Month: April 2026

Cyber Awareness Training Data Breaches and their consequences Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy

Three weeks v three minutes:  The MDR Difference

Managed Detection and Response, MDR, has long been considered too expensive and beyond the reach of SMEs.  There are very good reasons for this, not least because most companies who provide these services, don’t target SMEs because they perceive that the revenue isn’t there, even though the need very much is.  Another issue is that SMEs don’t have the in-house resource that can deal with this kind of service, to do this internally requires expertise, resource and expensive monitoring tools; all resource that SMEs don’t have.  At best, their IT systems are overseen by someone who has another primary function and hasn’t got much time to deal with IT issues, has no technical background, much less a cybersecurity background, and whose responsibility lies with liaising with their network provider. 

Turning to the network provider, who provides hardware and software, and maybe manages the network on behalf of the SME.  The service level agreement (SLA) that these companies work to will concisely lay down what services they provide, and I’m prepared to bet that that doesn’t include MDR, for the simple reason that they also don’t have the skill levels and experience required, to provide an adequate service.  Be clear, I’m not denigrating these companies or the services they supply, simply pointing out that they work to strict service levels as laid down in the contract and will usually not step outside of these.

I have written articles and posts about this before, but it’s worth repeating because there are now systems available that, often driven by AI, are now affordable and are not just appropriate for SMEs, but specifically designed for them, at a service level that is realistic and priced accordingly.  AI is something that we use in our service, quite extensively, because it does the heavy lifting and allows us to deliver a service at a price that is appropriate for an SME.  AI is now prevalent and is used pretty much everywhere, including by cyber criminals.  AI driven attacks are becoming the norm and are not going away.  We fight fire with fire.

Let’s develop this a bit further and look at a before and after’ scenario, where a small business, holding lots of personal identifiable data (PII), as defined within GDPR and associated legislation, decides to use an MDR service, having recognised that they have a legal duty to protect this data, and that a data breach would be a serious issue which could put them out of business.

Scenario: “Maple & Co. Accounting”

Business type: Small accounting firm (12 employees)

Tech setup: Cloud-based email, shared drives, a basic firewall, and endpoint antivirus

Challenge: Limited IT staff (1 generalist), growing concerns about cyber threats

BEFORE MDR

Day-to-day reality

Maple & Co. believes they’re “covered” because they have antivirus software and strong passwords. But in practice:

  • Alerts from antivirus pop up frequently → mostly ignored (“probably nothing”)
  • No centralised visibility into systems or logs
  • Employees occasionally click phishing emails
  • Software updates are inconsistent
  • No formal incident response plan

The Incident

One employee receives a convincing phishing email posing as a client invoice.

  • They click the link and enter credentials
  • Attacker gains access to their email account
  • Uses that account to send more phishing emails internally
  • Installs a lightweight remote access tool (RAT)

What goes wrong:

  • No one notices unusual login locations
  • Antivirus doesn’t flag the RAT
  • Suspicious outbound traffic goes undetected
  • The attacker quietly accesses financial documents for 3 weeks

Impact

  • Sensitive client data exposed
  • Regulatory reporting required
  • Business reputation damaged
  • Costly emergency IT response
  • Downtime and lost productivity

AFTER MDR IMPLEMENTATION

Maple & Co. adopts a Managed Detection and Response service.

What MDR Adds

  • 24/7 monitoring by a managed service provider
  • Endpoint detection and response (EDR) tools installed on all devices
  • Centralised log collection and analysis
  • Automated and human-led incident response

Same Attack Attempt (But Now…)

Step 1: Phishing Email Clicked

An employee clicks a similar phishing link again.

MDR Response:

  • Suspicious login detected (unusual geography + device fingerprint)
  • Alert triggered immediately by behavioural analytics

Step 2: Credential Misuse Attempt

Attacker tries to access email and internal systems.

MDR Response:

  • Account access temporarily blocked
  • Forced password reset initiated
  • Managed service team flags activity as high risk

Step 3: Malware Execution Attempt

The attacker tries to deploy a remote access tool.

