Month: July 2025

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Risk Analysis and Security Strategy Security Tools

A Guide to Cyber Security for SMEs

There’s a continual stream of blogs and posts about cyber security and the sometimes catastrophic effects of getting it wrong, but there is very little that tells SMEs what they should be doing, and it’s generally left to local IT management companies and VARs (Value Added Resellers – i.e. those who sell various products and add value by configuring and managing them).  I’m not knocking those companies; they have a very valid business model.  But what they aren’t are cyber security professionals and generally their security expertise is focused on the products that they sell.  For instance, they will have good skills in installing and configuring security products such as anti-virus and firewalls but there is generally no knowledge of cyber risk management and assessment, thereby ensuring that you have the right defences in the right place, providing the best value for your limited spend, and ignoring the non-technical solutions that are often a better bet than a piece of technology.

SMEs generally have very little budget to allocate to this and that means that what budget they have needs to be effectively targeted at what is important.  They need to be aiming for a situation whereby when a potential attacker targets them, they appear to be a more difficult nut to crack than other organisations in their space and their size.  Attackers want things to be easy, not difficult, and they will often move on if things get difficult.  A criminal is in the game of getting easy money.

Let’s take a look at what cyber security is all about, and more importantly, why you need it?  Let’s tackle the first question – what is cyber security?  One definition is as follows:

Cybersecurity is the practice of protecting computer systems, networks, software, and data from digital attacks, unauthorised access, damage, or theft. It involves a range of technologies, processes, and practices designed to:

  • Prevent cyberattacks
  • Detect breaches or suspicious activity
  • Respond to security incidents
  • Recover from damage or loss caused by attacks

The problem is of course that each bullet point there covers a multitude of issues that need to be addressed.  The question is understanding what those issues are, how they affect you and what is the priority i.e. what are the most important things that you need to protect, and what comes next, all managed within whatever budget you can allocate to it.  It’s not easy and you might feel that you don’t need to do everything but that you need to cover off the most important issues.  That means of course that you need to know what those issues are.

The first thing you need to do is to identify your cyber assets.  Assets are not confined to hardware and software, far from it.  A cybersecurity asset is anything of value that requires protection in a digital context. Identifying and classifying these assets is a foundational step in building a strong cybersecurity posture.  Assets will change from company to company, depending upon how you’re organised and what business you are in, but generally:

Hardware Assets

  • Servers, routers, laptops, mobile devices, firewalls
  • Why it matters: Physical devices are entry points for attackers and must be secured.

Software Assets

  • Operating systems, applications, databases etc
  • Why it matters: Vulnerabilities in software can be exploited to gain unauthorised access.

Data Assets

  • Customer records, financial data, intellectual property, source code
  • Why it matters: Data breaches can lead to regulatory fines, reputational damage, and financial loss.

Network Assets

  • VPNs, switches, IP addresses, subnets
  • Why it matters: Networks facilitate communication and, if not protected, can be avenues for lateral movement by attackers.

People Assets

  • Employees, contractors, system administrators
  • Why it matters: Human error is a leading cause of breaches, so training and access control are crucial.

Cloud and Virtual Assets

  • Virtual machines, containers, cloud storage (e.g., AWS S3, Azure Blob Storage)
  • Why it matters: Cloud environments introduce new attack surfaces that must be monitored and managed.

An example could be a customer database, maybe on the cloud or via an app, or even an onsite server.  You class this as high value because it contains personally identifiable information (PII) and of course all your interactions with those customers and the value they have to you.  Lose that and you might be out of business.  You decide to encrypt it and use multi factor authentication and have daily backups, not kept online.

Identifying the assets is the first step in defining what protections you need.  You then have to categorise those assets and decide how important they are to the business before you can decide what levels of protection they need.

Having categorised your assets, you then need to assign a risk score to them.  Now, this can be done formally via a formal risk assessment, but I accept that many SMEs can’t afford to have that done, and, given the size of the company and the amount/types of information held, it might be relatively easy, when compared to a corporate body, to assign a risk score to each asset.

