Cyber Awareness Training

Cyber Awareness Training Data Breaches and their consequences Identity and Access Management News Ransomware, Phishing and other Malware Security Tools Supply Chain Security

Cyber Attacks on SMEs

We’ve posted a few pieces recently on why setting a realistic budget for cyber security is so important and we thought we’d follow that up with some real-life examples.

Small and medium-sized enterprises (SMEs) are increasingly being targeted by cybercriminals in 2025 and are facing a range of sophisticated threats that exploit limited resources and evolving technologies. Here’s a quick look at some of the most pressing cybersecurity incidents and trends that have affected SMEs so far this year:

Major Cybersecurity Incidents Impacting SMEs

  • Co-op Supermarket Chain Cyberattack (UK)

A “highly sophisticated” cyberattack disrupted Co-op’s IT systems, leading to customer data theft, contactless payment failures, and empty shelves in Scottish stores. The breach also affected other major retailers like Marks & Spencer and Harrods, with investigations pointing towards hacker groups such as Scattered Spider and Lapsus$. 

  • Lockbit Ransomware Group Breach

The notorious ransomware gang Lockbit was itself hacked, resulting in leaked communications that revealed aggressive targeting of small businesses for extortion. This breach has temporarily disrupted Lockbits operations and exposed their tactics.

  • Berkeley Research Group (BRG) Data Breach

A cyberattack on BRG compromised sensitive data related to Catholic Church sex-abuse cases. The attacker used impersonation tactics via Microsoft Teams to deploy Chaos ransomware, leading to concerns over the exposure of victims’ identities.

 Emerging Cyber Threat Trends for SMEs

  • AI-Powered Phishing and Deepfake Attacks

Cybercriminals are leveraging AI to craft convincing phishing emails and deepfake audio impersonations of executives, deceiving employees into authorising fraudulent transactions.

  • Ransomware-as-a-Service (RaaS)

The availability of RaaS platforms has lowered the barrier for launching ransomware attacks, making SMEs prime targets due to their valuable data and often limited security infrastructure.

  • Supply Chain Vulnerabilities

Attackers exploit weaknesses in third-party vendors to infiltrate SMEs’ systems, as seen in incidents involving compromised software packages on platforms like NPM.

  • Business Email Compromise (BEC)

Scammers use AI to mimic emails from corporate partners and managers, leading to fraudulent financial transactions. In Australia, BEC attacks have increased by 7% year-on-year, with SMEs being particularly vulnerable.

Proactive Measures for SMEs

To mitigate these threats, SMEs should consider the following actions:

  • Implement Multi-Factor Authentication (MFA)

Enhance account security by requiring multiple verification methods.

  • Regular Employee Training

Your staff are your first line of defence and need to be educated on recognising phishing attempts and social engineering tactics.

  • Secure Supply Chains

Vet third-party vendors for cybersecurity compliance and monitor for unusual activities.   Are you in a supply chain for a major company?  Are you facilitating a back door into their systems?

  • Invest in AI powered security tools

Utilise advanced solutions capable of detecting and responding to sophisticated threats.  H2 has a couple of suggestion here that are affordable to SMEs.

  • Protective Monitoring

How do you know that your expensive solutions are protecting you?  Do you know if you’ve suffered a stealth attack where the attacker has built a back door into your systems?  Do you know if you’re hard-earned cash is being siphoned off?  How vulnerable are you to an attack? A monitoring solution for SMEs is now available at an affordable price.

  • Data Loss Prevention

Are you sure you know exactly where all your data is?  Are you sure that documents attached to emails aren’t still sitting on your email server?  Do you know if other documents have been downloaded from your cloud storage whilst your staff work from home, and then uploaded but a copy is still sitting on their laptop?  Data proliferation over time is almost a given.  Can you encrypt your sensitive data so that even if it’s stolen, it’s useless to the thief?  An affordable solution now exists.

  • Develop an Incident response and business continuity plan

No matter how well you protect yourself, you still need to prepare for potential breaches with a clear strategy to minimise impact and recover operations swiftly.

Cyber Awareness Training General Security Issues Ransomware, Phishing and other Malware Security Supply Chain Security

FEAR, UNCERTAINTY AND DOUBT

Or as it’s known amongst cyber security sales teams, FUD.  It’s a tried and tested method of trying to hook new sales and is often used by sales teams at, shall we say, a slightly lower level than the top end enterprise sales teams who, like me, don’t like it and stay shy of it.

OK, so now I’ve established my ethical credentials, how do I let my clients and potential clients, know what the threats are and how vulnerable to them, they are.  There’s a fine line between FUD and education.  People don’t need to be scared into doing things, they need to be educated into it and they have every right to know what the threat landscape looks like, and how vulnerable they are to it.

What’s the Threat in 2025?

It is expected that in 2025, organisations can expect to face a variety of cyber threats, including AI-powered attacks (see https://hah2.co.uk/?s=Artificial+Intelligence), ransomware with complex extortion tactics (https://hah2.co.uk/?s=Ransomware), supply chain attacks (https://hah2.co.uk/?s=Supply+Chain), vulnerabilities in IoT and 5G networks, and the rise of deepfake technology. Cybercriminals are leveraging AI to automate attacks, develop advanced malware, and bypass traditional security measures. Additionally, ransomware attacks are becoming more sophisticated, with some now stealing data alongside encryption, increasing the pressure on victims to pay. Supply chain vulnerabilities are also a major concern, as attackers can target third-party vendors to gain access to larger networks. The increasing number of IoT devices (see https://hah2.co.uk/?s=IOT) many of which lack robust security, also presents a significant challenge, as they can be easily exploited for attacks that disrupt critical infrastructure. Deepfake technology is also becoming more accessible, making it easier for attackers to create realistic fake content for various malicious purposes. 

How Does This Impact SMEs?

So where do SMEs sit in this space?  There is still the perception amongst them that they are too small to be worth attacking, that the rewards for the cybercriminals aren’t enough and they won’t bother.  Well, let’s debunk that.  SMEs are seen as low hanging fruit.  They will have much smaller budgets than the bigger players, they will almost certainly outsource their IT and as I’ve said often, you can outsource your IT, but not your responsibility.  There is a dearth of cyber security expertise, not just within the SMEs themselves, but also amongst the IT outsourcers they use.

