Cyber Awareness Training Archives - Page 4 of 9

A Guide to Cyber Security for SMEs

There’s a continual stream of blogs and posts about cyber security and the sometimes catastrophic effects of getting it wrong, but there is very little that tells SMEs what they should be doing, and it’s generally left to local IT management companies and VARs (Value Added Resellers – i.e. those who sell various products and add value by configuring and managing them). I’m not knocking those companies; they have a very valid business model. But what they aren’t are cyber security professionals and generally their security expertise is focused on the products that they sell. For instance, they will have good skills in installing and configuring security products such as anti-virus and firewalls but there is generally no knowledge of cyber risk management and assessment, thereby ensuring that you have the right defences in the right place, providing the best value for your limited spend, and ignoring the non-technical solutions that are often a better bet than a piece of technology.

SMEs generally have very little budget to allocate to this and that means that what budget they have needs to be effectively targeted at what is important. They need to be aiming for a situation whereby when a potential attacker targets them, they appear to be a more difficult nut to crack than other organisations in their space and their size. Attackers want things to be easy, not difficult, and they will often move on if things get difficult. A criminal is in the game of getting easy money.

Let’s take a look at what cyber security is all about, and more importantly, why you need it? Let’s tackle the first question – what is cyber security? One definition is as follows:

Cybersecurity is the practice of protecting computer systems, networks, software, and data from digital attacks, unauthorised access, damage, or theft. It involves a range of technologies, processes, and practices designed to:

Prevent cyberattacks
Detect breaches or suspicious activity
Respond to security incidents
Recover from damage or loss caused by attacks

The problem is of course that each bullet point there covers a multitude of issues that need to be addressed. The question is understanding what those issues are, how they affect you and what is the priority i.e. what are the most important things that you need to protect, and what comes next, all managed within whatever budget you can allocate to it. It’s not easy and you might feel that you don’t need to do everything but that you need to cover off the most important issues. That means of course that you need to know what those issues are.

The first thing you need to do is to identify your cyber assets. Assets are not confined to hardware and software, far from it. A cybersecurity asset is anything of value that requires protection in a digital context. Identifying and classifying these assets is a foundational step in building a strong cybersecurity posture. Assets will change from company to company, depending upon how you’re organised and what business you are in, but generally:

Hardware Assets

Servers, routers, laptops, mobile devices, firewalls
Why it matters: Physical devices are entry points for attackers and must be secured.

Software Assets

Operating systems, applications, databases etc
Why it matters: Vulnerabilities in software can be exploited to gain unauthorised access.

Data Assets

Customer records, financial data, intellectual property, source code
Why it matters: Data breaches can lead to regulatory fines, reputational damage, and financial loss.

Network Assets

VPNs, switches, IP addresses, subnets
Why it matters: Networks facilitate communication and, if not protected, can be avenues for lateral movement by attackers.

People Assets

Employees, contractors, system administrators
Why it matters: Human error is a leading cause of breaches, so training and access control are crucial.

Cloud and Virtual Assets

Virtual machines, containers, cloud storage (e.g., AWS S3, Azure Blob Storage)
Why it matters: Cloud environments introduce new attack surfaces that must be monitored and managed.

An example could be a customer database, maybe on the cloud or via an app, or even an onsite server. You class this as high value because it contains personally identifiable information (PII) and of course all your interactions with those customers and the value they have to you. Lose that and you might be out of business. You decide to encrypt it and use multi factor authentication and have daily backups, not kept online.

Identifying the assets is the first step in defining what protections you need. You then have to categorise those assets and decide how important they are to the business before you can decide what levels of protection they need.

Having categorised your assets, you then need to assign a risk score to them. Now, this can be done formally via a formal risk assessment, but I accept that many SMEs can’t afford to have that done, and, given the size of the company and the amount/types of information held, it might be relatively easy, when compared to a corporate body, to assign a risk score to each asset.

The next step then is to apply a risk score to the assets in accordance with how you have assessed them, this in turn informs you of the importance of each asset and how you will need to protect them. In other words, you are now targeting your spend to where you know it will be most effective.

We then need to identify the vulnerabilities and the threats and that is where most organisations require help.

Here at H2 we use our considerable experience in doing this for corporate level organisations, and translating that into doable chunks for SMEs, carving up what is needed into priorities and working with clients to decide what those priorities are. We do this keeping in mind the principle of People, Process and then Technology, keeping in mind that many protections, or controls as we term them, are actually not technical but are procedural, based on sound policy and process, and therefore costing very little.

We take a phased approach:

The first phase works with the client to decide where they are now, on a scale which we take from the Carnegie Melon cyber maturity model. Most SMEs come out at around 1 to 2 on the scale and aim to get to 3 to 3.5. The scale goes up to 5 but, as you can see from the phased approach above, this tends to be not necessary for an SME and is often too expensive anyway.

Once we know our starting point, we identify quick wins to tighten up security. As a rule, that will include things like cyber awareness training for staff, ensuring that all access is controlled using MFA of some sort and making sure that Admin rights are strictly controlled. Depending on the company and what it does, it might mean instituting some form of identity management.