The next step then is to apply a risk score to the assets in accordance with how you have assessed them, this in turn informs you of the importance of each asset and how you will need to protect them.  In other words, you are now targeting your spend to where you know it will be most effective.

We then need to identify the vulnerabilities and the threats and that is where most organisations require help.

Here at H2 we use our considerable experience in doing this for corporate level organisations, and translating that into doable chunks for SMEs, carving up what is needed into priorities and working with clients to decide what those priorities are.  We do this keeping in mind the principle of People, Process and then Technology, keeping in mind that many protections, or controls as we term them, are actually not technical but are procedural, based on sound policy and process, and therefore costing very little.

We take a phased approach:

The first phase works with the client to decide where they are now, on a scale which we take from the Carnegie Melon cyber maturity model.  Most SMEs come out at around 1 to 2 on the scale and aim to get to 3 to 3.5.  The scale goes up to 5 but, as you can see from the phased approach above, this tends to be not necessary for an SME and is often too expensive anyway.

Once we know our starting point, we identify quick wins to tighten up security.  As a rule, that will include things like cyber awareness training for staff, ensuring that all access is controlled using MFA of some sort and making sure that Admin rights are strictly controlled.  Depending on the company and what it does, it might mean instituting some form of identity management.

As part of the Quick win phase, we also look at policies and processes.  Is there a process for allocating and removing rights?  Is there a policy and process about on and off boarding staff etc.  Other policies we might need to look at include:

  • Top-level policy issued by the board
  • Starters and Leavers Policy
  • Access Control Policy
  • Magnetic Media Policy
  • Mobile Working Policy
  • Password Policy
  • Email Policy
  • Acceptable Use Policy
  • Data Protection

That done we move on to Phase 2 which is where we might recommend encryption both at rest and in transit, for critical data assets.  We will discuss back up procedures and processes which will ensure that backups are securely stored and that restoring from backups is practiced and works.  We will discuss incident handling procedures and business continuity planning.  Finally, we will discuss monitoring and audit, two things that until quite recently tended to be out of the price range of SMEs.  However, there are now systems and services on the market which are affordable.

This all seems a bit daunting, but if taken in chunks and phased over perhaps several budgetary periods it is doable, and you really need to consider it.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy

Ransomware – The Threat That Keeps On Giving


I know I’ve banged on about this quite a bit recently, but I make no apologies for it.  It has sprung to the front again following the Panorama programme on Monday night which highlighted the often catastrophic effects of ransomware on companies, and had interviews with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA), with an NCA rep saying that 2025 is shaping up to be the worst year ever for ransomware and the CEO of NSCS calling on businesses to face up to the issue and sort out their cyber defences.

The programme highlighted that Ransomware as a Service (RaaS) now enables less skilled attackers to run ransomware, complete with support and updates. Over 70% of attacks now use these services.
 
Attackers have shifted to double/triple extortion schemes, encrypting data, threatening to leak it, and sometimes targeting associated partners or customers. Next-gen ransomware, e.g. LockBit 4.0, BianLian etc, is rolling out advanced stealth, data theft, and automated lateral movement techniques, using an initial breach to jump across to other parts of your network or that of your partners and customers.
 
You’ll have to forgive me for being a bit smug as the programme highlighted issues that I’ve been talking about for a long time now.  Firstly, it’s not just the corporates that are targets for this.  SMEs are also very much in the firing line.  The programme highlighted an example I’ve quoted before.  Knight of Old (part of the KNP Logistics Group) suffered consequences that they just couldn’t recover from.

In June 2023, the Akira ransomware gang infiltrated the company via stolen credentials and encrypted critical systems, including freight-tracking, payments, and internal servers, displaying this chilling message:
 
“If you’re reading this, it means the internal infrastructure of your company is fully or partially dead.” 
 
The group also threatened to release over 10,000 confidential documents (payroll, invoices, financial files) as a form of double extortion. Despite having cyber insurance and backups, they couldn’t fully restore financial systems, and some backups were also destroyed.  Insurers covered only the initial cleanup (~£250k) and $1M policy, but this fell far short of covering the estimated $2.7–$5.3 million ransom or the broader economic damage.  Operational disruption prevented them from producing reports and financial statements, essential for securing bank funding. A sale fell through, as buyers wanted director guarantees they couldn’t offer.
 