In 2025, it is anticipated that SMEs will face evolving cyber threats, including AI-powered phishing, ransomware, and supply chain vulnerabilities, along with insider threats and IoT exploits. AI is going to have a very real impact on the attacks designed against SMEs.  Why?  Because AI provides automation, and automation is the key to making real money when attacking SMEs.  Think it through.  If a criminal organisation can attack hundreds, if not thousands of targets using one automated attack, with an expectation of say 50% success, with extremely little effort using AI, then that’s good business for them.  AI-driven attacks are predicted to be a top concern, with sophisticated phishing campaigns and deepfake fraud attempts on the rise. Ransomware continues to pose a significant risk, especially for SMEs with limited cybersecurity resources. 

Supply Chain Security

Supply chain vulnerabilities are also a growing concern, as hackers can exploit connections with external vendors to breach multiple businesses.  This latter should be a very real concern for any SME that is in the supply chain of a major organisation.  Just imagine the consequences for that SME if their customer is attacked, losing money and reputation, and can pinpoint the attack as coming via the SME.  How would that impact the SME?  Well, the financial and reputational consequences would probably kill their business.

Ramsac, in their 2025 SME threat report, tells us that a mid-sized UK logistics company fell victim to a ransomware attack in June 2023. They infiltrated the company’s network and left a note on screens: “If you’re reading this, it means the internal infrastructure of your company is fully or partially dead.” The attackers had encrypted the firm’s files and threatened to leak confidential data, essentially holding the business hostage.  They also reported that a large retail breach occurred when attackers compromised a small HVAC subcontractor (with far weaker IT security) and used those credentials to penetrate the larger corporate network. That attack led to the theft of millions of customer card details and tens of millions of dollars in damages – all traced back to a third-party SME vendor being hacked via a phishing email.

In Summary

We published a piece recently about cyber security and the SME and rather than repeat it here, we’ll simply give you the link – https://hah2.co.uk/cyber-security-and-the-sme/.  It reiterates some of my hobby horses, chief amongst them being cyber awareness training.  I’ve said before, but it bears repeating, that your staff are your first line of defence and are either your greatest asset, or your greatest risk.  The actions you take as an owner/director/manager, will decide which.

SMEs are facing increased pressures on their resources and the temptation to park cyber security until times are better, increases alongside those pressures, but avoid complacency, let’s discuss what you might be able to do procedurally and at low cost. If you have invested in tech, is it the right tech and is it doing what you think it’s doing? That’s never a given.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security

Cyber Security and The SME

What are we facing?

The world is in somewhat of a flux at the moment and SMEs are being battered from all sides it seems.  First, we have the increase in the minimum wage, which impacts SMEs, generally, more than the corporate sized businesses, and then the increase in NI.  What we didn’t need was tariffs, although how much of an impact that will have on SMEs won’t be known for some time yet.  The EU is the world’s largest single market area and is the largest economy in the world, whether some people agree or not.  Many may attribute that market size to large organisations and multi-national companies. While these are important contributors to the overall EU economy, the Small Medium Enterprise (SME) businesses form the backbone of that economy.  This is also true of the UK where the DTI estimates that SMEs make up nearly 95% of the UKs GDP.   A huge percentage and one that might surprise you.

According to the Cyber Security Breaches Survey (gov.uk), half of SMEs in the UK had experienced some form of cyber-attack in 2024, with email phishing, spear-phishing, and social engineering continue to trend as the most common and reliable means of illegally accessing a network.

NinjaOne produced are report which says that there were 7.78 million Cyber Attacks on UK Businesses in 2024. More than 400,000 cases of fraud and computer misuse were recorded. 50% of UK businesses experienced a cyber-attack.

The economic effects of the measures hitting SMEs discussed above, are already having an effect in that many SMEs are putting enhancing their protections against cyber-attacks, on the back burner.  Those we speak to acknowledge the problem but are reluctant to spend money on anything that isn’t their core business.  And we get that, we really do.  After all we are an SME ourselves.

What are the potential impacts of a cyber-attack on your business?

A successful cyber-attack can wreak havoc on your business. Damaging your financial stability, customer trust, and reputation while inviting legal issues. The fallout includes:

  • Loss of corporate, financial, and personal data
  • Disruption to trading and potential fines from ICO
  • Repair costs for affected systems
  • Imagine building customer trust and an impeccable reputation over years, only to see it shatter in hours due to a cyber-attack.
  • The consequences, loss of customers and decreased sales and profits

The fear of legal repercussions is real too. Deploying inadequate security measures can lead to fines, regulatory sanctions and even legal action.

So, what can you do to better protect your business?

Despite today’s digital landscape, cyber security remains a non-negotiable aspect of business success. The threats are real, and SMEs are not immune. In fact, they’re often the most vulnerable to cyber-attacks.

Solutions need not be complicated or expensive, yet many SME owners still act reactively, not proactively, to cyber threats.  The result? Huge costs to put things right and a massive hit on the company’s reputation and trust with their customers.

An underlying issue common to all SMEs is management awareness and commitment, which in turn drives budget, allocation of resources and effective implementation of the cybersecurity practices. Six categories of major challenges for SMEs have been identified:

  • Low cybersecurity awareness of the personnel.
  • Inadequate protection of critical and sensitive information.
  • Lack of budget.
  • Lack of ICT cybersecurity specialists.
  • Lack of suitable cybersecurity guidelines specific to SMEs.
  • Low management support.

Risk Management

Now I know that many will say that this is a technical matter and that we have a company under contract that looks after our IT infrastructure and therefore we can safely leave it to them.  Wrong.  Ask them some simple questions: 

  • Have they fully identified your security assets?  Security assets are not just   hardware and software, in fact those are often the least of your worries.  It’s the data, where it is and how it’s protected that is important.
  • Have they done a risk assessment on those assets.
  • Have they recommended or implemented controls to manage the risk down to your acceptable residual risk level.  That is assuming they have spoken to you about what that acceptable risk is. 

It’s very important that business owners grasp the difference between the technical requirements of their networks, and the business requirement. 

