provider to run a test restore of a real mailbox or folder during the trial, and time it.
Where your backups are stored under UK GDPR
Data location matters, but it is not the whole answer. The ICO's brief guide to international transfers, last updated on 15 January 2026, says the transfer rules apply when you send or make personal information accessible to a separate organisation outside the UK. Every restricted transfer needs UK adequacy regulations, appropriate safeguards or an exception, and the rules apply to sole traders as well as larger firms.
So ask where the backup copies sit, and also where the management console, support staff and logs are. Veeam, for example, lists UK South among the Azure regions for Vault and says data never leaves the region you choose. Get the region written into the contract and ask which support teams can reach the data.
How to choose in four steps
- Fix the prevention layer first. If you run on Microsoft 365, price Business Premium against the components you actually need, and set up the controls rather than just buying the licence.
- Choose a backup route. Decide whether Microsoft 365 Backup inside your tenant is enough, or whether you want an independent copy outside it.
- Test every shortlisted backup against the five NCSC principles, including a timed restore.
- Confirm data location and access in writing, then get dated quotes in pounds for the whole package.
The survey found that 58% of small businesses and 71% of medium businesses sought external information or guidance on cyber security. If you do not have an in-house specialist, an IT partner can run steps one to three for you.
Sources
- DSIT, Cyber security breaches survey 2025/2026, 2026
- Microsoft, Microsoft 365 security pricing for small and medium business, 2026
- Microsoft Learn, Microsoft 365 Backup pricing, 2026
- Veeam, Veeam Data Cloud purchasing options, 2026
- Veeam, Veeam Vault, 2026
- Rubrik, Rubrik is named a Leader in the 2026 Gartner Magic Quadrant, 2026
- Druva, Druva named a Leader in the 2026 Gartner Magic Quadrant for Backup and Data Protection Platforms, 2026
- Veeam, Veeam marks a decade as a Leader in the 2026 Gartner Magic Quadrant, 2026
- NCSC, Ransomware-resistant backups, 2024
- NCSC, Principles for ransomware-resistant cloud backups, 2024
- ICO, A brief guide to international transfers, 2026
