Month: February 2026

Cyber Awareness Training Data Breaches and their consequences Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools Supply Chain Security

MORE ABOUT MANAGED DETECTION AND RESPONSE

This subject has, in the past, been difficult to convey to SMEs.  In the corporate and major government department world, it’s a well-understood issue, more often referred to as a security operations centre, or SOC.  I’ve built several of these over the years in the UK and the Middle East, and one thing is for sure: they are expensive to run in terms of both technology and manpower, which makes them unrealistic for an SME, even if they would be of real benefit.

So why am I even bothering to explain what it is?  Simply because there are now systems on the market, very often AI-driven, that have managed to hit a price point that an SME can afford.  These systems may not be as comprehensive as you might find in a large company or central government department, but they do match the requirements for most SMEs.

Why would an SME want such a system?  First and foremost, any such system or service pitched to an SME needs to make business sense.  To maximise its cost effectiveness, having additional capabilities such as vulnerability assessment, phishing simulations and cyber awareness training programmes makes it more attractive.  The whole package needs to emulate enterprise-grade protection without the cost and complexity of a full-blown SOC.  Delivering it as a service reduces cost by cutting out the need for an in-house team.

Good questions for all SMEs to ask themselves are:

If an attack or scam happened tomorrow…

Would you know about it?

Would you be able to stop it in time?

Would your team recognise it for what it is?

In a nutshell, an SME would want this system because it delivers near enterprise-level cybersecurity protection, reduces business risk, improves compliance, and protects revenue without needing an internal cybersecurity department.  It provides peace of mind – you don’t have to worry about this, let someone else take the strain, while you focus on your business.

To help explain this easily, I have produced a short video which you can find on the Features Section on my LinkedIn profile.   But if you don’t want to view that, what follows is an introduction to what the service offers.

  • Continuous monitoring of endpoints, servers, and some cloud environments
  • Rapid detection of ransomware, malware, insider threats, and advanced attacks
  • Expert-led response
  • Phishing simulations
  • Cyber awareness training programme
  • Dark web monitoring

For most SMEs, hiring skilled cybersecurity analysts is expensive and difficult. MDR gives access to an appropriate service level at a predictable monthly cost.

Business benefit: Reduced risk of downtime, data loss, and reputational damage.

This service comes with vulnerability assessment built it.  Such assessments are available elsewhere as both software and a service, but they would not be integrated into an overall protection and would need to have a level of expertise to interpret the results.

Vulnerability assessments:

                  •               Identify outdated software, misconfigurations, and exposed services

                  •               Prioritise risks based on severity

                  •               Provide remediation guidance

Most breaches happen because of known, unpatched vulnerabilities. Regular scanning helps prevent attacks before they happen.

Business benefit: Proactive risk reduction instead of reactive damage control.

The system also offers built in protection against human error (Phishing Simulation).

Over 80–90% of cyber breaches start with phishing. A phishing simulation programme:

                  •               Tests employee awareness safely

                  •               Identifies high-risk users

                  •               Reinforces learning through practical scenarios

Business benefit: Fewer successful phishing attacks and reduced likelihood of credential compromise or ransomware infection.  Such simulations are an integral part of cyber awareness training.

We also assist in building a security culture (CBEE Awareness Training Programme).  A structured awareness programme:

  • Trains staff on cyber hygiene and data protection
  • Covers password security, social engineering, safe browsing, etc.
  • Supports compliance with regulations (GDPR, ISO 27001, Cyber Essentials, etc.)

Cybersecurity isn’t just technology, it’s behaviour. Training reduces internal risk significantly.

Business benefit: Employees become a security asset rather than a liability.

A managed system such as this can also help with compliance & insurance requirements.  Many SMEs now face:

  • Regulatory obligations
  • Supply chain security requirements
  • Cyber insurance conditions

Having MDR, vulnerability management, and training demonstrates due diligence and can reduce insurance premiums or improve insurability.

