The Other Side of the Mirror: What Confident Cybersecurity Culture Really Looks Like
A finance assistant receives an email from a long-standing supplier. The tone is familiar. The branding is correct. The request is straightforward: bank details have changed, and future payments should be redirected to a new account. Nothing about the email feels dramatic. It does not look like a cyberattack. It
Compliance Isn’t Safeguarding: Is 36 Minutes of Cyber Training Enough for Schools?
Compliance, Confidence and Safeguarding Responsibility Each year, schools across the UK complete the cyber security awareness training produced by the National Cyber Security Centre in support of the Department for Education Cyber Security Standards. The module takes approximately thirty-six minutes to complete and concludes with a downloadable certificate confirming that
Why You Should Invest in Cybersecurity Training for Your Employees
Cybersecurity is no longer just an IT issue or a compliance requirement. It is part of how organisations operate every day. Most cyber incidents do not begin with complex technical breaches. They begin with ordinary moments — an email that looks legitimate, a supplier request that feels routine, a shared
When Cyber Risk Comes From Inside the Classroom
When schools talk about cyber risk, the conversation still tends to focus outward. External attackers. Phishing emails. Criminal groups attempting to gain access from outside the organisation. That framing is familiar, and it remains relevant. But it no longer tells the full story of how cyber incidents are actually unfolding
How to Conduct a Cybersecurity Risk Assessment for Small Businesses
Most small businesses know they should think about cybersecurity risk. What often stops them isn’t a lack of concern, but uncertainty. They’re not sure what a risk assessment is supposed to look like, how formal it needs to be, or whether they’re even the right person to do it. The
Cybersecurity Risk for Small Businesses: What We Get Wrong
Most small businesses don’t think of themselves as a cybersecurity risk. That isn’t denial, and it isn’t ignorance. It’s a perfectly reasonable conclusion based on lived experience. Nothing serious has happened. Systems seem to work. Clients are happy. Work gets done. From the outside, everything looks fine. Cybersecurity, meanwhile, is
From Awareness to Understanding: The Hidden Cost of Falling Behind Modern Cyber Expectations
For a long time, cybersecurity awareness was treated as a reasonable endpoint. If staff had completed the training, clicked through the module, and acknowledged the policy, organisations could confidently say they had done what was required. Awareness was something you could evidence, report on, and move on from. That approach
The Human Limits Cyber Training Rarely Acknowledges
Most cyber training is built on a quiet assumption: that when a security decision matters, people will have the time, focus, and mental space to make a good one. That assumption is rarely questioned, and it underpins everything from awareness sessions and policies to how incidents are later explained. Yet
The UK Government Cyber Action Plan: What It Really Tells Us About Cyber Risk
On 6 January 2026, the UK Government published the Government Cyber Action Plan, setting out how cyber resilience is expected to be strengthened across central government, local authorities, public services, and the suppliers they rely on. At face value, this is a delivery plan. It outlines how responsibility is organised,