As part of the Quick win phase, we also look at policies and processes. Is there a process for allocating and removing rights? Is there a policy and process about on and off boarding staff etc. Other policies we might need to look at include:

Top-level policy issued by the board
Starters and Leavers Policy
Access Control Policy
Magnetic Media Policy
Mobile Working Policy
Password Policy
Email Policy
Acceptable Use Policy
Data Protection

That done we move on to Phase 2 which is where we might recommend encryption both at rest and in transit, for critical data assets. We will discuss back up procedures and processes which will ensure that backups are securely stored and that restoring from backups is practiced and works. We will discuss incident handling procedures and business continuity planning. Finally, we will discuss monitoring and audit, two things that until quite recently tended to be out of the price range of SMEs. However, there are now systems and services on the market which are affordable.

This all seems a bit daunting, but if taken in chunks and phased over perhaps several budgetary periods it is doable, and you really need to consider it.

Ransomware – The Threat That Keeps On Giving

I know I’ve banged on about this quite a bit recently, but I make no apologies for it. It has sprung to the front again following the Panorama programme on Monday night which highlighted the often catastrophic effects of ransomware on companies, and had interviews with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA), with an NCA rep saying that 2025 is shaping up to be the worst year ever for ransomware and the CEO of NSCS calling on businesses to face up to the issue and sort out their cyber defences.

The programme highlighted that Ransomware as a Service (RaaS) now enables less skilled attackers to run ransomware, complete with support and updates. Over 70% of attacks now use these services.

Attackers have shifted to double/triple extortion schemes, encrypting data, threatening to leak it, and sometimes targeting associated partners or customers. Next-gen ransomware, e.g. LockBit 4.0, BianLian etc, is rolling out advanced stealth, data theft, and automated lateral movement techniques, using an initial breach to jump across to other parts of your network or that of your partners and customers.

You’ll have to forgive me for being a bit smug as the programme highlighted issues that I’ve been talking about for a long time now. Firstly, it’s not just the corporates that are targets for this. SMEs are also very much in the firing line. The programme highlighted an example I’ve quoted before. Knight of Old (part of the KNP Logistics Group) suffered consequences that they just couldn’t recover from.

In June 2023, the Akira ransomware gang infiltrated the company via stolen credentials and encrypted critical systems, including freight-tracking, payments, and internal servers, displaying this chilling message:

“If you’re reading this, it means the internal infrastructure of your company is fully or partially dead.”

The group also threatened to release over 10,000 confidential documents (payroll, invoices, financial files) as a form of double extortion. Despite having cyber insurance and backups, they couldn’t fully restore financial systems, and some backups were also destroyed. Insurers covered only the initial cleanup (~£250k) and $1M policy, but this fell far short of covering the estimated $2.7–$5.3 million ransom or the broader economic damage. Operational disruption prevented them from producing reports and financial statements, essential for securing bank funding. A sale fell through, as buyers wanted director guarantees they couldn’t offer.

The company entered administration in September 2023 and ceased operations. Around 730 out of 900 employees lost their jobs, including many long-serving drivers and staff who were owed unpaid wages. Local impact was severe: furloughed staff lost homes, cars, and some experienced severe personal hardship.

It appears that the attack was perpetrated via a weak password and the absence of multi-factor authentication (MFA), with the gang using a brute force method to crack the password. It underscores the fact that even companies with cyber insurance and accredited systems are vulnerable.

Obviously, we’re not party to the full facts but the company’s directors have been quite candid in interview, and we have to wonder if something as simple as good cyber awareness training and the introduction of MFA could have stopped this attack in its tracks. There are other factors to consider though. The backups seemed to have failed, with some of them being destroyed by the attack, suggesting that these backups were on the same network as the main system.

Clearly what is needed is defence in depth, based on the tried and tested method of risk management. The idea of defence in depth stems from military defences, where there are multiple layers to a defensive system. In cyber security we talk about People, Process and then Technology. I’ll once again trot out the quote from Bruce Schneier, ‘If you think technology will solve your cyber security problem, you don’t understand the problem and you don’t understand the technology’. This aligns very well with the opinion of both NCSC and NCA that the majority of these attacks are more in line with scams than with technical hacking.

Rather than bore you with the components of risk management in cyber, I’ll just point you towards a short video we produced on the subject.

Risk Management – a short video

We produced another video which highlights social engineering. That is the method by which much of these attacks are undertaken which are not particularly technical in nature. It’s the People part of the risk management process and is arguably the quickest and cheapest win any company can take. It’s a continual source of wonder amongst cyber security professionals that a large focus remains on technology whilst ignoring this vital element. Our short video tries to hit the highlights but in this changing landscape, we haven’t hit them all.

Social Engineering – A Short Video

The takeaway from this should be that no one is safe or immune from a ransomware attack, particularly ransomware as a service. This latter means that the attacker doesn’t need to be technically proficient, just determined. It enables attackers to target multiple companies at once. If they, for instance, attack 1000 companies at the same time, using the same service, and ask for moderate amounts of ransom, they only need to hit around a 40-50% success rate to make a decent profit. Add in AI which makes this so much easier to do, and you’ve got an idea of how much of a business this is for criminal and nation state sponsored gangs.

Do CISOs have a role in the Small to Medium Enterprise?

A Chief Information Security Officer or CISO, is a post you almost never find in an SME, even those at the top end of that sector. This has contributed to the growth of what is known as fractional appointments i.e. appointments that are not full time with the incumbents often taking roles in more than one organisation, thus the term Fractional.