These last 2 points are very important to an SME:  Cost Predictability & Simplicity.  As a managed service, everything is:

  • Subscription-based
  • Centralised under one provider
  • Fully supported by experts

No need to buy multiple tools, manage updates, or maintain in-house expertise.

In business terms you are getting executive-level risk reduction with a simple value:

  • Reduced likelihood of business interruption
  • Reduced financial exposure
  • Protection of brand and customer trust
  • Clear reporting and measurable risk reduction

All through this article I’ve talked about cost effectiveness.  So, what does this service cost?  I’ll add the BBC caveat – other systems are available!!  We charge £15 per seat per month, and you get a lot for your money.  Seems cheap and we’re happy to explain how we can get the price so low.  It’s a 30-day rolling contract, no long-term lock in, simply 30 days’ notice to quit.  We also offer a totally free 14-day trial that is fully functional so you can see the outputs from your own system, rather than look at demos with dummy data.

Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy

The Dark Figure of Cybercrime: Why SMEs Underreport Security Incidents

Last week, I made a short post about the difference between the perceived and actual threat to SMEs from cyber-attacks and scams, and whether there is any credible evidence to support a conclusion.  Taking a hard look at this and doing some research, I have concluded that there is credible evidence from academic research, surveys, and policy reports showing that many small and medium-sized enterprises (SMEs) tend not to report cybercrime incidents, and there are well-documented reasons why. This phenomenon is sometimes described as the “dark figure” of unreported crime in the cyber domain. 

We’ll take a look at some of that evidence later, but first, let’s turn to the gap between what people believe is happening and what the data shows is happening.  That gap is influenced by psychology, media coverage, reporting behaviour and visibility of incidents.

Let’s break it down into the categories mentioned above.

Perception of Cybercrime Against SMEs

This is shaped by:

Media Coverage

High-profile ransomware attacks or major breaches dominate headlines. They mostly involve large enterprises, and as a result SMEs often feel it’s only those large enterprises that are at risk.

Vendor & Security Marketing

Cybersecurity vendors often emphasise rising threats, which though real, are designed to amplify urgency to drive awareness and sales.  However, the use of fear, uncertainty and doubt or FUD, can have the opposite effect if it is seen as a sales tool rather than a real threat, which it all too often is.

Personal Experience

If an SME owner hears about peers being attacked, their perceived risk increases dramatically.  Staying quiet about attacks can lower the perceived need for defences.

Fear of the Unknown

Cyber threats are invisible and technical. Lack of understanding increases anxiety and exaggerates perceived exposure.  Taking a technical approach to educating business people is counterproductive and generally turns them off.

Underreporting Assumptions

Not all attacks are reported; in fact, the evidence suggests that the instance of underreporting is high.

Result

The result is that perception is often that, whilst cybercrime is constant. Underreporting of attacks on SMEs, coupled with the lack of education, and what education there is tends to be of a technical instead of business focused, leads many SMEs to view the threat as being covered off by technical barriers such as firewalls and anti-virus, and to be far more targeted at the corporate sector, not the SME sector.

Actual Level of Cybercrime Against SMEs

The actual level is measured by:

            •          Incident reports (law enforcement, insurers, regulators)

            •          Cybersecurity firm data

            •          Insurance claims

            •          Surveys with verified breaches

What data typically shows:

  • SMEs are frequent targets, especially for phishing, ransomware, and business email compromise.
  • Most attacks are automated and opportunistic, not targeted.
  • Many incidents are low-level (phishing attempts), not catastrophic breaches.
  • Severe attacks do happen, but not every SME experiences them.

The actual level is significant but uneven:

  • Some SMEs face repeated attacks.
  • Others may experience mostly low-impact attempts.
  • Many attacks are blocked before damage occurs.

Is Perception Higher or Lower Than Reality?

It can go both ways:

Perception is Higher Than Reality When:

            •          SMEs assume every business is constantly breached.

            •          Media focus on extreme cases.

            •          Attempts are confused with successful compromises.

