Lead Velocity warns firms on cyber risks in marketing tools

Lead Velocity has issued guidance for businesses on cyber risks in digital marketing systems, focusing on the accounts and tools used for advertising, analytics, websites, social media and customer data.

The advice comes amid widespread cyber incidents affecting UK businesses. The government's latest survey found that 43% experienced a cyber breach or attack in the past year. Phishing affected 38% and was the most disruptive attack for 69% of those targeted.

Darren Taylor, Founder and Managing Director of Lead Velocity, said marketers should treat advertising and measurement platforms as part of a company's security perimeter rather than separate commercial tools.

Google Ads accounts are high on that risk list because they directly control media spending and campaign settings. Businesses should enable 2-Step Verification, ensure the business retains ownership of the account, limit user permissions and quickly remove former employees or suppliers.

Taylor said: "Treat your Google Ads account like a financial asset. Make sure 2-Step Verification is enabled, the business retains ownership and access is regularly reviewed. Not everyone needs admin permissions, and removing old users is a simple step that can significantly reduce your exposure. In addition, Google has started pushing for passkeys too, adding a further layer beyond traditional two-step verification."

Data risks

Analytics systems and tag management tools can also create security and commercial problems if access is poorly controlled. Because these platforms shape campaign decisions and conversion reporting, unauthorised changes can lead businesses to act on false data.

Firms should use individual logins, restrict publishing access and review permissions regularly. Conversion tracking should also be checked after major site or tag changes. Google recommends having at least two active Tag Manager administrators so access is not lost.

Taylor said: "Security isn't just about stopping someone stealing data. If your tracking is changed, you can start making decisions based on false information. That can send budget towards the wrong campaigns without anyone realising there is a problem. Some hackers have also changed the targeting, website and keywords of existing campaigns in a hacked Google Ads account to advertise spam using the victim's budget."

Customer journey

Website security is another area highlighted in the guidance, particularly for landing pages and forms at the centre of lead generation. A compromised site can disrupt customer enquiries, expose data and undermine the performance of paid campaigns directing traffic to those pages.

Suggested steps include keeping content management systems, plugins and themes up to date, removing obsolete developer or agency accounts, using two-factor authentication where available, and reviewing third-party scripts and integrations.

Taylor said: "Your website is where your marketing promise becomes a customer experience. If a landing page or form is compromised, you can have a security problem, a conversion problem and a reputation problem at the same time."

Social access

Social media accounts and paid social systems present a related risk because they often connect personal logins, brand accounts and advertising tools. Businesses were urged to use 2FA, avoid shared credentials, tightly manage admin rights and remove access as soon as staff or contractors leave.

The government survey found that 12% of businesses experienced impersonation, while 2% reported website, social media or email takeovers or attempted takeovers. Phishing messages seeking login or payment details remain a particular concern for teams managing these channels.

Taylor said: "Social media shouldn't be treated as low-risk. A compromised personal login can become a route into advertising accounts or the company's wider digital presence. Security needs to extend to everyone who has access, not just the business account itself. Social media networks may also be unhelpful when recovering compromised accounts, adding further frustration."

Connected tools

The guidance also points to customer relationship management systems, email platforms, third-party integrations and AI tools as areas where access control matters. Businesses were advised to audit connected apps, remove unnecessary integrations and understand what information each service can access and what actions it can take.

That is especially relevant for AI tools, where staff may share customer or commercial information without a clear view of how the data is used or retained. The broader warning is that modern marketing operations depend on an interconnected set of services, each of which can become a weak point.

Taylor said: "Think about your marketing stack as an ecosystem. Every integration is another connection, so ask what data a tool can access, why it needs it and who controls that access. With AI tools, businesses should be particularly clear about what information they're sharing and what the tool can actually do."

The central issue, Lead Velocity said, is basic control over who has access to marketing systems, what they can change and what information they can see.

Taylor said: "Businesses should know who has access to their marketing systems, what they can change and what data they can see. Security isn't about making every system difficult to use. It's about making sure the right people have the right access, and removing that access when they no longer need it."