Last year, roads across Birmingham and the Black Country were blocked by flooding. Storm Henk in January, Storm Bert in November, and Storm Darragh in December. Three named storms in a single year, each one knocking out transport links, cutting power, and forcing businesses to improvise. A few miles south in Stirchley, the Environment Agency confirmed that roughly 100 businesses sit within the flood risk zone of the River Bourn alone.
For most of those businesses, the question was whether the plan they had – if one existed at all – would hold up when it mattered.
Why This Matters More Today
A decade ago, a Birmingham SME could absorb a day of disruption without serious consequences. Files lived in cabinets. Phone calls could be rerouted. The damage was real but contained. But that’s no longer the case. Most operations now depend on cloud platforms, CRM systems, email, VoIP, and internet-connected tools that, if they go offline, take the entire workflow with them.
According to a Beaming report covered by IT Pro, UK businesses lost over 50 million hours and £3.7 billion to internet failures in 2023 – a fivefold increase in cost since 2018, driven by growing dependence on cloud applications, e-commerce, and digital communications. SMEs bore the brunt, averaging three to four connectivity failures and 19 hours of downtime each per year.
The UK Government’s Cyber Security Breaches Survey 2025 shared that 43% of UK businesses reported experiencing some form of cyber breach or attack in the previous twelve months. This is equivalent to roughly 612,000 organisations. Also, ransomware incidents doubled year on year, with an estimated 19,000 businesses affected. And phishing remains the dominant entry point, cited by 85% of those who identified a breach.
What Actually Causes Disruption in Birmingham
Cyber incidents grab headlines, but they’re only part of the picture. For SMEs in the West Midlands, disruption tends to come from a few recurring sources.
Power and network outages are more common than most business owners realise. Birmingham’s ageing infrastructure means that localised outages can take out connectivity for hours. When your internet goes down and your entire phone system, file access, and email run through the cloud, the result is an immediate standstill.
Hardware failure is another persistent cause. Servers that haven’t been replaced in five years, switches running without redundancy, or patched-up laptops are the weak points that tend to fail at the worst possible time. The irony is that hardware failure is one of the most preventable causes of downtime, yet it’s often the last thing to get budget allocation.
Then there’s the weather. Birmingham’s geography – its river network, rapid urbanisation, and ageing drainage infrastructure – makes surface water flooding a recurring problem. And with the Environment Agency projecting that one in four English properties could face flood risk by mid-century, this isn’t a problem that’s going away.
What a Genuine Recovery Plan Looks Like
There’s a difference between having a plan and having a document that sits in a shared drive gathering digital dust. A recovery plan that works under pressure has four components.
First, a backup strategy that’s been tested. Not one that exists in theory, but one where someone has confirmed that critical data can be restored, that recovery times are acceptable, and that the backup itself isn’t stored in the same location as the systems it’s supposed to protect. Too many SMEs discover their backup doesn’t work at the exact moment they need it most.
Second, defined recovery time objectives. This means knowing, in advance, how long each system can be offline before the business takes meaningful damage. Emails being down for two hours is irritating. Your ERP system being offline for two days might cost you a client contract.
Third, a communication plan. When things go wrong, the internal confusion is often as damaging as the technical failure. Staff don’t know who to call. Clients don’t get updates. Suppliers aren’t informed. A clear chain of communication – who tells whom, using what channel, within what timeframe – removes the guessing game when everyone’s already under pressure.
Fourth, vendor coordination. If you rely on third-party software, hosting providers, or telecoms companies, your recovery plan needs to account for their response times and escalation paths. You can’t recover faster than your slowest dependency.
How to Tell If Your Current Plan Is Weak
There are a few questions worth asking. When was the last time you tested a full data restore? If the answer is “never” or “I’m not sure,” that’s a problem. Do your staff know what to do if systems go down on a Monday morning? If the answer depends on one person being available, that’s a single point of failure dressed up as a plan. And can you confidently say how long your business could operate without its core IT systems before you’d start losing revenue or clients?
The businesses that struggle most after a disruption are the ones that assumed it wouldn’t happen to them. The Cyber Security Breaches Survey found that only 48% of small businesses had carried out a formal cyber security risk assessment – up from 41% the year before – but still leaving more than half without a clear picture of their own vulnerabilities.
Why Local Matters in Recovery
If Birmingham City’s recent turnaround has shown anything, it is that recovery does not happen by accident. It takes planning, investment, and the right people in place.
When disruption hits, response time is everything. A support partner based locally – one that knows the area, can get on site quickly, and already understands your setup – shortens the gap between “something’s gone wrong” and “we’re back up and running.” Remote support handles most issues well, but some situations demand someone physically present: a failed server that needs replacing, a network switch that’s gone down, or a site that’s lost power and needs its infrastructure brought back online from a temporary location.
Proactive monitoring changes the equation further. Rather than waiting for a failure and then reacting, continuous monitoring catches the warning signs. The goal is to fix the problem before it becomes a disruption. Regular recovery testing, where your IT partner simulates a failure and walks through the restoration process, is the difference between confidence and assumption.
MT Services has supported Birmingham businesses for over five decades, and business continuity sits at the core of what we do, from robust backup and disaster recovery systems to proactive monitoring that catches issues before they escalate. If you’d like to understand where your business might be exposed, we’re currently offering a free external penetration test for West Midlands businesses, a practical first step toward knowing where you stand before you need to find out the hard way.
The businesses that recover fastest are the ones that prepared before they had to.
Frequently Asked Questions
What is external penetration testing?
External penetration testing is a controlled security assessment that evaluates how attackers could access your systems from outside your organisation.
Why is external penetration testing important for Birmingham businesses?
Local businesses rely heavily on internet-facing systems and remote access. Testing helps identify weaknesses before they are exploited and supports due diligence.
How often should penetration testing be carried out?
Many organisations choose annual testing, with additional assessments following major system changes or new service deployments.
Will penetration testing disrupt our business?
Professional testing is carefully scoped to minimise disruption while still providing meaningful insight into security risk.
Is penetration testing suitable for small and medium-sized businesses?
Yes. Smaller organisations are frequently targeted due to limited visibility of risk. Penetration testing helps level the playing field by identifying exposure early.