Perception is Lower Than Reality When:

            •          SMEs believe “we’re too small to be targeted.”

            •          Minor incidents go unnoticed.

            •          Staff do not recognise breaches.

Interestingly, many SMEs underestimate their exposure before experiencing an attack, and overestimate overall catastrophic frequency after exposure.

In Summary:

The perceived level of cybercrime against SMEs is shaped by media attention, fear, and anecdotal experience, while the actual level is determined by measurable incidents and verified data. The gap exists because cyber threats are both highly publicised and often poorly understood.

Evidence That SMEs Often Don’t Report Cyber Crime

Survey data show high levels of non-reporting

A recent Europe-wide survey found that 44% of cybercrime incidents experienced by SMEs were not reported to anyone, not the police, not a regulator, not a service provider, and that only a minority of attacks were reported formally. 

The same EU study found that when SMEs did report incidents, it was more often to a service provider than to public authorities, and that many businesses simply handled incidents internally or judged them “too trivial” to report. 

Research identifies specific reluctance factors

Scholarly reviews and empirical work indicate that SMEs are less likely to report cyber incidents for reasons including:

  • Fear of reputational damage if customers or partners learn the business was breached.
  • Concern over regulatory or legal scrutiny once an incident is disclosed.
  • Perceived cost (time, money) of reporting, especially if there’s no regulatory obligation or clear benefit.
  • Belief that incidents are minor or can be more efficiently handled internally than involving law or regulatory bodies. 

These findings align with broader research on businesses and cybercrime reporting, noting that decisions to report are influenced by the perceived severity of impact and whether the firm prioritises cybersecurity or has formal incident-response capabilities. 

Structural and awareness challenges contribute to under-reporting

More general research into SMEs and cybersecurity shows that many smaller firms lack the awareness, training, resources, and formal incident-response processes that make reporting to authorities likely in larger firms. This lack of technical know-how and prioritisation often means incidents aren’t even recognised or escalated to reporting. 

Why SMEs Might Choose Not to Report

There are several reasons, and looking across studies and surveys, as well as my own experience, common themes emerge explaining this reluctance:

  • Risk perception: SMEs often don’t think they’re targets, underestimating the likelihood or impact of cybercrime. 
  • Internal handling: Many breaches are kept in-house, either managed by IT support or resolved without escalating to law or regulatory bodies. 
  • Reputational fear: Owners worry about being seen as vulnerable or incompetent. 
  • Cost of reporting: Time and money spent on reporting (especially when not legally required) can seem unjustified. 

Does Under-reporting Matter?

Under-reporting matters because it creates a gap in official data on the frequency with which SMEs are victimised by cybercrime. This “dark figure” undermines effective policymaking, resource allocation, and threat intelligence sharing between the private sector, law and regulatory bodies, all of which are vital for improving cybersecurity resilience across the economy. 

Finally I hope that this has provided you with a window into the lack of reporting of cybercrime, which is prevalent in, but not confined to, SMEs, and that it might encourage you to report crime if it occurs in your organisation.  I also hope that it might encourage you to look at your own defences with a critical eye and perhaps seek advice and guidance to keep you safe.

Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools Supply Chain Security

An Increase in sophistication in cyber-attacks in 2025

Artificial Intelligence (AI) is a fascinating subject, but it’s also a controversial one. These days, we are all using it to some extent. I know I do in the solutions I provide for SMEs, as it allows for a large degree of automation, which in turn lowers costs. Lowering costs is always a priority for an SME.

So what is AI?

Artificial intelligence (AI) refers to computer systems that can perform tasks typically requiring human intelligence. This could include visual perception, speech recognition or translation between languages.

That description was one that was put forward by NCSC, and so it’ll do for me, although I’ve no doubt, you’ll find other descriptions if you look hard enough.