You carry out risk management on a daily basis as you go about your business.  Cyber security is no different and a simple risk management process can save you money by targeting your limited spend where it really needs to go, not where you may think it needs to go.  Here is a link to a short video on that risk management process, which should help you see that it’s not onerous and need not be costly.

https://bit.ly/3FdZ6x0

Cyber Awareness Training

Some of you who are amongst my regular readers, will be quite aware of my mantra in regard to Cyber Awareness Training for staff and managers.  A big misconception is that because cyber security can be an issue connected to technical measures, it lies squarely within the realm of IT.  Wrong.  Cyber security needs to be part of the culture of the organisation, second nature to all.  Staff need a basic awareness and how their attitude and actions can have a damaging effect on the business.  A report for ENISA, the EU security agency, suggests that 84% of Cyber attacks rely on some form of social engineering, and that the number of phishing attacks within the EU continues to grow.  This is echoed in the UK.

Budgets

Budgets remain a problem.  Many SMEs are low margin organisations, heavily reliant on cash flow, and therefore reluctant to spend on things that are not connected to their core business.  But they must get used to asking themselves, ‘Is IT part of my core business?’, and ‘how long could I continue to operate my business if I lost my IT systems?’.  Cyber security needs to be factored into budgets. Cyber security is an iterative process, it isn’t something that needs to be done once and then forgotten about.  The criminals are constantly evolving, and defences must evolve with them.

Cyber Expertise

Cyber security expertise is something that isn’t cheap and easy to obtain.  Many IT companies will talk about their expertise in this area but if you delve into that, it is generally focused on products, mainly firewalls and anti-malware.  Cyber security expertise goes much much deeper than that and is as much procedural as it is technical.  It starts with risk management, understanding the risks you face, which in turn is derived from threat and vulnerability analysis, matched to your cyber security assets.  Those latter are not necessarily hardware and software but can be much wider ranging than that.  Typically, the type of person who can legitimately call themselves experts in this field, can command salaries north of £80K.  I doubt there are many SMEs prepared to pay that, or indeed, many of the smaller IT companies.

Security Standards

It can also be advantageous to follow a standard.  By far the most comprehensive is the International Standard for Cyber Security, ISO27000 series.  However, this might be seen as a little heavy for many SMEs, although at the higher end, they may want to follow it, rather than seek certification.  At the lower end the UK Cyber Essentials scheme, mandated for anyone wishing to do business with the public sector, is very suitable, inexpensive, and obtainable.

Cloud Services

More and more SMEs are now moving to a cloud environment.  Be it MS365, Amazon Web Services, Digital Ocean, amongst others.  I usually recommend that SMEs take this approach as it can solve a lot of problems, particular with home working still very much in vogue.  However, it is not the panacea that most think it is and still has some security issues, usually but not always at the user end, that need to be addressed.

About H2

Here at H2 we use our long experience of providing cyber security solutions to the large enterprises, to craft solutions for the SME community, having first identified the issues that the business faces.  We take an approach that looks at things from the business point of view, managing risk and coming up with cost effective solutions which can be brought in in a phased way, for a subscription price.  No large bills to damage that all important cash flow.

Cyber Awareness Training General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools

Cyber Security is a Business Issue

I know that I tend to include the statement in the title, in many articles and posts that I produce, but I haven’t really expanded on it and explained in more detail why I say that this is a business issue and one that owners and boards need to fully embrace if they are to stay safe.

We still see many ‘tick in the box’ exercises happening when we talk to SMEs, particularly when they have encountered an issue and tell us that they have taken precautions which, when examined, aren’t doing what the company thought, or perhaps hoped, they were doing.  Compliance and auditable solutions need to underpin what precautions you are taking.  If you can’t check and make sure that everything is up to scratch, and do it easily and often, then you have wasted your money. 

Far too much money is spent on one size fits all solutions and those that are reactive to one off threats, which produces a firefighter mentality that is at odds with the holistic preventive protection that is required to combat the current and emerging threat landscape.

This is not just a technical issue

A great quote which I use a lot comes from Bruce Schneier, an American scientist and

information security thought leader.  He says:

If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.

And there’s a lot of truth in that statement, particularly when it comes to SMEs, simply because they don’t understand the technology, and leave it to the IT management company that looks after their network, who mainly focus on technology, because that’s their comfort zone and selling licenses is a big part of their business.  And neither the SME nor the IT Management company have a handle on the emerging threat landscape.

Another good quote comes from the Chair of the Australian Securities and Investments Commission.  He says, ‘If boards do not give cybersecurity and cyber resilience sufficient priority, this creates a foreseeable risk of harm to the company and thereby exposes the directors to potential enforcement action by [insert here your regions governance requirements] based on the directors not acting with reasonable care and diligence.’

Cyber security needs to be flexible and adaptable to the changing threats as they occur, because once they have become prevalent, it’s often too late to play catchup.  This means a holistic strategy that encompasses technology but also process, personnel, compliance and audit.  Don’t be complacent.  If you stand still, you will as they say, come a cropper.

Keep saying – PEOPLE, PROCESS and TECHNOLOGY – in that order.

Is there a Misleading Message Coming from the Technology Industry?

Perhaps, because there is a considerable amount of what we call FUD, fear, uncertainty and doubt, doing the rounds constantly. It concentrates people on thinking about specifics, instead of looking at the bigger picture.  Whilst there is no doubt that phishing, ransomware, and other scams have certainly concentrated the mind somewhat, and these attacks are most definitely not confined to the large enterprise businesses, but have been attacking, with a lot of success, the small to medium business market, this causes vendors to try and exploit the issues around that and push their technology solutions and of course, SMEs rarely, if ever, have the expertise to judge whether or not a particular product will actually give them the protection they need.  We now must add into the mix AI and its capacity for increasing cyber-attacks at all levels, making the production of malicious code so much easier and making it available to those perhaps less skilled than heretofore.

