Month: January 2026

Cyber Awareness Training Data Breaches and their consequences General Security Issues Risk Analysis and Security Strategy

Security on Paper vs Security in Practice: What Executives Need to Know

My recent articles have been all about data leakage and I very briefly indicated that we have a solution for that.  I am aware though that in cyber security and in fact data protection, technical solutions on their own, are not sufficient.  They must be underpinned by sound policies and procedures.  One of my favourite quotes, that I probably use too often, but I make no apologies for that, is by a Harvard professor and cyber security evangelist, Bruce Schneier.  He says:

If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.

What am I getting at here exactly?  Well, some solutions are not about technology and in fact are best done procedurally and with sound cyber awareness training.  Other solutions are technical in nature but must be underpinned with sound policies and processes that are rolled out and understood by staff via sound cyber awareness training which covers these policies and processes and why they are necessary.

The great cry from cyber security professionals is – People, Process and then Technology.

For many SMEs, cybersecurity policies do exist but real visibility into cyber risk does not. Policies are often written to satisfy compliance requirements, reassure clients, and demonstrate intent, yet they rarely answer the questions executives care about most: Where are we vulnerable? What could realistically disrupt the business? Are we investing in the right protections?

What we are saying here is that security documentation should be more than a defensive tick box. When policies are actively mapped to vulnerability assessments, they become a powerful source of risk intelligence. Gaps between documented controls and technical reality surface quickly, exposing weaknesses that attackers are far more likely to exploit than auditors are to find.

In an environment where cyber incidents increasingly target smaller organisations, the difference between written policy and operational security is no longer academic. Converting policy into protection is a practical, achievable step that materially reduces risk and one that executive leadership is uniquely positioned to drive.

The trick is understanding what your risks are and what needs protecting and at what level.  What we mean is separating out what is highly sensitive, sensitive and not so much.  Our system helps you map this and helps you make some informed decisions, but it won’t write your policies for you.

I’ve written articles in the past on risk management and identifying threats and vulnerabilities and mapping them to risks Identifying what could go wrong digitally, understanding how bad it would be for the business, and deciding what to do about it, all within your budget and risk appetite. Think of it like financial or operational risk, just applied to data, systems, and online operations.

You can’t protect everything equally.  You don’t need a threat catalogue, just a broad understanding of the common ones that hit SMEs.  You can then assess:

Risk = Likelihood × Impact

Translate tech issues into:

  • Revenue loss
  • Operational downtime
  • Legal/regulatory exposure
  • Reputational damage
  • Customer trust erosion – reputational damage

What we are looking to do is to decide how we treat each risk.  There are really 4 options that you need to think about in terms of each risk:

  • Reduce – put controls in place (e.g., MFA, backups)
  • Accept – consciously live with the risk
  • Transfer – insurance, contracts, outsourcing
  • Avoid – stop doing the risky thing

There was an interesting post on LinkedIn recently about the Bank of England having just dropped its 2025 CBEST Thematic Report with some interesting findings.


After 13 threat-led penetration tests across UK financial services, the message is clear: most vulnerabilities aren’t sophisticated. They’re foundational.

  • Passwords stored in spreadsheets and shared drives
  • Weak MFA enforcement and poor credential hygiene
  • Inadequate network segmentation
  • Detection capabilities that couldn’t spot simulated attacks early
  • Staff still falling for social engineering

The regulators’ call to action is direct:

  • Harden your systems – patch and configure properly
  • Fix your credentials management – MFA, strong passwords, no plaintext storage
  • Detect faster – monitoring and alerting that actually works
  • Remediate based on risk – with proper oversight, not just tactical patches

What I’m touching upon here is multi layered security, what in the military we referred to as strength in depth.  Monitoring systems has often been thought of as too difficult and expensive for SMEs but that’s no longer true and we now have a solution that is affordable and designed specifically for SMEs which handles monitoring but also has some useful addons such as vulnerability assessment, phishing simulations and a built in cyber awareness programme, all within the licence costs, no hidden extras.

Cyber Awareness Training Data Breaches and their consequences Risk Analysis and Security Strategy

More About Data Leakage

Last weeks newsletter was all about data leakage, and I argued that it wasn’t a well understood problem, which doesn’t get the attention it deserves.  We all know about data protection, at least at a high level, and we know about the regulatory issues around it, although many take the view that talking about that is scare tactics designed to make you buy something.  And OK, it can be just that, but it doesn’t make it any the less real.

We all need to be cognisant of the issues and potential fallout, but it becomes much more of an urgent issue for organisations that depend upon holding and processing large amounts of what is known as Personally Identifiable Information or PII.  That is information that can identify a specific individual, either on its own or when combined with other data.  PII spans quite a large category of data:

a. Direct identifiers (identify someone immediately)

         •        Full name

         •        Social Security number / National ID number

         •        Passport number

         •        Driving license number

         •        Biometric data (fingerprints, facial recognition data)

b. Contact information

         •        Home or mailing address

         •        Email address

         •        Phone number

c. Financial information

         •        Credit or debit card numbers

         •        Bank account and routing numbers

         •        Tax records

         •        Payment transaction histories

d. Digital & online identifiers

         •        IP address

         •        Device IDs (IMEI, MAC address)

         •        Cookies linked to an individual

         •        Account usernames (when tied to a real person)

e. Personal characteristics

         •        Date and place of birth

         •        Gender

         •        Marital status

         •        Employment details

         •        Education records

f. Sensitive PII (higher risk if exposed)

         •        Medical and health records

         •        Insurance information

         •        Genetic data

         •        Precise location data

         •        Criminal history

We all process some data of this kind, if only data pertaining to our own employees, such as payroll information.  However, we often hold personal data regarding our customers and suppliers, names, payment details, addresses etc.  But consider organisations that store and process data covering many of the categories above.  I’m thinking about law firms, financial firms, even real estate agents and recruitment agents, amongst others.  Have you thought about the categories of PII you are holding?  Have you identified the sensitivity of the data you hold, and protect it accordingly?