Anyone taking any role in an SME management team will need to be pragmatic, practical and bring cost effectiveness to their discipline. The CISO role is no different and is all about managing risk, enabling the business and ensuring trust in a very cost sensitive environment.

The CISO can play a crucial role in an SME by ensuring that the organisation’s information and data assets are secure. While the CISO role in a large corporation may be more siloed or focused on strategy, in an SME the CISO often wears multiple hats, balancing strategy, operations, and hands-on technical work.

Challenges Unique to SMEs

I’ve often talked about the challenges that SMEs face, focusing as I do on cyber security. Let’s just have a quick recap looking at where the CISO fits in with these unique challenges.

Limited budget and staff: This is the main reason why SMEs will not employ a full time CISO, they simply can’t afford it. The other being that an SME probably doesn’t require a full-time resource anyway. Because of this lack of resource the CISO may also act as a hands-on security engineer or IT lead, perhaps liaising with a contracted IT outsourcer.
Lack of security culture: Many SMEs don’t prioritise security until after a breach. The CISO will be able to raise awareness and provide advice and guidance before the fact.
Rapid growth and change: Scaling securely is a key challenge as SMEs expand and there are often gaps left because of overlooking the need to embed security at the design stage. The CISO can plug that gap.

Let’s take a look at the potential elements of a job description for the role of a CISO, or a Fractional CISO, in an SME. Of course, these may not fit everyone and it’s more of a menu for SMEs to choose from:

Developing and Leading the Cybersecurity Strategy
Define the overall information security roadmap aligned with the SME’s business goals.
Balance security with business agility, in other words making sure security does not get in the way of business and keeping in mind budget constraints typical in SMEs.
Ensure the strategy addresses risk management, compliance, and data protection.

Risk Management and Assessment
Identify and assess cyber risks relevant to the SME (e.g., phishing, ransomware, insider threats).
Conduct regular vulnerability assessments and penetration tests.
Prioritise risks based on business impact and likelihood.

Policy and Compliance Management
Develop and enforce security policies, standards, and procedures.
Ensure compliance with relevant regulations (e.g., GDPR, PCI-DSS etc depending on industry).
Prepare for audits and provide documentation to demonstrate compliance.

Security Awareness and Training
Conduct regular security awareness training for employees.
Create a culture of security by promoting best practices (e.g., strong passwords, phishing awareness).

Incident Response and Business Continuity
Develop and maintain an incident response plan.
Lead the response to security breaches and minimise damage.
Ensure business continuity and disaster recovery plans are in place and tested.

Technology Oversight and Vendor Management
Evaluate and implement cybersecurity tools (e.g., firewalls, endpoint protection etc).
Manage relationships with third-party vendors, especially cloud providers and MSSPs.
Ensure that vendors comply with the SME’s security requirements.
Ensure the SME itself is not in conflict with any security requirements of larger organisations if it is in that organisations supply chain.

Board and Executive Communication
Translate technical risks into business language for senior management.
Report regularly on security posture, incidents, and needs.
Advocate for security budget and resources in line with organisational risk appetite.

I hope that gives a feel as to why an SME might want to consider a Fractional CISO or Board Advisor. Cyber-attacks are becoming more sophisticated, faster and harder to repel. It is no longer just the corporates who are in the firing line. Modern, often AI driven attacks have put everyone in the sights of the modern cyber-criminal and even from those criminal organisations that are nation state funded. It’s never been more crucial to have professional advice and guidance on tap.

How Should SMEs View Cyber Security?

We experience a quite varied attitude amongst SMEs to cyber security. There is still a prevalent view that they are not really a target because they’re not worth it, and we’ve commented again and again that this is simply not so. SMEs are considered low hanging fruit amongst cyber criminals simply because they tend to have weaker defences and don’t have easy access to the right levels of advice and guidance.

Good cyber defences can be seen in a similar light to insurance. Whilst you hope that you’ll never need it, you understand that it’s safer to have it and in turn, the insurance company will require you to meet certain requirements for your policy to remain extant.

100% protection against an attack is simply not possible and no responsible cyber security company will guarantee that. But we do try and empower businesses by forging intelligent defences to protect them in an ever-evolving threat landscape, being made more dangerous as criminals adopt AI in greater numbers.

SMEs face many of the same cybersecurity threats as large organisations, but they are often more vulnerable due to limited resources, staff, and awareness. So far it’s being reported that the biggest cybersecurity threats to SMEs in 2025 include:

Phishing & Social Engineering

What it is: Deceptive emails, texts, or calls that trick employees into revealing credentials or installing malware.
Why it matters for SMEs: They often have no formal training or tools to detect phishing. A single click can lead to a major breach.

Ransomware Attacks

What it is: Malware that encrypts data and demands a ransom for decryption.
Why SMEs are targets: They’re seen as “soft” targets, less likely to have backups or strong defences, more likely to pay.

Business Email Compromise (BEC)

What it is: Fraudsters impersonate executives or vendors to trick employees into sending money or sensitive data. Traditionally done by email spoofing, now increasingly being done by AI impersonation.
Why it’s dangerous: BEC is low-tech but high impact, no malware, just manipulation. Losses can be substantial.