MDR Response:

  • EDR agent detects unusual process behaviour
  • File execution is automatically stopped
  • Device is isolated from the network

Step 4: Human Analyst Intervention

  • Analysts investigate the full timeline
  • Confirm malicious intent
  • Remove persistence mechanisms
  • Provide a clear incident report

Outcome

  • Attack stopped within minutes, not weeks
  • No data exfiltration
  • Minimal disruption to operations
  • Actionable report delivered to the business

BEFORE vs AFTER (Quick Comparison)

Summary

Before MDR, Maple & Co. relied on tools without coordination or expertise. After MDR, they gained:

  • Continuous monitoring
  • Rapid response
  • Expert analysis
  • Reduced risk exposure

The biggest shift isn’t just better tools; it’s having dedicated security expertise actively defending the business at all times.

Remember, no service is ever going to guarantee 100% security, that’s just not realistic.  What an MDR designed for SMEs will do is to reduce your risk to a level that you’re prepared to accept, by adopting a risk managed approach.  It does this by having:

  • A vulnerability assessment tool
  • A cyber awareness programme inbuilt
  • A phishing simulation tool

By identifying your vulnerabilities early and fixing them, your exposure is reduced and by training your staff to be your first line of defence, you reduce your exposure still further.

Cyber Awareness Training Data Breaches and their consequences Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Working Practices

TARGET PROFILING AND SOCIAL ENGINEERING

I frequently share insights on the significance of Cyber Awareness Training and its critical role in helping organisations defend against cybercrime. Cyber awareness training is a vital aspect of contemporary security strategies for everyone. It provides employees with the essential knowledge and skills needed to identify, respond to, and reduce cyber threats. This training is particularly effective in combating social engineering.  It is arguably the quickest and cheapest measure an SME can implement to shore up their defences.

While many people are now familiar with the term social engineering, they may not fully understand its meaning. In the context of cybersecurity, social engineering involves manipulating, influencing, or deceiving individuals to gain unauthorised access to IT systems or to steal personal and financial information. It employs psychological tricks to lead users into making security errors or divulging sensitive data. The most prevalent form of social engineering is phishing.

Social engineering heavily relies on the six Principles of Influence identified by Robert Cialdini, a behavioural psychologist and author of “Influence: The Psychology of Persuasion.” These six principles are: Reciprocity, Commitment and Consistency, Social Proof, Authority, Liking, and Scarcity. Simply put, what these criminals seek is information, login credentials, passwords, names, phone numbers, and more. They are profiling your organisation to identify vulnerabilities, such as who manages accounts payable or whether you have an IT support company under contract that they could impersonate. In addition to phishing, they utilise various forms including vishing (voice phishing), smishing (SMS phishing), and simply calling to ask questions.

A rising threat that criminals are increasingly adopting is help desk social engineering tactics. In these schemes, attackers call an organisation’s IT help desk while posing as a legitimate employee, trying to convince the help desk agent to reset passwords or multi-factor authentication (MFA) for a specific account.

In recent years, these techniques have been used to access single sign-on (SSO) accounts and cloud-based application suites. Multiple criminals adopted this approach in 2024, targeting academic and healthcare institutions; in these cases, attackers utilised compromised identities to extract data from cloud-based software as a service (SaaS) application or alter employee payroll information.

It is important to keep in mind that profiling isn’t about technology.  Profiling uses social engineering techniques before it starts scanning your network for vulnerabilities.

Let’s now look at a scenario which we have entitled, “The Helpful IT Contractor”

Reconnaissance (Profiling the Target)

An attacker spends time gathering information about a mid-sized company:

  • Reviews employee profiles on LinkedIn
  • Identifies the IT helpdesk structure
  • Finds names of recent hires and projects
  • Notes that the company recently adopted a new cloud platform

The attacker now knows enough to sound convincing.

Initial Contact (Pretexting)

The attacker calls the finance department pretending to be:

“Hi, this is Alex from IT support. We’re fixing an issue with the new system rollout.”