Another problem is that the advertising tends to give the impression that Cyber security is something new when in fact it’s just an evolution of the physical security issues that existed when information was all on paper.  Think of it like that and you’ll realise that it’s been around for a very long time and that what you are trying to protect is information of all kinds.  It’s information that makes your business work efficiently.  The very word Cyber brings with it the illusion that it’s something modern and/or futuristic, when in fact that word is essentially meaningless and the old description of Information Security or Infosec, is far more accurate and descriptive.  Cyber is a blatant attempt to push the technological aspect of information security.

Risk Management

I’m going to slip in a link to a short video on risk management as it pertains to Cyber (yes, I’m using that word because it’s sadly become de facto).  This video describes the process at a high level.

https://bit.ly/3FdZ6x0

Technology can be an essential part of your protection, but it must be targeted in the right way, which not only means you have the right piece of kit doing the right thing, but that you are targeting your IT spend to support your business goals and give a maximum return on investment (ROI).  It should also be married to good policies and processes that are enforceable and auditable and fully understood by your work force.  To do this you have to understand exactly what your risks, vulnerabilities and threats are to ensure that your solution to those risks, vulnerabilities, and threats, is targeted for maximum effect and ROI and that the technology is supporting the policies and processes, all of which is underpinned with good security awareness training.

It’s also necessary to have some way of measuring the effectiveness of your solutions through a monitoring or auditing solution.  Such solutions for SMEs have long been considered too expensive to even consider but that is no longer the case and affordable solutions are now on the market.

We must all grasp that these risks are owned by the board, and if you don’t have a formal board, then the management team.  This needs to be understood fully by those at the top.  They team need to understand what level of risk is acceptable and agree what risks they are prepared to tolerate to achieve the business aims.   They need to ensure that supporting policies are produced, implemented, understood by employees, and regularly reviewed and updated.  At H2 we tend to produce an information security and data protection handbook which can run into many pages.  Producing these policies is not as easy as it sounds.

You may also wish to look at some recognised standards by which you can regulate your risk management.  One such is the international standard for information security, ISO 27000 series but perhaps the most appropriate for SMEs is the Cyber Essentials Scheme which will help you demonstrate an appropriate level of information security and risk management within your company.

Once you have a risk management framework in place, owned from the top, then you can identify your information assets and assess the risk to your business should those assets be compromised in some way.  Then and only then can you adequately assess what processes and technologies you need to mitigate the risks identified for each asset thus targeting your spend for maximum effectiveness.

Sadly, that’s not the end.  User education is probably the most important element of all for SMEs.  Ensuring that your staff are aware of the policies and why they exist.  Protect yourself against scams which sadly, form the biggest danger to SMEs rather than hacks.  Scams can be very low tech or high tech using malware, but however they come in, your staff need to be aware of them.

Cyber Awareness Training General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Working Practices

Social Engineering

I frequently share insights on the significance of Cyber Awareness Training and its critical role in helping organisations defend against cybercrime. Cyber awareness training is a vital aspect of contemporary security strategies for everyone. It provides employees with the essential knowledge and skills needed to identify, respond to, and reduce cyber threats. This training is particularly effective in combating social engineering.

While many people are now familiar with the term social engineering, they may not fully understand its meaning. In the context of cybersecurity, social engineering involves manipulating, influencing, or deceiving individuals to gain unauthorised access to IT systems or to steal personal and financial information. It employs psychological tricks to lead users into making security errors or divulging sensitive data. The most prevalent form of social engineering is phishing.

Social engineering heavily relies on the six Principles of Influence identified by Robert Cialdini, a behavioral psychologist and author of “Influence: The Psychology of Persuasion.” These six principles are: Reciprocity, Commitment and Consistency, Social Proof, Authority, Liking, and Scarcity. Simply put, what these criminals seek is information, login credentials, passwords, names, phone numbers, and more. They are profiling your organisation to identify vulnerabilities, such as who manages accounts payable or whether you have an IT support company under contract that they could impersonate. In addition to phishing, they utilise various forms including vishing (voice phishing), smishing (SMS phishing), and simply calling to ask questions.

A rising threat that criminals are increasingly adopting is help desk social engineering tactics. In these schemes, attackers call an organisation’s IT help desk while posing as a legitimate employee, trying to convince the help desk agent to reset passwords or multi-factor authentication (MFA) for a specific account.

In recent years, this technique has been used to access single sign-on (SSO) accounts and cloud-based application suites. Multiple criminals adopted this approach in 2024, targeting academic and healthcare institutions; in these cases, attackers utilised compromised identities to extract data from cloud-based software as a service (SaaS) applications or alter employee payroll information.

IT help desks typically require employees requesting password and MFA resets to provide their full name, date of birth, employee ID, and manager’s name or answer a pre-set security question. However, cybercriminals attempting to socially engineer help desk personnel often answer these questions accurately. Much of this information is not confidential and can be found in public resources and social media sites. The dark web frequently harbours data that should remain private. At H2, we continuously scan the dark web for our clients to uncover any exposed information.

Often, help desk social engineering calls occur outside of regular working hours. This tactic allows criminals to maintain access to compromised accounts for longer periods before the legitimate account owner detects any suspicious activity. Attackers using this method may register their own devices for MFA to secure ongoing access to compromised accounts. They also frequently delete emails from compromised mailboxes related to suspicious account activities or configure mail transport rules to redirect relevant emails away from the main inbox.

Over the past year, several criminals have openly sought callers on popular forums. Advertisements typically call for English-speaking individuals familiar with RMM tools and experienced in conducting remote sessions. Some criminals are also exploring effective ways to spoof phone numbers or encrypt calls, ensuring caller IDs appear more credible. This trend suggests that phone-related social engineering will pose a significant threat in 2025 as demand for these capabilities increases.

So how can we combat this? I began with cyber awareness training, and I’ll conclude with it as well. When your staff, regardless of their technical expertise, understand what social engineering is and its intentions, they are much more likely to recognise it when it occurs. Simple practices such as asking unknown callers to call back using a verified number instead of one provided by the caller can make a difference. If you receive an email from a senior manager or board member that seems suspicious, open a new email thread for confirmation rather than replying directly, this helps avoid potential spoofing by scammers masquerading as legitimate sources. And of course, never click on links!

Cyber awareness training doesn’t need to be costly; it can be delivered face-to-face, online, or through automated means. At H2, we offer all these options! Regardless of your choice, please consider this training an essential component of your strategy.