Poor Password Hygiene

Common issues: Weak, reused, or shared passwords; lack of multi-factor authentication (MFA).
Impact: Credential stuffing and brute-force attacks are easy ways into SME systems.

Unpatched Software & Systems

What it is: Outdated software with known vulnerabilities.
Why it happens: SMEs often delay updates due to compatibility fears or lack of IT resources.
Real threat: Attackers automate the search for these flaws.

Supply Chain Attacks

What it is: Attackers target less secure vendors or partners to infiltrate your network.
Relevance: SMEs often rely on third-party services (e.g. MSPs, cloud tools), but don’t vet their security rigorously. Check their Ts&Cs, what are they responsible for and what are you responsible for? This is becoming a big issue amongst those with critical supply chains of which SMEs may be a part.

Insider Threats (Malicious or Accidental)

Malicious: Disgruntled employees stealing or sabotaging data.
Accidental: Well-meaning staff misconfiguring systems or clicking unsafe links.
Problem: SMEs rarely have monitoring tools in place to catch insider issues early.

Insecure Remote Work Infrastructure

Examples: Unsecured Wi-Fi, lack of VPNs, personal device use (BYOD).
Why it’s risky: Many SMEs embraced remote/hybrid work without upgrading their security posture.

Lack of Cybersecurity Training

Result: Employees don’t recognise threats or understand basic security practices.
Impact: Human error is still a major cause of breaches. Cyber Awareness Training is arguably the biggest and cheapest quick win an employer can take.

Cloud Misconfigurations

Common mistake: Leaving cloud storage exposed to the internet.
Why it happens: SMEs may lack specialised cloud knowledge or rely on default settings. Check with your supplier.

Bonus: AI-Powered Attacks

Emerging trend: Attackers use generative AI to craft more convincing phishing emails, deepfakes, and automated reconnaissance. Check out our earlier blog on this subject (An increase in sophistication of cyber-attacks).
Why SMEs should care: These tools lower the barrier for attackers and increase the success rate of scams.

What practical advice would we have for SMEs? Obviously, that depends on the SME, their vertical, how they operate etc. But generally:

Enable MFA everywhere.
Train staff regularly.
Keep software up to date.
Back up data (and test recovery).
Use endpoint protection.
Identify where all your sensitive data resides.
Investigate protective monitoring services.
Investigate Cyber Security Insurance.
Hire or consult a cybersecurity professional, even part-time.

Protective Monitoring for SMEs

Security operations is a complex subject and there is no doubt that it can be expensive and difficult, even for corporate organisations who generally have the resource, both financial and technical, to run a security operations centre (SOC), or at least can afford to outsource. I saw an RFP from a housing society for a SOC and I would be very interested to see if that contract gets let once the organisation gets the quotes, because I would be shocked if they could afford it.

Their RFP based its premise on the introduction of a Security Information and Event Management system (SIEM), which.in itself, might suggest that they don’t really know what they are asking for, or indeed, what they want. I base this on having designed, built and operated several such operations centres in the past.

Now before the SIEM vendors and resellers pile on, let’s be clear, SIEM systems have their place and are very useful in a SOC, although I would argue that they are most certainly not the end all and be all. My focus these days is on SMEs and for an SME there are several reasons why a SOC and an SIEM may be over the top and a cost too far.

Whilst an SIEM system is a valuable tool for cybersecurity, it comes with several drawbacks, including:

a. High Cost

Expensive Implementation – SIEM systems require significant upfront costs for software, hardware, and licensing.
Ongoing Costs – Maintenance, updates, and skilled personnel add to long-term expenses.

b. Complex Deployment and Management

Difficult Configuration – Setting up a SIEM system to work effectively requires extensive tuning and integration with various security tools.
Frequent Fine-Tuning – To avoid false positives and negatives, organisations must continuously refine alert rules and correlation policies.

c. High Volume of Alerts and False Positives

Alert Fatigue – SIEM systems generate numerous alerts, many of which are false positives, overwhelming security teams.
Difficult Prioritisation – It can be challenging to distinguish between critical threats and routine events without proper tuning.

d. Scalability Issues

Performance Bottlenecks – As an organisation grows, more logs and data sources can slow down the system.
Expensive Scaling – Scaling a SIEM to handle increasing data volumes often requires costly upgrades.

e. Need for Skilled Personnel

Expertise Required – SIEM systems need cybersecurity professionals to manage, analyse, and fine-tune them effectively.
Shortage of Talent – Finding skilled SIEM analysts can be challenging and expensive.

f. Storage and Compliance Challenges

Log Retention Costs – Storing large volumes of logs for compliance can be expensive.
Regulatory Complexity – Ensuring compliance with data protection laws (e.g., GDPR) requires careful log management.

h. Limited Threat Detection Without AI/Automation

Reactive Approach – Many traditional SIEMs rely on pre-set rules, making them less effective against new or sophisticated threats.
Lack of Automation – Without AI-driven analytics, manual investigation can be time-consuming.

Having debunked the usefulness of an SIEM system for an SME, let’s look at what an SME could do to mitigate their cyber risks.

A good cyber security strategy has always been founded upon strength in depth. Sound security architecture, good cyber awareness training, solid access control and identity management, and the ability to protectively monitor your estate for threats, vulnerabilities, and risks.