They:

  • Use real employee names to build trust
  • Mention the actual cloud migration project
  • Create urgency: “We need to resolve this before payroll processing today”

Exploitation Attempt

The attacker asks the employee to:

  • Confirm their login details “for verification”
  • Install a “security patch” (malware)
  • Or approve a multi-factor authentication (MFA) request

If successful, the attacker gains:

  • System access
  • Credentials for lateral movement
  • Potential access to financial systems

How This Can Be Detected

Red Flags

  • Unexpected calls asking for credentials
  • Urgency or pressure (“must be done now”)
  • Requests that bypass normal IT procedures
  • Slight inconsistencies (email domain, phone number, tone)

Technical Indicators

  • Unusual login attempts (time/location anomalies)
  • Multiple MFA push requests
  • New software installation outside standard processes

How to Stop the Attack

People Controls

  • Train staff to:
  • Never share passwords or MFA codes
    • Verify identity via official channels
    • Challenge unusual requests—even from “IT”
    • Encourage a “pause and verify” culture

Process Controls

  • Enforce strict IT support procedures:
  • No credential requests via phone/email
  • All changes logged through a ticketing system
  • Require call-back verification using known numbers
  • Implement approval workflows for sensitive actions

Technology Controls

  • Multi-factor authentication (with number matching, not just push)
  • Endpoint protection to block unauthorized installs
  • Email and call filtering systems
  • Identity monitoring (detect unusual behaviour patterns)

Example of a Successful Defence

An employee receives the call but:

  • Refuses to share credentials
  • Reports the incident to IT/security/line manager
  • IT confirms no such request exists
  • Security team blocks the attacker’s number and flags related activity

Attack stopped before any damage.

Key Takeaway

Social engineering works by exploiting trust, urgency, and human behaviour—not technical vulnerabilities.  The strongest defence is a combination of:

  • Aware people
  • Clear processes
  • Enforced technology controls

Cyber Awareness training isn’t a nice to have, it’s essential  Your staff can be a very effective first line of defence, or they can be your biggest weakness.  Such training is an iterative process; it should be done on induction and then at regulator intervals through the year.  It is not a fire and forget process.

This training doesn’t need to be costly; it can be delivered face-to-face, online, or through automated means. At H2, we offer all these options! Regardless of your choice, please consider this training an essential component of your strategy.

If you’d like more information on this topic, let’s chat!

Cyber Awareness Training Data Breaches and their consequences Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Working Practices

Ransomware 101:  What Every SME Needs to Know

Ransomware is something that we tend to only hear about when it hits the news, usually referring to an attack on a major corporate organisation or a government body.  But it’s happening to a much wider range of businesses, and it tends to be a very much under-reported issue, particularly when it affects SMEs, which it does more often than you’d think. In a post last week, I referred to the attack on Knights of Old, a mid-sized transport company which was taken down in a very short space of time by a ransomware attack, from which they never recovered.  I wrote a piece a couple of months ago which highlighted the issue of under-reporting.  I won’t regurgitate it here, but if you want to read up on it, the link is Under-reported security incidents.

Overall, SMEs are particularly vulnerable because they often lack robust cybersecurity resources and recovery capabilities. A ransomware attack can have severe and often disproportionate impacts on small or medium-sized businesses:

  • Operational disruption: Critical systems and data become inaccessible, halting day-to-day business activities.
  • Financial loss: Costs may include ransom payments, recovery expenses, lost revenue, and potential regulatory fines.
  • Data loss or exposure: Sensitive customer or business data may be encrypted, stolen, or leaked.
  • Reputational damage: Loss of customer trust can lead to reduced sales and long-term brand harm.
  • Legal and compliance risks: Breaches of data protection laws (i.e. GDPR) can trigger investigations and penalties.
  • Business continuity risk: In severe cases, prolonged downtime can threaten the survival of the business.

Let’s now use a scenario to illustrate the problem.  The scenario is fictitious but has been constructed from real events.

It started like an ordinary Tuesday morning for BrightLane Logistics, a 45-person SME based just outside Manchester. They specialised in same-day delivery for local retailers, and their entire operation depended on a cloud-based booking system, a small internal server, and a handful of laptops used by dispatchers and drivers.

The Entry Point

At 9:12 AM, Sarah, a finance assistant, received what appeared to be a routine email from a known supplier. The message referenced an overdue invoice and urged her to review an attached document. The email address looked legitimate at a glance, just one letter off from the real domain.

Busy and under pressure, Sarah downloaded the attachment: “Invoice_April2026.xlsm.”

When she opened it, nothing obvious happened, just a blank spreadsheet and a prompt to “Enable Content.” She clicked.