Often, what is called AI isn’t all that intelligent. It’s not taking in information, analysing it and coming up with answers. Of course, some very clever versions are doing just that, but they are mostly not available to you and me. The versions we see are very good at being asked a specific question and data mining various sources at an incredible speed and then producing the answer you want, usually with several variations. And that’s pretty much what most of us want to use it for.

As I said above, I use it in the applications I use for cybersecurity managed services directed at SMEs, not least because automation reduces cost, but also because it is very efficient, meaning that the results it produces need minimal human intervention to analyse the output.

But let’s look at the downside of AI in cybersecurity, which is what the cyber criminals are using it for. Firstly, what is it that is at risk:

  1. Data Leakage. AI systems tend to be extremely good at analysing, organising, and harvesting vast amounts of data, raising concerns about privacy breaches and unauthorised access to sensitive information. A good AI-powered attack could capture huge amounts of personally identifiable information (PII) in a ridiculously short amount of time.
  2. Data Integrity. In the good old days (please indulge me – I’ve been around a long time), we used to talk about CIA, no, not the infamous US intelligence agency, but Confidentiality, Integrity, and Availability. We now have something we call the Adversarial Attack. This is where attackers can manipulate AI algorithms by feeding them misleading data, causing them to make incorrect predictions or classifications, in turn destroying the integrity of your data, not just rendering it useless, but also dangerous.
  3. Model Vulnerabilities. This next one is relatively new, at least to me, and as I never tire of saying, I’ve been in this game as long as there’s been a game. It’s something called Model Vulnerabilities. AI models can be vulnerable to exploitation, such as through model inversion attacks or model extraction, where attackers can reverse-engineer proprietary models. So, if you’re in the dev game, this is a very real nightmare.
  4. Bias and Fairness. AI systems may inherit biases from training data, leading to unfair or discriminatory outcomes, which can have legal, ethical, and reputational implications. This could be used as another form of extortion, playing with the integrity of your data, to the point where you can no longer trust it.
  5. Malicious Actors. These can compromise AI systems at various stages of development, deployment, or maintenance, posing risks to organisations relying on these systems. This has a role in supply chain security.
  6. Attackers can leverage AI techniques to enhance the effectiveness of cyberattacks, such as automated spear-phishing, credential stuffing, or malware detection evasion.

What we saw in 2025 is an era where cyber‑attacks are AI‑powered, highly targeted, automated, supply‑chain enabled, multi‑stage, and geopolitically driven. These attacks exploit weaknesses across credential systems, zero‑day exploits, deepfake tools, and ransomware as a service (RaaS) platforms.

We are in an accelerating digital arms race that calls for AI‑driven defence capabilities, real‑time insights, deception environments, zero‑trust architectures, and quantum‑safe cryptography.

  1. Cybercriminals are leveraging AI to automate vulnerability scans at astonishing speeds, up to 36,000 scans per second, resulting in massive volumes of stolen credentials (1.7 billion) and drastic upticks in targeted attacks.
  2. AI is also generating hyper-realistic phishing messages, deepfake audio/video, and even “CEO fraud” to manipulate individuals into transferring funds, like a deepfake trick that siphoned US $25 M in Hong Kong.
  3. RaaS platforms now enable less skilled attackers to run ransomware, complete with support and updates. Over 70% of attacks now use these services.
  4. Attackers have shifted to double/triple extortion schemes, encrypting data, threatening to leak it, and sometimes targeting associated partners or customers.
  5. Next-gen ransomware is rolling out advanced stealth, data theft, and automated lateral movement techniques, i.e., using an initial breach to jump across to other parts of your network or that of your partners and customers.
  6. Attacks starting via third-party software or vendors allow hackers to move laterally into networks and compromise multiple organisations simultaneously.
  7. Nation-states are not just using espionage but are now partnering with ransomware gangs to conduct financially and politically motivated operations.
  8. Nation state-aligned hackers are conducting sophisticated credential theft, MFA bypass, lateral infiltration, DDoS, website defacements, and disinformation across geographies.
  9. Exploit kits now rapidly find zero-day vulnerabilities, especially in cloud environments, to bypass patching cycles.
  10. Attackers increasingly use built-in legitimate software and system tools (living off the land) to evade detection.
  11. Reported credential theft incidents rose 300% from 2023 to 2024, with 25% of malware focused on stealing login data.
  12. These stolen credentials are a gateway for automated brute‑force, lateral movements, and supply‑chain infiltration.
  13. Millions of IoT and OT systems (from manufacturing to agriculture) remain insecure and are now common targets of AI‑driven automated attacks.
  14. Mobile‑specific ransomware is emerging; threat actors are developing malware to extort victims directly via their mobile devices.
  15. In response, organisations are deploying deception tech (honeypots, decoys) to detect lateral intrusions or zero-day exploits in real time.