If you are not monitoring the effectiveness of the protections, you have spent good money on, how do you know it’s money well spent? Are those protections doing what you think they are. Monitoring is central to the identification and detection of threats to your business. It acts as your eyes and ears when detecting and recovering from security incidents and it enables you to ensure that devices are used in accordance with your organisational policies.

Many small to medium-sized businesses struggle with stretched resources, lean budgets, and a critical technical expertise gap. This fight against sophisticated cyber threats and outdated systems turns them into easy targets for cybercriminals. Exposed and at risk, these businesses stagger on the edge of significant disruption, financial loss, and reputational damage. Although on the surface an SIEM system might seem to be what an SME needs, it would not fit the profile of most SMEs, being too resource intensive and costly.

We have been researching the market, looking for a way of providing a security managed service that would serve an SME, at an affordable price. And we think we’ve found it – no, we are SURE we have found it. Simplicity is at its core, employing enterprise-grade technology to simplify and streamline the day-to-day work. Our unified platform and onboarding process, seamlessly detects, prevents, and responds to cyber threats in the most holistic, hassle-free, and cost-effective way.

We are offering a 14 day free trial and will cover:

Email security.
Cloud data.
Automated cyber awareness training.
External risk.
Endpoint security.
Secure browsing.
Phishing simulation.
And as an added bonus we can provide cyber insurance at a price which is directly linked to your risk score within or system. The lower your risk, the cheaper the insurance.

This system is deliberately aimed at 1-250 IT users in your business. Most SMEs come in around 10 to 15 IT users, but we’re not precious about it. It is a managed service, and we have our eyes on the glass and can mitigate your risks in concert with our clients providing advice, guidance and remediation as part of the service. All this for a mere £12 per user per month.

Check it out at the link below.

Cyber Security: why do I need protective monitoring?

Supply Chain Attacks

There have been a number of recent cyber-attacks that have used supply chains that many large businesses have. These businesses rely on smaller ones to provide key components that they require in their manufacturing or other processes. That supply chain is critical to their operations and therefore needs to be robust and secure. An attacker is constantly looking for weak links in cyber defences, that can be exploited for financial gain. They will look at an SME as such a weak link, expecting the SME to have a lower understanding of the threat, and lower expenditure on defence. They will be looking to piggyback on loopholes in the suppliers defences, to attack their main target.

A cyberattack on a supply chain can have far-reaching and severe consequences, not just for the targeted organisation, but also for its partners, customers, and even national security when considering the critical national infrastructure, nuclear, transport, energy, water etc. In short SMEs are a high‑risk conduit for supply chain attacks. Even minor breaches in small firms can ripple out, causing data loss, operational shutdowns, regulatory scrutiny, and reputational damage—highlighting why third‑party cybersecurity should be a top priority for all.

What real world examples can we give, particularly in the UK. Below are some notable UK supply chain cyber‑attacks that impacted SMEs and their customers, especially within third-party and vendor ecosystems

CTS breach — affecting dozens of UK law firms via SME IT provider

In 2023, CTS, a small IT supplier to multiple conveyancing and legal firms, was compromised. This granted attackers access to the networks of multiple SMEs in the legal sector, enabling potential data theft and operational disruption.

Metropolitan Police — hack via a small supplier

In 2023, hackers penetrated the Metropolitan Police by targeting a supplier responsible for police ID badges. Because the SME provider’s systems were breached, attacker access extended to personal staff data (names, ranks, photos, pay numbers), highlighting how SMEs serve as gateways for attacks on major institutions.

Synnovis ransomware — disrupting NHS clinical services

In June 2024, Synnovis, a pathology service provider for NHS hospitals, was hit by a Clop ransomware attack. Though Synnovis is not a front-line NHS body, as an essential subcontractor, the breach led to cancellations and testing disruptions in major London hospitals.

Blue Yonder — supply chain SaaS hack hits supermarkets & small logistics partners

In November 2024, Blue Yonder, a logistics SaaS provider, suffered a ransomware attack. Major supermarkets like Sainsbury’s and Morrisons were impacted—but crucially, many small UK warehouses and logistics SMEs that rely on the platform had to revert to manual operations, enduring days or weeks of chaos.

Systemic SMEs-vulnerability in UK supply chains

Research shows 77% of UK SMEs lack in-house cybersecurity, making them “soft targets” for attackers looking to pivot into larger clients. Meanwhile, 95% of larger UK companies reported experiencing negative impacts via vendor incidents.

Why SMEs are often the weak link in supply chains

SMEs often run with minimal cybersecurity budgets, lacking formal certifications.
Granted privileged access to larger clients. Many large organisations operate a just in time supply system, requiring their suppliers to be integrated into their systems.
When compromised, they become easy stepping-stones into bigger networks.

Summary Table of SME related supply chain attacks

Incident & Date	SME Role	Impact
CTS (2023)	IT supplier to law firms	Dozens of SMEs exposed
Met Police (2023)	Badge/ID card vendor	Police data compromised
Synnovis (June 2024)	Pathology provider	Hospital labs disrupted
Blue Yonder (Nov 2024)	Logistics SaaS provider	SME warehouses/businesses disrupted

What consequences can we expect from a supply chain attack?

