Business risks of denial-of-service attacks explained

A denial-of-service attack is a deliberate attempt to make an online service unavailable. For a small or medium-sized business, that can mean a website that will not load, an online booking system that stops taking orders, a customer portal that times out, or internal systems that become painfully slow. The immediate problem is not just technical. It is lost revenue, missed opportunities, frustrated customers, and pressure on staff who are trying to keep the business running.

For UK SMEs, the risk is often less about a dramatic headline and more about ordinary business disruption. If your sales, support, or operations rely on internet-facing systems, even a short outage can affect cash flow and customer confidence. In some cases, the cost comes from the attack itself. In others, it comes from the time spent recovering, explaining the issue, and dealing with the knock-on effects.

What a denial-of-service attack is

In plain English, a denial-of-service attack is when someone overwhelms a service so that genuine users cannot get through. The target is usually a website, application, or online service, but the same idea can apply to other internet-connected systems. The attacker does not need to break in. They simply try to make the service too busy, too slow, or too unstable to handle normal use.

A distributed denial-of-service attack is the same idea, but the traffic comes from many different devices at once rather than one source. That makes it harder to block because the unwanted traffic is spread across many locations. The business impact is similar either way: customers and staff cannot use the service properly.

If you want a broader view of how resilience should be built into systems from the start, our article on secure-by-design principles is a useful companion read.

What happens during an attack

During an attack, the first signs are often practical rather than technical. A website may load slowly, pages may fail part way through, or users may see error messages. Staff may report that logins are timing out, orders are not going through, or the phone lines are receiving complaints from customers who cannot access online services.

Sometimes the service is not completely down, but it becomes unreliable enough to cause business damage. That matters because customers rarely distinguish between a total outage and a service that is so slow it is unusable. From their point of view, the business is unavailable.

Legitimate traffic can be blocked or slowed because the system has limited capacity. Think of it like a shop with a small doorway. If too many people crowd the entrance, genuine customers struggle to get in, even if they are behaving normally. The same happens online when servers, network links, or application components are pushed beyond what they can comfortably handle.

Why SMEs are targeted

SMEs are often targeted because disruption can be effective even when the business is not especially large. Smaller organisations may have fewer technical controls, less monitoring, and less spare capacity to absorb a surge in traffic. That can make them easier to disrupt and slower to recover.

There is also a business motive. Attackers may use disruption to create pressure, distract staff, or damage confidence. In some cases, the goal is simply to cause inconvenience. In others, it is to force a response, test defences, or create leverage.

Visibility can also make a business attractive. If your website is the main route for sales, bookings, support, or customer communications, an outage is immediately noticeable. The more dependent the business is on a small number of online services, the greater the impact when one of them fails.

The business impact for UK SMEs

The most obvious cost is lost sales. If customers cannot place orders, request quotes, make bookings, or pay invoices, revenue stops flowing. Even a short interruption can affect daily trading, especially for businesses that rely on online transactions or time-sensitive enquiries.

There is also the cost of missed opportunities. A customer who cannot reach you may not try again. A partner who cannot access a portal may move work elsewhere. A sales lead who encounters repeated errors may decide to contact a competitor instead.

Reputation damage can be just as important. Customers tend to remember poor availability, especially if they are under pressure themselves. If your service is unavailable at a critical moment, the issue can undermine trust even when the underlying cause is temporary.

Operational strain is another hidden cost. Staff may have to answer calls, send updates, manage complaints, and work around unavailable systems. That takes time away from normal work and can quickly affect productivity across the business.

For organisations that depend heavily on digital channels, it is worth thinking about denial-of-service risk alongside wider resilience planning. Our guide to systems that are resilient to both attack and failure explains why availability should be treated as a core design concern, not an afterthought.

Common weak points that increase risk

Some businesses are more exposed because of single points of failure. If your website, payment system, or customer portal depends on one hosting provider, one internet link, or one application server, then a problem in that component can take the whole service down. Even if the issue starts as an attack, the real weakness is the lack of backup capacity or alternative routes.

Limited capacity is another common issue. Systems that work well under normal use may struggle when traffic rises suddenly. That can happen during a genuine spike in customer interest, but it can also happen during an attack. If the service has no headroom, it may fail quickly.

Poor monitoring makes the situation worse. If no one is watching for unusual traffic, slow response times, or repeated errors, the business may not notice the problem until customers start complaining. By then, the outage may already be affecting sales and reputation.

Supplier resilience matters too. If your website relies on a third party for hosting, content delivery, or security filtering, you need to know how that supplier handles disruption. A weak supplier can become your weak point. Our article on third-party cyber risk assessments is a good starting point for checking that dependency.

How to reduce the risk

The aim is not to make your business invulnerable. That is unrealistic. The aim is to make disruption less likely, less severe, and easier to recover from.

Start with the services that matter most to revenue and operations. Identify which systems must stay available for the business to function. Then ask what would happen if each one became slow or unavailable for an hour, a day, or longer. That simple exercise often reveals where the biggest business risk sits.