Cyber Awareness Training General Security Issues Risk Analysis and Security Strategy Security

Societal Perception of Cyber Security

Cyber Security continues to be, all too often, treated as an IT issue.  Now this is a drum that cyber security professionals have been banging for a long long time.  Cybersecurity is NOT and IT issue, it is very much a business issue.  But we do struggle to get that across, particularly in the SME market who continue to view it as purely technical in nature.

Now, whilst I’m not always enthusiastic about the stats and reports that are published, simply because they tend to be industry publications with the authors often having an axe to grind but they can make some very good points.  Let’s look at some key challenges being encountered:

  • Cybersecurity spending appears to be slowing (although that depends on who you speak to), while boards are starting to push back and ask what they have achieved after years of heavy cybersecurity spend.
  • Boards and senior executives are asking the wrong questions about cybersecurity, leading to poor investment decisions.
  • Many current approaches to improve cybersecurity are falling short of providing appropriate and defensible levels of protection.

SMEs are invariably focused on cost, which means optimising their spend to ensure that they get the biggest bang for their buck, to coin a phrase.  However, time and again we see that they have spent, sometimes considerable, sums on technology without actually understanding what risks that technology is there to mitigate, therefore having no real idea if it is doing what they have been told its doing.  The amount of money they are spending is of course relative.  To a small business the sum invested might be a minor consideration to a much larger business.  So, it becomes crucial that the mitigations put in place are appropriate to the risks they are there to mitigate. 

This comes down to another drum we like to beat, that of risk management.  Below is a link to a short video which explains the risk management process as it appertains to cyber security.  Look at it with the view that it can be a matter of scale, and the smaller businesses may not need to go through the whole process but will need to go through much of it.

The risk management process

Note the I use the term mitigate rather than prevent.  That’s simply because eradication of risk is simply not possible if you are going to continue to do business.  The best you are going to achieve is to mitigate that risk to the lowest level achievable without getting in the way of business.

Let’s consider the following challenges and impacts:

ChallengeImpact
Societal perception of cybersecurity is that it is a technical problem, best handled by technical people, although that tends to be amongst the SME community.  There is evidence though that that is changing slowly.Societal perception is dominated by fear, uncertainty and doubt. It results in poor engagement with between management and suppliers, unproductive exchanges and unrealistic expectations. Ultimately, it leads to bad decisions and bad investments in cybersecurity.

Organisations are focused on the wrong questions about cybersecurity.  The question of what do I need to buy to secure my data is asked rather than what do I need to secure and what is the priority.
Unproductive questions are indicative of poor understanding, and drive attention away from an improving that understanding and therefore drive better investments.
Current investments and approaches designed to address known limitations are not productive.Many SMEs focused on technology and have a poor understanding of cyber risk management.  This is often compounded by an equally poor understanding within the IT management company’s they often outsource to.  This leads to a combination of poorly scoped solutions and all too often failed execution and unrealistic expectations.
Real failures are not getting enough attention to productively change behaviour.Compliance with any regulation does not equal appropriate levels of protection.

Now, whilst some of these impacts may not be a 100% fit for many SMEs, particularly at the smaller end of the bracket, they are close enough to be taken very seriously indeed.  Poor decisions are being taken every day in regard to the purchase of hardware and software to protect against cyber threats, without having carried out any kind of risk assessment to actually understand what risks they are trying to mitigate.  End result, an investment in technology that on its own, will not prevent many of the cyber threats that abound today, coupled with a false sense of security.

A competent cyber security professional will approach the problem from the point of view of People, Process and Technology, understanding that many mitigations require a combination of 2 or 3 of those to provide an adequate response to the threat.  For many SMEs, one of the biggest and quickest wins they can achieve is cyber awareness training for their staff.  If their staff are aware of the issues, they have a much greater chance of recognising a scam, a phishing attack, an attempt at social engineering etc.  And oftentimes such things can be mitigated by sound policies and processes.  All of this prior to even considering spending money on technology. However, the very first thing that should be considered is to undertake a risk management process to identify the threats and vulnerabilities inherent in the business, thus enabling the risks to be identified and working out what mitigations are needed to drive the risks down to an acceptable level.  SMEs almost never do this and it is a fundamental mistake.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Risk Analysis and Security Strategy Working Practices

Remote or Office?  The Debate Goes On

Barely a week goes by without the remote working v office-based argument surfaces somewhere, usually it must be said, at the corporate level, although many SME owners remain nervous of it, with others downright against it.  My client base appears to be largely OK with a hybrid model of working and only one is 100% remote based, having given up their office.

The COVID pandemic was the catalyst for this with businesses of all sizes being forced to transform their operations to support remote work and by and large have done well, but not without many challenges, including video conferencing burn out, (along with wishing they’d taken out shares in Zoom!!), and a yearning to work together in person again, someday.  We all realise that group working, face to face, is often necessary not just for efficiency, but because we are social animals.  Experience has taught many businesses many things but are often still struggling with the potentially dire consequences in terms of cyber security and data protection.

I should perhaps mention that in the corporate IT world, where I worked for many years for major system integrators like HP, hot desking and remote working was introduced in the early 2000s and therefore this was no problem for us.

A distributed work environment i.e., personnel spread around various locations, office, home working, even the local coffee shop, creates critical challenges and new security threats as a result.  The speed with which this has happened has meant that many simply did not take cyber security issues into account and if they did, thought, well, this is temporary, and it won’t matter in the long run.  Well perhaps, but as many are now finding, there have been advantages to home working, not least a lowering of costs in terms of how much office space is needed to carry out the business function.  Many are now looking at Hybrid working i.e., from home with a day or two in the office during the week.  There are pros and cons to this outside of the scope of this article, and businesses will have to make their own judgements, but one thing is clear and that is that businesses need to understand the risks now inherent in distributed work and need to get better at cyber security and data protection, in those environments.

Employees when remote working, are at much greater risk than those in offices. Since home connections are less secure, cybercriminals have an easier entry into the company network.  Furthermore, the explosion of various online tools, solutions, and services for collaboration and productivity tend to have the bare minimum of security default setting, and updates from third-party vendors can change security preferences and be easily overlooked.