It’s also important to understand what PII is not. 

  • Fully anonymised or aggregated data
  • General information that cannot be tied to a specific person (i.e., “people aged 20–30 in England”).

If you do hold lots of PII that is critical to your business, what do you need to care about?  This will depend to a certain extent on what you are holding and processing, but generally:

  • Protecting reputation above all else
  • Being seen as a safe pair of hands
  • Keeping clients and the board confident
  • Avoiding public embarrassment or loss of trust
  • Having certainty without complexity

Reputational damage can be far worse than losing say, some money to a scam or ransomware.  Firms can often come back from financial loss, but reputational damage is often permanent and fatal.  You need to be seen as a safe pair of hands.

A core anxiety is often worrying that if something happens, the organisation wouldn’t be able to confidently explain where the sensitive data is and how it’s protected.  Three things that tend to be a common theme amongst those we deal with at the start of their journey:

  • They know the risk exists
  • They don’t know how big the problem is
  • They hope nothing happens before they act

The problem often gets explained like this:

  • “We don’t really know where all our sensitive data is.”
  • “I’m relying on trust and assumptions.”
  • “Our outsourced IT provides storage solutions and gateway security, but they don’t really have a handle on our data.”

At H2 we understand the issues and anxieties.  We have a solution that deals with these requirements and has a built-in encryption system, all within the same monthly cost.  It’ll cost you nothing to trial it and we’d be very surprised if once you’ve seen it and seen the low monthly charge for the managed service, you don’t want to keep it.

Cyber Awareness Training Data Breaches and their consequences Risk Analysis and Security Strategy

Data Leakage

Data leakage is a subject that is not well understood but can have a devastating effect on a business.  It is a somewhat dry subject that many companies, particularly SMEs, pay little attention to, even whilst understanding the requirements of data protection, even if at a high level. 
 
Most data leaks are not the result of a cyber-attack, although many are, particularly ransomware, but are often the result of an employee either making a simple mistake, or more likely doing something that they didn’t know they shouldn’t.
 
I’m minded of an issue that arose a couple of years ago with a government department where magnetic media containing millions of pieces of data belonging to members of the public, was sent to somewhere it shouldn’t have been.  An employee was asked to download the data and send it out.  There was no policy in place for magnetic media handling, and the employee could not be blamed for doing what he was told.
 
Of course, these days electronic data handling make mistakes like that much easier to make, and as such they happen much more often.  The reputational damage from such mistakes can be catastrophic.
 
My subscribers will know that my focus is the SME, large and small.  So how does this impact them.  Not so long ago a small UK housing association experienced a breach when a disgruntled former employee leaked tenant data, exposing names, addresses, financial details, and tenancy agreements of around 3,500 tenants. This case shows how insider threats and inadequate access controls can lead to leakage of sensitive data in a small organisation. 
 
Industry reporting and surveys show that many UK SMEs experience data breaches with around 43 % reporting some kind of cyber security breach or attack in the past year. 
 
While not always individually publicised, these incidents often involve:
 
         •       Phishing that leads to credential compromise
         •       Unauthorised access via weak passwords or unmanaged devices
         •       Malware/ransomware encrypting or exfiltrating business data
 
These types of breaches typically result in data leakage of customer contacts, invoices, employee records and sensitive business information that can severely harm small firms.
 
A widespread supply-chain style attack affected companies using compromised versions of popular VoIP software (3CX). While this isn’t a single SME, it demonstrates how attackers target tools widely used by SMEs, leading to stolen data and credentials across hundreds of thousands of business customers globally. 
 
Here at H2, when we are first approached by a prospective client and we begin our offer of a 15-day free trial to examine their requirements, one of the first things we find is that they don’t know what data they are holding, or where it all is.  Oh, they have a general idea; it’s on the cloud server(s), it’s not on laptops or desktops, it’s just the stuff we need to process our clients’ requirements and yes, we’ve only got one copy.  And then we install our software that first carries out a discovery exercise and we find that their laptops/desktops are holding lots of copies of the data that is on the cloud server(s).  How does that happen?  Over time, especially with many now employing the hybrid system of working, ie between the office and remote (home) locations, employees log on to the cloud, find they have a bit of shaky internet link and download the data they need, work on it and then upload it again, forgetting to delete it from their machine.  Or they need to share it and attach it to an email and send it out, forgetting, or perhaps not realising, that the data is now stored, attached to an email, on their email server.
 
Then comes the issue with audit trails.  If the ICO ever wanted to carry out an investigation, then having an audit trail of who created/copied/deleted/forwarded what to who, makes life a whole lot easier.  And let’s not forget the member of the public who is fully entitled to submit a Data Subject Access Request or DSAR, which demands that you reveal what data you are holding on that person.  The law insists on it, and you can’t refuse it.  I know of a financial firm that took nearly 3 weeks to satisfy a DSAR, taking an employee off billing, for that time.
 
We have a solution that meets these requirements and has a built-in encryption system, all within the same monthly cost.  It’ll cost you nothing to trial it and we’d be very surprised if once you’ve seen it and seen the low monthly charge for the managed service, you don’t want to keep it.
Scroll to top