Data Breach and Intellectual Property Theft
- Exposure of sensitive data: Customer data, supplier contracts, or internal communications.
- Theft of intellectual property: Designs, formulas, or proprietary technologies can be stolen and exploited.

Operational Disruption
- Production halts: If a manufacturer’s software is attacked, it may stop production.
- Delayed shipments: Logistic partners may be unable to fulfil deliveries.
- Inventory management issues: Automated systems may become unreliable or inaccessible.

Financial Loss

• Direct losses: Ransom payments, remediation costs, and legal fees.

• Indirect losses: Lost sales, customer churn, and regulatory fines.

• Stock impact: Public companies may see a drop in share price following disclosure.

Ripple Effects Across the Ecosystem
- Third-party impact: A breach in one company can compromise many others (CTS attack).
- Supplier distrust: Loss of trust among partners can damage relationships and business opportunities.
- Geopolitical risks: If critical infrastructure or government suppliers are hit, it can trigger national security concerns.

Legal and Regulatory Consequences

Violations of GDPR, PCI, etc.: Leading to hefty fines and legal action.
Breach notification requirements: Mandatory reporting can hurt brand image and cause public fallout.

Reputational Damage

Loss of customer trust: Perception of weak cybersecurity can cause long-term brand damage.
- Negative media coverage: Public awareness of the breach can linger for years.

Competitive Disadvantage

Loss of proprietary data: Competitors may gain an edge.
Resource diversion: Time and money spent on recovery rather than innovation or expansion.

Protecting against a supply chain attack

This will involve a mix of technical, procedural, and strategic measures. You need to understand that technology alone will not protect you. You must take a risk managed approach and understand that these attacks target vulnerabilities in third-party vendors, partners, or software dependencies. They will employ social engineering techniques and phishing in all its forms.

Know Your Suppliers and Vendors

If you are managing suppliers:

Inventory all third parties: Maintain an up-to-date list of all external vendors, software providers, cloud services, and contractors.
Assess risk levels: Identify which vendors have access to critical systems or sensitive data.
Ensure that you suppliers are aware of your security policies and that they have agreed to abide by them. Audit that.
Include security requirements in contracts (such as regular audits, breach notification timelines, etc.).
Ask for compliance evidence (ie, Cyber Essentials etc.).

If you are a supplier to a larger organisation:

Know and understand your customers security policies and undertake to abide by them. Don’t pay lip service, actually do it.
Make sure you understand your contractual obligations in this regard. Failure to do so could put you out of business.

Use Zero Trust Architecture
Apply least privilege access to vendors and third-party applications.
Isolate critical systems from less-trusted networks using segmentation.
Verify before trusting: Always authenticate and validate access requests, even from trusted sources.

Secure Your Software Supply Chain
Ensure your software comes from reputable sources and is regularly updated and patches applied.
Validate the integrity of software updates (e.g., use code signing and secure CI/CD pipelines).
Monitor for tampered or malicious packages.

Continuous Monitoring and Audit

Monitoring has long been considered too costly for most SMEs with systems such as SIEM not only being expensive but requiring constant analysis by a SOC analyst. However, there is now a system which is effective, managed and within most SME budgets. H2 can advise on this.
Log and audit changes to critical infrastructure or data access.
Use threat intelligence to stay ahead of known supply chain threats.

Patch Management and Updates

• Stay current with software and firmware updates.

• Use automated patch management tools where possible.

• Vet updates from vendors for authenticity and origin.

Incident Response Planning
- Create and test a supply chain-specific incident response plan.
- Ensure you can quickly revoke unauthorised or administrative access if needed.
- Conduct tabletop exercises that simulate supply chain attacks.

Train Your Staff
This is often the most effective quick win any organisation can make.
Educate employees about phishing, social engineering, and how supply chain attacks often begin.
Train procurement and legal teams to evaluate vendors with security in mind.

There is a lot too this subject and you might feel that you need advice and guidance.

DO YOU HAVE A HANDLE ON CYBER SECURITY?

Over the years I’ve had some very interesting conversations with several people from multiple different verticals, many fitting comfortably within the SME bracket, around Cyber Security. The conversations tend to take a very familiar turn. The cry of, ‘I’m covered, my IT support company has put in a firewall and some anti-virus. They tell me all is good’. Slightly depressing but hardly surprising.

So why surprising? A lot of IT Support Companies providing managed services do a very good job of supplying and implementing networks and providing hardware and software. The Cyber Security field is one where resources are scarce and expensive. Cyber Security professionals take a very different view than IT support companies and come at security from the risk managed view and recognise that it is not just about technology and in fact, it’s about people, process and then technology. More about this below.

As we travel around and visit clients or potential clients, it is common to find that they have the view that adequate security is provided by technology. They rely on their IT provider to provide the guidance they need which tends to involve firewalls, anti-malware software and perhaps a backup regime. All well and dandy. I use a quote from Bruce Schneier, Fellow at the Berkman Center for Internet & Society at Harvard Law School, quite a bit, it goes like this:

‘If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology’.

A common misperception is that IT Security is the same as Cyber Security. That surprises a lot of people, so let’s explore it a bit. There is clearly a close symbiotic relationship between the two disciplines. I would argue, and I know this might meet with some disagreement, that IT security refers to traditional IT security methods which are technology based. Such as firewalls, anti-malware, end point protection etc. Whilst Cyber security is based very much on risk management which combines controls which are both non-technical and technical, following the principles of People, Process and Technology. A good cyber security professional will have a good handle on both approaches.