Phishing becomes an even greater threat to home workers simply because, in an office environment, they have access to colleagues and managers, who they can approach for advice and guidance.  This is much harder to replicate with remote workers, especially those who may not be particularly tech savvy and who may not wish to become ‘burdensome’ to their co-workers.

Ransomware also enjoys an advantage in the remote working model.  If their connection to the company is blocked, it is more difficult for workers to get assistance from the right experts and authorities.  And since trust levels are lower when working from home, some workers will be concerned that they have “done something wrong” and so may be more reluctant to seek help. While this risk can be addressed by increased training, as well as messaging that vigilance and involving IT support will be rewarded, it can still be an uphill battle.

In a study carried out by Entrust it was clear that many organisations are grasping the concept of cyber awareness training, although there are still too few amongst SMEs that take this on board.  Of those who responded to Entrust:

  • 94% said employee training has a positive impact on data security.
  • 95% agreed that they trust remote employees to comply with data security best practices and training.
  • 93% said they felt positive about the impact data security training had on them.

Of course, this was a sampling and only 61% of employees said that their company offered training.

Whatever system of hybrid you are proposing to use, or are using, it is clear that you will need to go beyond baseline security measures.  In this case we are almost certainly dealing with baseline protections such as multi-factor authentication, known as MFA or sometimes 2FA, and virtual private networks (VPNs).  Both have their place and will be needed. 

The Entrust report cites a contradiction here, and it’s one I have also noted.  Many company owners/directors say they believe company data is protected with these baseline solutions, yet they also say that home internet connections, leaked sensitive company information and cyber-attacks are their top concerns.

If organisations are going to use hybrid work models successfully over the long term, then they will need to further invest in their security strategy. MFA and VPNs, while important, should be seen as part of a larger strategy for data security in a hybrid work model. Throughout and beyond the pandemic, bad actors have exploited security deficiencies of remote environments such as insecure home tech hardware, poor password hygiene and employee use of unapproved tools.


If you are going to adopt this new normal, or already have adopted it, then the process must start with understanding your risk posture which will inform you of what measures you need to take to secure your data.  Below is a link to a short video explaining cyber risk management, at least at a high level.

https://bit.ly/3FdZ6x0

Once you have a clear understanding of what your risks are, then you might like to consider a zero-trust approach to data security.

With employees having the ability to work anywhere in a hybrid environment, the office perimeter is no longer relevant to digital security.  Zero Trust frameworks are designed to apply the concept of least privileged access to people, systems and devices, giving these entities only the access they need to fulfil their role and nothing more. Additionally, a Zero Trust approach continually monitors user and device behaviour to identify suspicious patterns and take preventive action, including a step-up authentication challenge.

You may need to consider other protections such as:

  • Passwordless single sign on involving Privileged Access Management (PAM) to facilitate a Zero Trust approach. 
  • Data Loss Prevention.  Whilst a VPN will protect your data in transit, file level encryption ensures that it is protected at rest, at both ends of the tunnel, so that if it does get stolen or otherwise compromised, the impact is severely lessened.  There is more information in the short video below.

https://bit.ly/4berDPa

  • Protective Monitoring.  This has long been considered too expensive for an SME.  Well, no longer, there is now a system which is effective and affordable and is explained in the video below.

https://bit.ly/3Qy4u0x

If you feel a no obligation chat about this would be helpful, give us a call.

Cyber Awareness Training Data Breaches and their consequences Ransomware, Phishing and other Malware Security Tools

DATA BREACHES

Data breaches continue to make headlines, with corporate incidents grabbing the most attention. A prime example is the Equifax breach, where a server exploit compromised credit reports of over 140 million individuals. The breach took months to discover and resolve, ultimately resulting in Equifax settling with the FTC for a $575 million fine.

Not so long ago the Electoral Commission revealed it fell victim to a “complex cyber-attack,” potentially impacting millions of voters. Unspecified “hostile actors” accessed electoral registers from August 2021 and infiltrated emails and control systems. Alarmingly, this attack went undetected until the following October, leaving sensitive data exposed to cyber criminals for over a year. It’s astonishing that adequate protections were not in place to ensure timely detection and management of the breach.

According to the UK’s NCSC, half of businesses and about a third of charities have reported experiencing some form of cyber security breach or attack. This figure rises to approximately 70% for medium-sized businesses and 74% for large enterprises. Phishing remains a favoured attack method due to its relative simplicity, with AI now generating new variations of old scams.

Most data breaches occur unintentionally, often due to employees making mistakes because they lack awareness of proper procedures. Who bears responsibility? Is it the employee or the employer for not providing sufficient cyber awareness training? That’s open to interpretation.

Here are some notable examples from the Information Commissioner’s Office (ICO):

• A data controller inadvertently sent paperwork to a child’s birth parents without redacting the adoptive parents’ names and addresses. Upon discovering the breach, the data controller failed to inform the adoptive parents.

• A debt insolvency agent mistakenly emailed a vulnerable new client’s file to a colleague in another department. The colleague quickly deleted the email and alerted the sender about the mistake.

• An employee misplaced his briefcase containing work on an unencrypted laptop and unredacted paper files related to a sensitive court case, which included information on criminal convictions and health details. Initially, he believed both the laptop was encrypted and that the paper files were redacted. After informing his manager, who reported it to IT, the laptop was remotely wiped without initially notifying the ICO. The data controller later reported it after realising the laptop was unencrypted.

• A courier mistakenly delivered medication intended for one patient (Patient A) to another (Patient B). After Patient A complained, the pharmacist recognised the error and arranged for the unopened medication to be picked up and delivered correctly.

• A law firm employee fell victim to a phishing attack after clicking on a link in an email that led them to enter login credentials on what they thought was a legitimate site. The IT department later discovered that their email account had been compromised, leading to significant unauthorised payments being made by clients due to spoofed communications.

These cases are just a small sampling.

Now let’s discuss ransomware. There’s a common misconception among SME management that ransomware primarily targets larger companies since SMEs seem too small to be lucrative targets for cybercriminals. However, when SMEs do get attacked, ransom demands can be surprisingly low—often between £500 and £1,000—leading many SMEs to pay up without hesitation. This poses significant risks because often their data has already been stolen, and sometimes criminals fail to restore access afterward, leaving SMEs financially strained and unable to operate.