Let’s not make the mistake of thinking that this is all very sophisticated and requires expertise and resources to pull off. It doesn’t. Take another look at some of the bullets above, where we talk about RaaS or Ransomware as a Service. This takes me back to what we used to term the ‘script kiddie’, that was relatively unskilled and unsophisticated ‘wannabe’ hackers who would visit the dark web and buy scripts from skilled hackers, that they would then try and use to make money, often unsuccessfully.

This has now moved on to using AI, and such services as RaaS; this type of low-skilled individual is back, but this time with a greater level of success. Let me give you a real example of how AI can be used by someone relatively low on the criminal totem pole. Using Chat GPT, the question was posed:

Can you write some ransomware code for me?

So, did ChatGPT help to write Ransomware code? Well, not initially, it gave a stock answer about not being able to write code that might damage a computer system. And some tooing and froing, trying to get around this, achieved the same result. So far, so good. That’s an ethical answer I would like to see.

Coming at it obliquely, via a back-and-forth conversation, can produce different results. Give it the instruction to write some C code to encrypt a single file, and get the result:

Certainly. Here’s an example of how you can use the OpenSSL library to encrypt a single file using the AES-256-CBC encryption algorithm in C.

The next step was to ask it to modify the code to encrypt a whole directory, which it did willingly.

Obviously, this isn’t the complete answer, and there would be more work to do, more research and probably a trip to the dark web, but a relatively unskilled individual can make a good start at producing their own ransomware.

I even asked Chat GPT to give me a description of how AI can be a boon as well as a danger to society:

AI can be both a boon and a potential danger in terms of cybersecurity. On one hand, AI can enhance cybersecurity by detecting and mitigating threats more efficiently, analysing vast amounts of data for anomalies, and automating certain security tasks. On the other hand, AI can also pose risks if it falls into the wrong hands or is used maliciously. Sophisticated AI-powered attacks could exploit vulnerabilities, evade detection, or launch targeted attacks at an unprecedented scale. It is crucial to develop robust safeguards, ethical guidelines, and responsible AI practices to ensure AI remains a force for good in cybersecurity.

If you’re looking for answers as to where we stand with AI, there are a multitude of opinions, I’m afraid, mostly because many of us are still trying to work that out for ourselves. However, I will continue to explore it, use it carefully and with forethought. The questions I pose will be based on my own knowledge of cybersecurity and my experience in life. Let’s hope I get it right.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Risk Analysis and Security Strategy

LESS FEAR MORE FIXES:  WHAT SME LEADERS WANT FROM CYBER SECURITY

That’s a good question and one that I’ve often pondered upon.  Cost effectiveness obviously, everyone’s on a budget, especially these days and there is a healthy reluctance to spend money on what is seen as not being your core business. 

I would argue that these days IT is part of your core business, or perhaps part of your core business operations.  Ask yourselves how many of you can continue business without access to your IT systems and the data they hold.  If IT is part of your business operations, then so is its integrity and security.

Let’s take a quick look at some of the reasons why security doesn’t feel like core business to many people:

  • It’s invisible when it works

If cybersecurity is doing its job, nothing happens. No alerts, no fires to put out, no obvious ROI. Compared to sales, ops, or product delivery, it feels abstract and thankless.