The company entered administration in September 2023 and ceased operations.  Around 730 out of 900 employees lost their jobs, including many long-serving drivers and staff who were owed unpaid wages.  Local impact was severe: furloughed staff lost homes, cars, and some experienced severe personal hardship.
 
It appears that the attack was perpetrated via a weak password and the absence of multi-factor authentication (MFA), with the gang using a brute force method to crack the password.  It underscores the fact that even companies with cyber insurance and accredited systems are vulnerable.
 
Obviously, we’re not party to the full facts but the company’s directors have been quite candid in interview, and we have to wonder if something as simple as good cyber awareness training and the introduction of MFA could have stopped this attack in its tracks.  There are other factors to consider though.  The backups seemed to have failed, with some of them being destroyed by the attack, suggesting that these backups were on the same network as the main system.
 
Clearly what is needed is defence in depth, based on the tried and tested method of risk management.  The idea of defence in depth stems from military defences, where there are multiple layers to a defensive system.  In cyber security we talk about People, Process and then Technology.  I’ll once again trot out the quote from Bruce Schneier, ‘If you think technology will solve your cyber security problem, you don’t understand the problem and you don’t understand the technology’.  This aligns very well with the opinion of both NCSC and NCA that the majority of these attacks are more in line with scams than with technical hacking.
 
Rather than bore you with the components of risk management in cyber, I’ll just point you towards a short video we produced on the subject.
 
Risk Management – a short video
 
We produced another video which highlights social engineering.  That is the method by which much of these attacks are undertaken which are not particularly technical in nature.  It’s the People part of the risk management process and is arguably the quickest and cheapest win any company can take.  It’s a continual source of wonder amongst cyber security professionals that a large focus remains on technology whilst ignoring this vital element.  Our short video tries to hit the highlights but in this changing landscape, we haven’t hit them all.
 
Social Engineering – A Short Video
 
The takeaway from this should be that no one is safe or immune from a ransomware attack, particularly ransomware as a service.  This latter means that the attacker doesn’t need to be technically proficient, just determined.  It enables attackers to target multiple companies at once.  If they, for instance, attack 1000 companies at the same time, using the same service, and ask for moderate amounts of ransom, they only need to hit around a 40-50% success rate to make a decent profit.  Add in AI which makes this so much easier to do, and you’ve got an idea of how much of a business this is for criminal and nation state sponsored gangs.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools Supply Chain Security Working Practices

Do CISOs have a role in the Small to Medium Enterprise?

A Chief Information Security Officer or CISO, is a post you almost never find in an SME, even those at the top end of that sector.   This has contributed to the growth of what is known as fractional appointments i.e. appointments that are not full time with the incumbents often taking roles in more than one organisation, thus the term Fractional.

 Anyone taking any role in an SME management team will need to be pragmatic, practical and bring cost effectiveness to their discipline.  The CISO role is no different and is all about managing risk, enabling the business and ensuring trust in a very cost sensitive environment.

The CISO can play a crucial role in an SME by ensuring that the organisation’s information and data assets are secure. While the CISO role in a large corporation may be more siloed or focused on strategy, in an SME the CISO often wears multiple hats, balancing strategy, operations, and hands-on technical work.

Challenges Unique to SMEs

I’ve often talked about the challenges that SMEs face, focusing as I do on cyber security.  Let’s just have a quick recap looking at where the CISO fits in with these unique challenges.

  • Limited budget and staff: This is the main reason why SMEs will not employ a full time CISO, they simply can’t afford it.  The other being that an SME probably doesn’t require a full-time resource anyway.  Because of this lack of resource the CISO may also act as a hands-on security engineer or IT lead, perhaps liaising with a contracted IT outsourcer.
  • Lack of security culture: Many SMEs don’t prioritise security until after a breach.  The CISO will be able to raise awareness and provide advice and guidance before the fact.
  • Rapid growth and change: Scaling securely is a key challenge as SMEs expand and there are often gaps left because of overlooking the need to embed security at the design stage.  The CISO can plug that gap.