Preventing such attacks in the first place is far more advantageous. Here are several strategies you might consider implementing:

• One of the most impactful steps an SME can take is providing Cyber Awareness Training for employees. Research shows that 90% of data breaches stem from human error; it’s unlikely an employee will intentionally harm your business. However, without proper training, they may unknowingly engage in risky behaviour. Cyber security awareness training is crucial; staff need knowledge about potential threats. Cyber security is not just an IT issue; it’s a business-wide responsibility that requires everyone’s involvement. Effective strategies tend to follow the KISS principle—Keep It Simple Stupid.

• Another cost-effective measure is developing robust policies and procedures related to cyber security that are communicated throughout your organisation and regularly updated to remain relevant. Providing employees with clear guidelines on how to respond if they suspect suspicious activity supports them rather than penalising them for mistakes. Many SMEs lack adequate policies or settle for generic templates found online that seldom meet their needs.

• Review your backup strategy as well. Even if using cloud-based services, your data may not be adequately secured, despite providers’ claims. A better approach would be implementing a backup strategy where your data is backed up nightly onto magnetic media storage that’s stored securely offline. In case of an attack that locks your data, you could wipe affected workstations and restore information from backups without significant downtime.

• EMail remains one of the most common attack vectors. Numerous products claim to block malicious emails effectively; many excel at this task. For SMEs, cost is often a deciding factor when selecting these products. Unfortunately, some still opt for low-cost or free anti-malware solutions. Understanding that quality correlates with price is essential; if it’s free, you’re likely facing issues down the line.

Turning to how your systems might be monitored for security issues, we have been exploring options in the market for an affordable security managed service tailored specifically for SMEs and we believe we have found it! Our solution emphasises simplicity while utilising enterprise-grade technology to streamline daily operations effectively. Our unified platform seamlessly detects, prevents, and responds holistically to cyber threats without hassle or excessive costs.

We are offering a free trial that includes:

a. Email security.

b. Cloud data protection.

c. Automated cyber awareness training.

d. External risk assessment.

e. Endpoint security.

f. Secure browsing practices.

g. Phishing simulations.

h. Plus, as an added bonus: cyber insurance priced based on your risk score within our system—the lower your risk score, the more affordable your insurance!

This service is specifically designed for businesses with 1-250 IT users; while most SMEs typically fall between 10-15 users, we’re flexible! It’s a managed service approach with proactive risk mitigation tailored according to your preferences—all at just £12 per user per month!

We’re also introducing an intuitive cloud software solution focused on data protection that empowers organisations by securing their information while giving IT professionals an easy way to track sensitive data and manage risks effectively. The system routinely audits company data to locate sensitive information and applies necessary updates and encryption automatically.

This method ensures organisations always know what sensitive data they possess while keeping it secure through automatic encryption measures, making data security straightforward so businesses can protect private information as circumstances evolve over time, without needing complex software requiring specialised expertise.

Here are 2 very short videos explaining our solutions.

Why Your Business Needs Protective Monitoring – https://bit.ly/3Qy4u0x

Mastering GDPR Compliance: Safeguarding Your Company – https://bit.ly/4berDPa

Cyber Awareness Training General Security Issues

Cyber Awareness Training

Investing in cyber awareness training is crucial, especially for SMEs who tend not to have the expertise and resource at their fingertips, to protect themselves against cyber-attacks and scams. Cyber threats are constantly evolving, and smaller businesses are often prime targets for attackers due to perceived weaker security defences. Your staff are key, they are the first line of defence, and potentially, your biggest weakness.  This means they must know what the threats are and what simple steps they can take to protect the business. 

Here are some key reasons why an SME should be seriously considering a cyber awareness training programme for their staff:

a. Protect Against Cyber Threats

SMEs face risks from phishing, ransomware, and social engineering attacks. Training helps employees recognise and respond to these threats before they cause harm.

b. Reduce Human Error

Most cyber incidents result from human mistakes and are not malicious in nature.  Cyber awareness training can significantly reduce mistakes such as clicking on malicious links or using weak passwords. Training teaches employees what security best practice means and how to adopt it.

c. Ensure Regulatory Compliance

Many industries have data protection laws (e.g., GDPR) and other industry led regulations (PCI, FSA etc) that require businesses to safeguard customer data. Cyber awareness training helps SMEs comply with these regulations and avoid fines and reputational damage.

d. Protect Business Reputation

A data breach can damage customer trust and brand reputation, potentially leading to lost business. Proactive cybersecurity measures, including training, help maintain credibility.

e. Minimise Financial Losses

Cyber incidents can lead to financial losses from fraud, legal fees, downtime, and recovery costs. Investing in training is a cost-effective way to mitigate these risks.

f. Strengthen Overall Security Culture

When employees understand cybersecurity risks, they become an active part of the defence strategy, fostering a security-first mindset across the organisation.

g. Improve Incident Response

Trained employees can quickly identify and report security incidents, enabling faster response times and reducing potential damage.

h. Stay Competitive

Many clients and partners prefer working with businesses that prioritise cybersecurity. Demonstrating a commitment to security can be a competitive advantage.

Awareness training doesn’t need to cost that much, and it can be delivered classroom based, either on site or online, or it can be automated.  The latter is often the preferred platform for an SME. 

Let’s take a look at the pros and cons of each method of delivery.

Classroom-Based Training

Pros:

  • Interactive Learning – Employees can ask questions, engage in discussions, and get real-time feedback.
  • Customisable Content – Trainers can tailor content based on specific organisational threats or employee skill levels.
  • Higher Engagement – In-person or live virtual sessions often result in better engagement and knowledge retention.
  • Hands-on Practice – Allows for simulations, group exercises, and real-world case studies.

Cons:

  • Costly – Requires hiring trainers, scheduling sessions, and potential travel expenses.
  • Time-Consuming – Employees must take time away from work to attend sessions.
  • Scalability Issues – Difficult to train a large workforce across multiple locations.
  • Inconsistency – The effectiveness may vary depending on the instructor’s expertise and teaching style.