Even though cyber security and data protection have leapt to the top of many people’s agenda in recent years it is still common amongst many SMEs to believe that it is an IT problem, a technical problem rather than a business issue, even when recognising that the risk of a cyber intrusion or a data breach, impacts the business, the bottom line.

Since I first wrote about this, we now have the changing landscape of working practices. Many SMEs have adopted a more flexible approach to work and are utilising a more hybrid working pattern with some working from the office, some from home and other places. This does have financial advantages for an SME but brings with it a lot more security issues which many are either parking or outright ignoring.

The National Cyber Security Centre (NCSC), a department of GCHQ Cheltenham, estimated, before the hybrid working pattern starting to bed in, that if you are an SME then you have around a 1 in 2 chance of experiencing a cyber security breach. For the small business this could result in costs of around £1400, for the medium business, considerably more. One has just been hit for around £30000, which I am sure you will agree, can be extremely damaging to the bottom line of businesses operating under tight margins. And of course, it’s not just financial penalties but the reputational damage should your customers data and assets be affected as well.

Within the SME world there is an almost total reliance on third party IT providers. Is that a good thing, after all that’s in the IT providers area of expertise and responsibility, isn’t it? And here comes the controversial bit. Third party IT providers, particularly in the SME space, are pretty much exclusively value added resellers or VARs, i.e., companies that sell other company’s products. Now I’ve no problem with that per se, but it comes with issues. Notable amongst them is that these companies will have skill sets that are very much limited to the products they sell. Ie they are proficient in the installation and configuration of those products and their clients are offered those products whether they are best in class, or more importantly, whether they are the most appropriate for the task. Before I get a social media pile on, I know that some of the bigger VARs do sell multiple vendors products, but they are in a minority.

Before we go any further, let’s briefly explore some issues that are common amongst SMEs. Some common myths first:

Small to medium size businesses are not worth attacking.
Cyber Security is an IT Issue.
Technology will keep me safe.
My policies and procedures are up to the job.
My staff are young and have been brought up with IT. They know the score.

Now let’s look at some of the more common issues that we see often amongst SMEs:

Lack of awareness around the current real-world cybersecurity risks
False sense of security, with a heavy reliance and dependence on an external IT third-party provider
Lack of cybersecurity knowledge and understanding
Poor cybersecurity maturity and posture within their businesses
Lack of staff training (at all levels) – just like Health & Safety, cybersecurity is everyone’s responsibility.

Here at H2 we offer a cyber maturity assessment that is designed specifically for SMEs. It is a comprehensive evaluation of an organisation’s cybersecurity capabilities and readiness to effectively mitigate and respond to cyber threats. It involves a detailed analysis of the organisation’s cybersecurity policies, procedures, technologies, and practices. The assessment aims to identify potential vulnerabilities, weaknesses, and areas for improvement in the organisation’s cybersecurity posture.

During the assessment, cybersecurity experts typically examine various aspects, such as:

Governance and Management: Reviewing the organisation’s cybersecurity policies, risk management frameworks, and leadership’s commitment to cybersecurity.

Security Awareness and Training: Evaluating the level of cybersecurity awareness among employees and the effectiveness of training programs.

Technical Controls: Assessing the implementation and effectiveness of security technologies, such as firewalls, intrusion detection systems, antivirus software, and encryption mechanisms.

Incident Response and Recovery: Analysing the organisation’s incident response plan, including procedures for detecting, reporting, and responding to cyber incidents.

Security Risk Management: Evaluating how the organisation identifies, assesses, and manages cybersecurity risks.

Third-Party Risk Management: Assessing the organisation’s approach to managing cybersecurity risks associated with third-party vendors and partners.

Compliance and Regulations: Verifying the organization’s compliance with relevant cybersecurity regulations and industry standards.

The results of the Cyber Maturity Assessment provide valuable insights to the organisation, enabling them to enhance their cybersecurity defences and establish a more robust and resilient security posture. It helps organisations prioritise their investments in cybersecurity, address vulnerabilities, and strengthen their overall cyber resilience and provides a road map to reach a standard agreed with the management, taking full account of that managements risk appetite.

WHAT DO SMES REALLY NEED TO KNOW ABOUT CYBER SECURITY

Maybe I should have titled this ‘What do SMEs WANT to know’ rather than need to know. That’s because all too often they want a very cut down version of what they need, because simply put, they don’t have the budget or expertise to get into too much detail and will often look for the easy way out. That’s becoming more and more of a problem given the concerted effort by cyber criminals to attack all sizes and types of business, here in the UK. I posted a bit about this earlier, you can read it here. Do SMEs really need a cyber strategy and if so, what exactly does that entail.

What is a Cyber Security Strategy?

A cyber security strategy is a plan that outlines an organisation’s approach to protecting its information systems and data from cyber threats. This strategy typically includes measures such as implementing security controls, conducting regular risk assessments, training employees on security best practices, monitoring network activity for suspicious behaviour, and responding to security incidents in a timely manner. The goal of a cyber security strategy is to minimise the risk of cyber-attacks and protect the confidentiality, integrity, and availability of an organisation’s sensitive information.