That single action executed a hidden macro. Within seconds, a small piece of malicious code connected to a remote server and quietly installed ransomware on her machine.

Attackers do their homework.  They will have spent time profiling this company and its staff.  They will have researched them on Companies House, seen their last financial postings, and will have carried out various innocuous social engineering exercises to discover who does what within the company, and who their suppliers and customers are.  They maximise the chance of an employee clicking the link in the email.

The Spread

Because BrightLane had weak internal network segmentation and shared admin credentials across several systems, the malware didn’t stay contained. It harvested saved passwords from Sarah’s machine and moved laterally across the network.

By lunchtime:

  • The shared file server was infected
  • The dispatch system was compromised
  • Backup drives connected to the network were also encrypted

No alarms were triggered.  BrightLane had basic antivirus, but no advanced detection or monitoring tools.

The Detonation

At 2:03 PM, screens across the office flickered.

Files began changing names. Systems slowed to a crawl. Then everything locked.

A message appeared:

“Your files have been encrypted.

To regain access, pay X Bitcoin within 72 hours.

After that, your data will be permanently deleted.”

Phones started ringing immediately. Drivers couldn’t access delivery routes. Customers couldn’t place orders. The warehouse team had no visibility of scheduled shipments.  Operations ground to a halt.

The Immediate Consequences

Within hours:

  • All deliveries stopped
  • Customer service was overwhelmed
  • Financial systems were inaccessible
  • Staff were sent home early

The managing director, Tom, faced a brutal reality: the company could not operate.

They contacted their IT support provider, but it quickly became clear:

  • Backups were unusable (they had been encrypted too)
  • No incident response plan existed
  • Recovery could take weeks, if at all possible

The Decision Point

The ransom demand equated to roughly £120,000.

Paying it came with no guarantee of recovery as well as potential legal and ethical implications. Not paying meant:

  • Permanent data loss
  • Severe operational disruption
  • Potential business closure

Meanwhile, the attackers escalated pressure by threatening to leak sensitive customer data.

The Longer-Term Impact

Over the following weeks:

Financial Damage

  • Lost revenue from halted operations
  • Cost of external cybersecurity experts
  • Legal and regulatory compliance expenses

Reputational Harm

  • Customers lost trust
    • Key clients moved to competitors

Regulatory Consequences

  • A data breach investigation was triggered
    • Potential fines for failing to protect customer data

Internal Fallout

  • Staff morale dropped sharply
    • Leadership faced scrutiny over the lack of preparedness

The Aftermath

BrightLane eventually chose not to pay the ransom. They rebuilt their systems from scratch, but it took nearly a month to resume partial operations.

By then:

  • 30% of their customer base was gone
    • Cash reserves were severely depleted
    • The company had to downsize

The Lesson

The attack didn’t rely on sophisticated zero-day exploits.  This wasn’t one failure; it was a chain of small, common weaknesses, which, taken together, created a complete business shutdown:

  • One phishing email
  • One click
  • One flat network
  • One set of shared credentials
  • One poorly designed backup system

For BrightLane, the ransomware attack wasn’t just an IT issue; it became an existential business crisis.

SMEs can’t do everything, and if I were to prioritise measures that could produce the biggest risk reduction, taking into account limited budgets, I would recommend the following:

  • MFA everywhere (especially email & admin accounts)
  • Offline/immutable backups
  • Cyber Awareness training for staff and managers
  • EDR instead of basic antivirus
  • Remove shared admin credentials
  • Network segmentation (even simple VLANs)
  • Some form of managed detection and response

Don’t think it won’t happen to you.  It can and does happen to SMEs in the UK, many of whom pay up and don’t report it.  I understand why they do this, but it doesn’t help the overall problem, as it disguises the frequency and the damage done.  It’s much cheaper in the long run to take preventative action than it is to try to recover once it’s happened.

H2 provides affordable and flexible one-off and ongoing data protection and cyber risk protection services.

To learn more about the services we provide, please click here https://www.hah2.co.uk/

Alternatively, please feel free to give us a call or drop us an email:

M: 07702 019060

E: kevin_hawkins@hah2.co.uk

Trust H2 – Making sure your information is secure

Scroll to top