Let’s take a look at the potential elements of a job description for the role of a CISO, or a Fractional CISO, in an SME.  Of course, these may not fit everyone and it’s more of a menu for SMEs to choose from:

  1. Developing and Leading the Cybersecurity Strategy
  2. Define the overall information security roadmap aligned with the SME’s business goals.
  3. Balance security with business agility, in other words making sure security does not get in the way of business and keeping in mind budget constraints typical in SMEs.
  4. Ensure the strategy addresses risk management, compliance, and data protection.
  • Risk Management and Assessment
  • Identify and assess cyber risks relevant to the SME (e.g., phishing, ransomware, insider threats).
  • Conduct regular vulnerability assessments and penetration tests.
  • Prioritise risks based on business impact and likelihood.
  • Policy and Compliance Management
  • Develop and enforce security policies, standards, and procedures.
  • Ensure compliance with relevant regulations (e.g., GDPR, PCI-DSS etc depending on industry).
  • Prepare for audits and provide documentation to demonstrate compliance.
  • Security Awareness and Training
  • Conduct regular security awareness training for employees.
  • Create a culture of security by promoting best practices (e.g., strong passwords, phishing awareness).
  • Incident Response and Business Continuity
  • Develop and maintain an incident response plan.
  • Lead the response to security breaches and minimise damage.
  • Ensure business continuity and disaster recovery plans are in place and tested.
  • Technology Oversight and Vendor Management
  • Evaluate and implement cybersecurity tools (e.g., firewalls, endpoint protection etc).
  • Manage relationships with third-party vendors, especially cloud providers and MSSPs.
  • Ensure that vendors comply with the SME’s security requirements.
  • Ensure the SME itself is not in conflict with any security requirements of larger organisations if it is in that organisations supply chain.
  • Board and Executive Communication
  • Translate technical risks into business language for senior management.
  • Report regularly on security posture, incidents, and needs.
  • Advocate for security budget and resources in line with organisational risk appetite.

I hope that gives a feel as to why an SME might want to consider a Fractional CISO or Board Advisor.  Cyber-attacks are becoming more sophisticated, faster and harder to repel.  It is no longer just the corporates who are in the firing line.  Modern, often AI driven attacks have put everyone in the sights of the modern cyber-criminal and even from those criminal organisations that are nation state funded.  It’s never been more crucial to have professional advice and guidance on tap.

Cyber Awareness Training General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy

How Should SMEs View Cyber Security?

We experience a quite varied attitude amongst SMEs to cyber security.  There is still a prevalent view that they are not really a target because they’re not worth it, and we’ve commented again and again that this is simply not so.  SMEs are considered low hanging fruit amongst cyber criminals simply because they tend to have weaker defences and don’t have easy access to the right levels of advice and guidance.

Good cyber defences can be seen in a similar light to insurance.  Whilst you hope that you’ll never need it, you understand that it’s safer to have it and in turn, the insurance company will require you to meet certain requirements for your policy to remain extant.

100% protection against an attack is simply not possible and no responsible cyber security company will guarantee that.  But we do try and empower businesses by forging intelligent defences to protect them in an ever-evolving threat landscape, being made more dangerous as criminals adopt AI in greater numbers.

SMEs face many of the same cybersecurity threats as large organisations, but they are often more vulnerable due to limited resources, staff, and awareness. So far it’s being reported that the biggest cybersecurity threats to SMEs in 2025 include:

  1. Phishing & Social Engineering
  • What it is: Deceptive emails, texts, or calls that trick employees into revealing credentials or installing malware.
  • Why it matters for SMEs: They often have no formal training or tools to detect phishing. A single click can lead to a major breach.
  • Ransomware Attacks
  • What it is: Malware that encrypts data and demands a ransom for decryption.
  • Why SMEs are targets: They’re seen as “soft” targets, less likely to have backups or strong defences, more likely to pay.
  • Business Email Compromise (BEC)
  • What it is: Fraudsters impersonate executives or vendors to trick employees into sending money or sensitive data.  Traditionally done by email spoofing, now increasingly being done by AI impersonation.
  • Why it’s dangerous: BEC is low-tech but high impact, no malware, just manipulation. Losses can be substantial.
  • Poor Password Hygiene
  • Common issues: Weak, reused, or shared passwords; lack of multi-factor authentication (MFA).
  • Impact: Credential stuffing and brute-force attacks are easy ways into SME systems.
  • Unpatched Software & Systems
  • What it is: Outdated software with known vulnerabilities.
  • Why it happens: SMEs often delay updates due to compatibility fears or lack of IT resources.
  • Real threat: Attackers automate the search for these flaws.
  • Supply Chain Attacks
  • What it is: Attackers target less secure vendors or partners to infiltrate your network.
  • Relevance: SMEs often rely on third-party services (e.g. MSPs, cloud tools), but don’t vet their security rigorously.  Check their Ts&Cs, what are they responsible for and what are you responsible for?  This is becoming a big issue amongst those with critical supply chains of which SMEs may be a part.
  • Insider Threats (Malicious or Accidental)
  • Malicious: Disgruntled employees stealing or sabotaging data.
  • Accidental: Well-meaning staff misconfiguring systems or clicking unsafe links.
  • Problem: SMEs rarely have monitoring tools in place to catch insider issues early.
  • Insecure Remote Work Infrastructure
  • Examples: Unsecured Wi-Fi, lack of VPNs, personal device use (BYOD).
  • Why it’s risky: Many SMEs embraced remote/hybrid work without upgrading their security posture.
  1. Lack of Cybersecurity Training
  • Result: Employees don’t recognise threats or understand basic security practices.
  • Impact: Human error is still a major cause of breaches.  Cyber Awareness Training is arguably the biggest and cheapest quick win an employer can take.
  • Cloud Misconfigurations
  • Common mistake: Leaving cloud storage exposed to the internet.
  • Why it happens: SMEs may lack specialised cloud knowledge or rely on default settings.  Check with your supplier.
  • Bonus: AI-Powered Attacks
  • Emerging trend: Attackers use generative AI to craft more convincing phishing emails, deepfakes, and automated reconnaissance. Check out our earlier blog on this subject (An increase in sophistication of cyber-attacks).
  • Why SMEs should care: These tools lower the barrier for attackers and increase the success rate of scams.

What practical advice would we have for SMEs?  Obviously, that depends on the SME, their vertical, how they operate etc.  But generally:

  1. Enable MFA everywhere.
  2. Train staff regularly.
  3. Keep software up to date.
  4. Back up data (and test recovery).
  5. Use endpoint protection.
  6. Identify where all your sensitive data resides.
  7. Investigate protective monitoring services.
  8. Investigate Cyber Security Insurance.
  9. Hire or consult a cybersecurity professional, even part-time.

Data Breaches and their consequences General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Supply Chain Security

An Increase in sophistication in cyber-attacks in 2025

There is a lot of discussion about AI, it’s benefits to society in general and its undoubted downside.  It’s a fascinating subject and AI can really become the gift that keeps on giving, but a downside for those of us concerned with cyber security, and really that should be all of us, is that we’ve always played catch up to the cyber criminals, trying and often failing to anticipate what the next attack will be, what the next series of attacks will be.  Will it be ransomware, denial of service or perhaps a new and more sophisticated scam?  Who knows?  And there is no doubt that AI is raising the bar.

I have talked a lot about the re-emergence of the script kiddie and how AI in enabling this breed of wannabe criminals.  For those who maybe don’t now, a script kiddie was a low level, part skilled hacker, who downloaded scripts from the dark web, put there by the more competent hacker who hoped to sell them.  The script kiddie would use those scripts to try and attack targets.  But it’s also true that the more skilled and sophisticated criminal is making use of AI and finding new and innovative ways of relieving you of your hard-earned cash.

What we are seeing in 2025 is an era where cyber‑attacks are AI‑powered, highly targeted, automated, supply‑chain enabled, multi‑stage, and geopolitically driven. These attacks exploit weaknesses across credential systems, zero‑day exploits, deepfake tools, and ransomware as a service (RaaS) platforms.