Automated Training (often AI-Based)

Pros:

  • Cost-Effective – No need for in-person instructors or travel costs.
  • Scalable – Easily deployed across an entire organisation, including remote employees.
  • Flexible Scheduling – Employees can complete training at their own pace.
  • Consistent Content Delivery – Ensures all employees receive the same training material.
  • Trackable Progress & Reporting – Automated platforms provide analytics on employee performance and compliance.

Cons:

  • Limited Engagement – Lack of real-time interaction may result in lower retention.
  • Generic Content – May not always address specific threats or industry-specific risks.
  • No Immediate Feedback – Employees may not have an opportunity to clarify doubts in real time.
  • Potential for Click-Through Learning – Some employees might rush through without fully absorbing the information.

Which one is better?  This is somewhat subjective and will depend very much on the type of business you are, your budget and expectations.  Generally:

  • For organisations needing high engagement and tailored content, classroom-based training is ideal.
  • For large, distributed teams or cost-conscious businesses, automated training is more practical.
  • A hybrid approach, combining both methods, often works best—using classroom sessions for deep learning and automated modules for ongoing reinforcement.

Here at H2 we can offer both classroom based, in person or on-line, as well as an automated programme which can include induction courses and continual reinforcement.  This of course if the more cost effective solution for many SMEs.

Cyber Awareness Training Data Breaches and their consequences Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools Working Practices

Cyber Security Operations

Security operations is a complex subject and there is no doubt that it can be expensive and difficult, even for corporate organisations who generally have the resource, both financial and technical, to run a security operations centre (SOC), or at least can afford to outsource.  I saw an RFP from a housing society for a SOC and I would be very interested to see if that contract gets let once the organisation gets the quotes, because I would be shocked if they could afford it.

Their RFP based its premise on the introduction of a Security Information and Event Management system (SIEM), which.in itself, might suggest that they don’t really know what they are asking for, or indeed, what they want.  I base this on having designed, built and operated several such operations centres in the past.

Now before the SIEM vendors and resellers pile on, let’s be clear, SIEM systems have their place and are very useful in a SOC, although I would argue that they are most certainly not the end all and be all.  My focus these days is on SMEs and for an SME there are several reasons why a SOC and an SIEM may be over the top and a cost too far.

Whilst an SIEM system is a valuable tool for cybersecurity, it comes with several drawbacks, including:

a. High Cost

  • Expensive Implementation – SIEM systems require significant upfront costs for software, hardware, and licensing.
  • Ongoing Costs – Maintenance, updates, and skilled personnel add to long-term expenses.

b. Complex Deployment and Management

  • Difficult Configuration – Setting up a SIEM system to work effectively requires extensive tuning and integration with various security tools.
  • Frequent Fine-Tuning – To avoid false positives and negatives, organisations must continuously refine alert rules and correlation policies.

c. High Volume of Alerts and False Positives

  • Alert Fatigue – SIEM systems generate numerous alerts, many of which are false positives, overwhelming security teams.
  • Difficult Prioritisation – It can be challenging to distinguish between critical threats and routine events without proper tuning.

d. Scalability Issues

  • Performance Bottlenecks – As an organisation grows, more logs and data sources can slow down the system.
  • Expensive Scaling – Scaling a SIEM to handle increasing data volumes often requires costly upgrades.

e. Need for Skilled Personnel

  • Expertise Required – SIEM systems need cybersecurity professionals to manage, analyse, and fine-tune them effectively.
  • Shortage of Talent – Finding skilled SIEM analysts can be challenging and expensive.

f. Storage and Compliance Challenges

  • Log Retention Costs – Storing large volumes of logs for compliance can be expensive.
  • Regulatory Complexity – Ensuring compliance with data protection laws (e.g., GDPR) requires careful log management.

h. Limited Threat Detection Without AI/Automation

  • Reactive Approach – Many traditional SIEMs rely on pre-set rules, making them less effective against new or sophisticated threats.
  • Lack of Automation – Without AI-driven analytics, manual investigation can be time-consuming.

Having debunked the usefulness of an SIEM system for an SME, let’s look at what an SME could do to mitigate their cyber risks.

A good cyber security strategy has always been founded upon strength in depth.  Sound security architecture, good cyber awareness training, solid access control and identity management, and the ability to protectively monitor your estate for threats, vulnerabilities, and risks. 

If you are not monitoring the effectiveness of the protections that you have spent good money on, how do you know it’s money well spent?  Are those protections doing what you think they are?  Monitoring is central to the identification and detection of threats to your IT systems. It acts as your eyes and ears when detecting and recovering from security incidents and it enables you to ensure that devices are used in accordance with your organisational policies.

Many small to medium-sized businesses struggle with stretched resources, lean budgets, and a critical technical expertise gap. This fight against sophisticated cyber threats and outdated systems turns them into easy targets for cybercriminals. Exposed and at risk, these businesses stagger on the edge of significant disruption, financial loss, and reputational damage.  Although on the surface an SIEM system might seem to be what an SME needs, it would not fit the profile of most SMEs, being too resource intensive and costly.

We have been researching the market, looking for a way of providing a security managed service that would serve an SME, at an affordable price.  And we think we’ve found it – no, we are SURE we have found it.  Simplicity is at its core, employing enterprise-grade technology to simplify and streamline the day-to-day work. Our unified platform and onboarding process, seamlessly detects, prevents, and responds to cyber threats in the most holistic, hassle-free, and cost-effective way.

We are offering a 14 day free trial and will cover:

  1. Email security.
  2. Cloud data.
  3. Automated cyber awareness training.
  4. External risk.
  5. Endpoint security.
  6. Secure browsing.
  7. Phishing simulation.
  8. And as an added bonus we can provide cyber insurance at a price which is directly linked to your risk score within or system.  The lower your risk, the cheaper the insurance.

This system is deliberately aimed at 1-250 IT users in any business.  Most SMEs come in around 10 to 15 IT users, but we’re not precious about it.  It is a managed service, and we have our eyes on the glass and can mitigate your risks automatically, or in concert with you, depending on how you wish to tailor the service.  All this for a mere £12 per user per month.

Scroll to top