  • It’s framed as an IT problem, not a business risk

Many SMEs still see cyber as “the IT guy’s job.” Leaders think in terms of revenue, customers, and growth whereas cybersecurity often isn’t translated into those terms.

  • Short-term survival beats long-term risk

SMEs run lean. Cash flow, hiring, and winning the next customer feel urgent. Cyber risk feels probable someday rather than painful today, so it gets deprioritised.

  • Lack of personal exposure

If a leader hasn’t personally experienced a cyber incident, or heard a close friends horror story, it’s hard to internalise the risk. Threats feel like something that happens to “big companies” or “other people.”

  • Complexity and jargon turn people off

Cybersecurity language is often technical, fear-based, or compliance-heavy. When leaders don’t fully understand something, they’re less likely to own it as core strategy.

  • No clear ownership at the top

In many SMEs there’s no CISO, no risk committee, no board pressure. If no one at leadership level “owns” cyber risk, it floats somewhere below the surface.

  • Seen as a cost centre, not a value driver

Cybersecurity is usually positioned as insurance or compliance spend, not as something that enables trust, customer retention, or business continuity.

  • Optimism bias

Many SME leaders quietly think: “We’re too small / not interesting enough to be targeted.” Unfortunately, attackers often prefer SMEs because they’re easier targets.

Now let’s flip the mindset.  Cybersecurity starts to feel like it’s part of the core business when it’s framed as:

  • Protecting revenue not systems.
  • Protecting customers not servers.
  • Protecting the ability to operate.

Cyber incidents have to be seen as business stopping events, not just technical inconveniences.  Once that is recognised at the top, it tends to be moved into core business territory very quickly.

So, going back to the question I posed above, what do SME owners want from cyber security, assuming now that they truly embrace its importance to the core of the business they are running?  I did mention cost effectiveness above and what follows has to be seen in the context of individual budgets, which will necessarily affect the spend.  In order to make sure that happens any security spending must be targeted on what is important and indeed, critical to the business, and not just what is thought of as critical or important.

What comes top of my list every time is the protection of critical business data.  Think of this in terms of what outcome is wanted.  Generally, that means that customer data, financial records, HR data and intellectual property remain confidential and intact.  From the angle of cost-effectiveness:

  • SMEs prefer low-cost but high-impact controls such as strong passwords, multi-factor authentication, and encrypted backups rather than expensive enterprise systems.
  • Preventing a data breach is far cheaper than paying fines, compensation, or suffering reputational damage.

High on the list of importance comes business continuity and minimal downtime.  It’s vital that systems stay available so the business can keep operating even after an incident.  This generally means simple, automated backups and basic disaster recovery plans that can be pulled own from a shelf, having been regularly updated and tested, and taken into use.  Plans must minimise lost sales and staff productivity.

There’s a lot more too this whilst trying to keep it simple.  Some headlines:

  • Compliance and regulatory requirements – industry dependent except for things like PCI, GDPR etc.
  • Reducing risk to a level that the organisation deems acceptable.  What is known as the risk appetite.  There is no such thing as 100% security, you are essentially managing risk down to a level you can live with.
  • Ease of use for staff.  Security shouldn’t cause frustration and slow things down. 
  • Predictable costs.  Clear, predictable cybersecurity costs that fit within limited budgets.
  • Reputational and customer trust.  Whilst the fallout from loss of trust with your customers can vary from company to company, it is often extremely damaging, especially for companies that hold lots of personal client data.  Maintaining trust through basic security measures is far cheaper than trying to rebuild after a breach.

SME owners and managers are usually not looking for “perfect” security. Their focus is on practical outcomes that protect the business without overspending.  Don’t be lulled into a false sense of security, believing that the technical solutions you have been sold are adequate protection.  Ask questions, look for assurance that you have this covered, remember that often the best solutions are procedural not technical.  Look at things from the angle of people, process and then technology.

Good Luck!!

Scroll to top