We are in an accelerating digital arms race that calls for AI‑driven defence capabilities, real‑time insights, deception environments, zero‑trust architectures, and quantum‑safe cryptography.

a. AI-powered precision and scale

  • Cybercriminals are leveraging AI to automate vulnerability scans at astonishing speeds, up to 36,000 scans per second, resulting in massive volumes of stolen credentials (1.7 billion) and drastic upticks in targeted attacks.
  • AI is also generating hyper-realistic phishing messages, deepfake audio/video, and even “CEO fraud” to manipulate individuals into transferring funds, like a deepfake trick that siphoned US $25 M in Hong Kong.

b. Ransomware as a Service (RaaS) 3.0

  • RaaS platforms now enable less skilled attackers to run ransomware, complete with support and updates. Over 70% of attacks now use these services.
  • Attackers have shifted to double/triple extortion schemes, encrypting data, threatening to leak it, and sometimes targeting associated partners or customers.
  • Next-gen ransomware, e.g. LockBit 4.0, BianLian etc, is rolling out advanced stealth, data theft, and automated lateral movement techniques, ie using an initial breach to jump across to other parts of your network or that of your partners and customers.

c. Supply‑chain & third‑party infiltration

  • Attacks starting via third-party software or vendors (e.g., SolarWinds-style) allow hackers to move laterally into networks and compromise multiple organisations simultaneously.

d. State‑sponsored & geopolitical cyber warfare

  • Nation-states (China, Russia, Iran, North Korea) are not just using espionage but now partnering with ransomware gangs to conduct financially and politically motivated operations.
  • Iranian state-aligned hackers are conducting sophisticated credential theft, MFA bypass, lateral infiltration, DDoS, website defacements, and disinformation across geographies.

e.  Zero‑days and living‑off‑the‑land

  • Exploit kits now rapidly find zero-day vulnerabilities, especially in cloud environments, to bypass patching cycles.
  • Attackers increasingly use built-in legitimate software and system tools (living off the land) to evade detection.

f.  Credential theft resurgence

  • Reported credential theft incidents rose 300% from 2023 to 2024, with 25% of malware focused on stealing login data.
  • These stolen credentials are a gateway for automated brute‑force, lateral movements, and supply‑chain infiltration.

g.  Targeting of IoT, OT & mobile platforms

  • Millions of IoT and OT systems (from manufacturing to agriculture) remain insecure and are now common targets of AI‑driven automated attacks.
  • Mobile‑specific ransomware is emerging; threat actors are developing malware to extort victims directly via their mobile devices.

h.  Rise of deception technology and defence adaptability

  • In response, organisations are deploying deception tech (honeypots, decoys) to detect lateral intrusions or zero-day exploits in real time.
  • Proactive threat intelligence, zero‑trust frameworks, AI‑driven detection, and adoption of post‑quantum cryptography are becoming critical defensive measures.

SMEs still have the mind-set that these attacks are just about the corporate sector and that they are safe because they are small and not worth targeting.  Wrong.  SMEs are considered low hanging fruit because they typically spend much less on their defences and tend not to have access to the right levels of support and advice.  SMEs make up over 90% of the UK GDP, that’s huge and it makes them worth attacking if, for example, a nation state wanted to cripple the UK economy.  AI automation makes this much easier to achieve and attackers at all levels can leverage AI to automate attacks against multiple SMEs at the same time using the same methods.  If they attack 1000 SMEs at once, and get a 50% hit rate, that is good business for them.

We are seeing AI letting attackers scan thousands of targets at once, deploy malware bots and use brute force tools.  They are automating phishing and social engineering allowing them to deepfake audio and video, using cloned voices to mimic senior personnel in companies.  Don’t be lulled into a false sense of security, AI makes this a relatively easy thing to do, doesn’t take high levels of skill, and is highly automated.

There is a real fear that traditional firewalls and spam filters used by most SMEs may fail to detect these advanced threats.

In summary AI-driven cyberattacks pose a significant and growing threat to small and medium-sized enterprises (SMEs). While larger corporations may have the resources to defend themselves, SMEs are often more vulnerable due to limited cybersecurity budgets, staffing, and expertise.

Scroll to top