Practical resilience measures include:

• Using a content delivery network to absorb traffic and spread load across multiple locations.
• Setting sensible rate limits so one source cannot overwhelm a service with repeated requests.
• Separating critical services so one problem does not take everything down at once.
• Making sure hosting and internet arrangements have a fallback option where possible.
• Testing how the service behaves when traffic rises sharply, before a real incident forces the issue.

Rate limiting is a simple control that restricts how many requests a system will accept in a given period. It will not stop every attack, but it can reduce the chance that one source overwhelms the service. A content delivery network helps by placing copies of content closer to users and spreading demand, which can improve both performance and resilience.

It is also worth planning for failover, which means switching to an alternative service or route if the main one is unavailable. For some SMEs, that may be a second internet connection, a backup hosting arrangement, or a simpler fallback version of the website. The right answer depends on the business, but the principle is the same: do not rely on one path if the business cannot tolerate its failure.

If you are reviewing the technical side of resilience, our article on testing systems for high load and denial-of-service conditions explains why controlled testing is valuable before an incident exposes a weakness.

How to prepare before an attack

Preparation should be simple enough that people will actually use it. A long document that nobody reads will not help when customers are calling and systems are failing.

A practical readiness checklist for leaders and operational teams should include:

• Knowing which services are most important to the business.
• Identifying who owns each service and who can make decisions during an outage.
• Keeping supplier contact details up to date, including hosting, internet, and support providers.
• Agreeing how customers will be informed if a service is unavailable.
• Deciding what can be switched off, slowed down, or redirected if the service is under pressure.
• Making sure backups, recovery steps, and escalation routes are documented and easy to find.

It helps to assign roles in advance. Someone should be responsible for technical investigation, someone for customer communication, and someone for business decisions such as whether to move to a fallback service or pause a campaign that is adding load. In a small business, one person may hold more than one role, but the responsibilities should still be clear.

Supplier escalation is especially important. If your hosting provider or internet provider is part of the response, you need to know how to contact them quickly and what information they will ask for. Delays at this stage can extend the outage unnecessarily.

What to do if your service is under attack

If you suspect a denial-of-service attack, the first priority is to protect the business from avoidable harm. That means staying calm, confirming what is affected, and focusing on service restoration rather than trying to solve everything at once.

Immediate actions usually include:

• Checking whether the issue is affecting one service or several.
• Notifying the people who own the service and can make decisions.
• Contacting your hosting provider, internet provider, or managed service provider.
• Turning on any available traffic filtering or protective settings.
• Updating customers with a clear, honest message if the outage is visible externally.
• Recording what happened, when it started, and what was done.

Do not spend valuable time guessing. If you have a provider that can help filter traffic or move the service to a safer route, involve them early. If you have an incident response partner, bring them in when the issue is affecting business operations or when the cause is not clear.

Communication matters. Customers do not need a technical explanation. They need to know that you are aware of the issue, that you are working on it, and when they can expect the next update. Even a short, factual message can reduce frustration and protect trust.

How this fits into wider security architecture

Denial-of-service resilience is not a separate problem. It sits alongside other security and continuity concerns such as monitoring, recovery, supplier management, and service design. A business that only thinks about prevention may still struggle when a service is overwhelmed or a supplier has an outage.

That is why security architecture matters. Good architecture looks at how systems fail, how they recover, and how the business keeps operating when something goes wrong. It also considers whether the organisation can see what is happening in time to act. Without visibility, even a well-designed service can be difficult to manage under pressure.

For SMEs, the most useful approach is usually pragmatic. Focus on the services that matter most, remove obvious single points of failure, and make sure the business can continue in a reduced but workable form if the main service is unavailable. That may mean a fallback website, a manual order process, or a temporary customer communication route.

Security architecture should support business continuity, not compete with it. If a control makes the service harder to run or harder to recover, it needs to be reviewed. The goal is resilience that fits the size and shape of the business.

For a broader view of how architecture decisions affect day-to-day operations, our article on secure system design for maintainability and observability is a useful next step.

Bringing it together

For UK SMEs, the business risk of a denial-of-service attack is straightforward: lost availability leads to lost revenue, damaged trust, and avoidable operational disruption. The best response is not panic. It is preparation.

Know which services matter most. Reduce single points of failure. Put sensible limits and fallback options in place. Make sure you can see problems early and escalate them quickly. Most importantly, decide in advance how the business will respond if a service becomes unavailable.

If you would like help reviewing where your business is most exposed, or you want practical support with resilience planning and security architecture, speak to a consultant.

Frequently asked questions

Can you explain what a DDoS attack is?

A distributed denial-of-service attack is when a service is flooded with traffic from many sources at once so that genuine users cannot get through. The aim is to make the service slow or unavailable rather than to break into it.

What happens during a denial-of-service attack?

The service may become slow, unstable, or completely unavailable. Customers may see errors, staff may be unable to log in, and the business may lose sales or support requests until the problem is contained.

Why would a small business be targeted?

Smaller businesses can be easier to disrupt because they often have less spare capacity, fewer protective controls, and less monitoring. If the business depends heavily on online services, the impact can be immediate and visible.

What should we do first if our website is under attack?

Confirm what is affected, alert the people who own the service, contact your hosting or internet provider, and use any available protective settings. Then communicate clearly with customers and keep a record of what happened.