A supplier email lands while someone is closing off invoices. A login prompt appears while a manager is moving between systems. A charity administrator receives a document request that appears to relate to a real funding conversation. A team member working from home needs access to a shared file before a meeting starts. None of […]
The Reality of Workplace Decisions There’s an assumption built into most cybersecurity training. That when an employee is faced with something suspicious, they will recognise the moment, pause what they are doing, and apply what they have been taught. That they will step out of the flow of work, assess the situation, and make a […]
A finance assistant receives an email from a long-standing supplier. The tone is familiar. The branding is correct. The request is straightforward: bank details have changed, and future payments should be redirected to a new account. Nothing about the email feels dramatic. It does not look like a cyberattack. It looks like admin. In that […]
Most small businesses don’t think of themselves as a cybersecurity risk. That isn’t denial, and it isn’t ignorance. It’s a perfectly reasonable conclusion based on lived experience. Nothing serious has happened. Systems seem to work. Clients are happy. Work gets done. From the outside, everything looks fine. Cybersecurity, meanwhile, is largely invisible when it’s working. […]
For a long time, cybersecurity awareness was treated as a reasonable endpoint. If staff had completed the training, clicked through the module, and acknowledged the policy, organisations could confidently say they had done what was required. Awareness was something you could evidence, report on, and move on from. That approach made sense in a world […]
Cyber insurance is often spoken about in the same way as firewalls, backups, and incident response plans. Something sensible organisations are expected to have. Something that reassures boards, clients, and insurers alike. And yet, when incidents actually happen, many businesses discover that their understanding of cyber insurance was built on assumptions rather than reality. Claims […]
If you sit in enough meetings about risk, compliance, or “cyber”, you start to notice something interesting. The language changes, but the assumptions rarely do. Cybersecurity and information security are used as if they’re interchangeable. Different words, same meaning. Same budget line. Same responsibility. Most of the time, no one challenges that assumption. It feels […]