Do I really need that – I’m an SME and not really a target, am I?

Well yes, you are a target and there are a ton of statistics available which shows that SMEs globally are a very real target for cyber-attacks and can in fact, be very profitable for cyber criminals. There are a lot of reasons for that but one of the top reasons is that typically, SMEs spend very little on cyber defence and generally have very weak defences. Add to this that they don’t tend to carry out cyber awareness training for their staff, have limited resources and generally don’t have a good grasp of the issues.

Not their fault. Most are focused on their core business, trying make a quid or two and are pressed for time. They tend to rely on whatever company, usually local, that supplied their network, hardware and software, generally on a retainer. The problem is that those companies don’t really have a good grasp of the issues either, concentrating on technology, and then, not necessarily the right technology.

The real trick here is in devising a strategy that works whilst staying within budget and having the resources to make it work. Not an easy path to tread but one that is very definitely a must.

Secure by default and design

Now that’s an interesting title, but what does it mean? Secure by default and design means that a system or product is inherently built with security measures in place from the start. This ensures that security is a priority throughout the development process and that users can trust that their data and information will be protected. It also means that security features are enabled by default, reducing the risk of vulnerabilities or breaches. This approach helps to create a more robust and resilient system that is better equipped to withstand potential threats.

It applies as much to your network and systems as it does to software development and possibly more importantly to you, it is a legal requirement under the Data Protection Act 2018, or as it is becoming known, UK GDPR.

The first problem many people come up against is that they already have a network, probably connected to the cloud of some sort, very possibly for SMEs, MS365, but when the design was done, there wasn’t a full risk assessment undertaken which is a requirement to underpin that design. In other words what we in the cyber security industry refer to as Security Architecture Design (SAD), wasn’t a prominent consideration.

Not unusual and the common technologies were probably set up, firewalls and anti-virus, but not much else. And that is where a well thought out strategy comes into play.

What should I be considering in my Cyber Security Strategy

We’ve already said you are an SME, so do you need the sort of comprehensive cyber security strategy that we would see in a major corporate? No, but it should still cover off the major points and should continue to be reviewed alongside things like your Health and Safety policy and other industry standards that are required to be reviewed for you to stay in business, usually annually. I know, it’s a pain and you’ve got enough to do without increased paperwork. But this isn’t red tape, this is designed to keep your business protected and can save you a lot of money, time and trouble.

You need to be thinking about the key components needed to effectively protect an organisation’s digital assets and data. These components may include:

Risk assessment: Assessing potential cybersecurity risks and vulnerabilities to identify areas of weakness and prioritise areas for improvement.

Security policies and procedures: Establishing clear and enforceable policies and procedures for data protection, access control, incident response, and other security-related activities.

Employee training: Providing ongoing training and education to employees on cyber security best practices, such as password management, phishing awareness, and safe browsing habits.

Security tools and technologies: Implementing robust security tools and technologies, such as firewalls, intrusion detection systems, encryption software, security monitoring tools and data protection tools, and endpoint protection solutions.

Incident response plan: Developing a detailed incident response plan that outlines the steps to be taken in the event of a security breach or cyber-attack, including communication protocols, containment measures, and recovery strategies.

Regular audits and testing: Conducting regular security audits and penetration testing to assess the effectiveness of existing security measures and identify any vulnerabilities that need to be addressed.

Collaboration with external partners: Establishing a partnership with cyber security company that understands the issues that affect SMEs and who themselves can establish a solid working relationship with the IT provider that is providing and administering your network and IT resources, will enhance your protections, significantly improve your employee and managerial awareness of the issues, and provide you with the peace of mind you need, allowing you to concentrate on your core business.

So, to wind this up, everyone needs a strategy that is tailored to them and covers off their needs. In order to make sure that your cyber, or if you prefer, your information assets, are secured, you need to understand what they are and how vulnerable they are to attack. Only then can you start to put in place protections that are appropriate to you, and affordable, making sure that your budget is spent wisely. Don’t be put off by all the stuff above, some of it, or perhaps much of it, won’t apply to you, but some of it definitely will. Don’t be afraid to take advice from those who know what they are talking about.

Cyber Attacks on SMEs

We’ve posted a few pieces recently on why setting a realistic budget for cyber security is so important and we thought we’d follow that up with some real-life examples.

Small and medium-sized enterprises (SMEs) are increasingly being targeted by cybercriminals in 2025 and are facing a range of sophisticated threats that exploit limited resources and evolving technologies. Here’s a quick look at some of the most pressing cybersecurity incidents and trends that have affected SMEs so far this year:

Major Cybersecurity Incidents Impacting SMEs

Co-op Supermarket Chain Cyberattack (UK)

A “highly sophisticated” cyberattack disrupted Co-op’s IT systems, leading to customer data theft, contactless payment failures, and empty shelves in Scottish stores. The breach also affected other major retailers like Marks & Spencer and Harrods, with investigations pointing towards hacker groups such as Scattered Spider and Lapsus$.

Lockbit Ransomware Group Breach

The notorious ransomware gang Lockbit was itself hacked, resulting in leaked communications that revealed aggressive targeting of small businesses for extortion. This breach has temporarily disrupted Lockbits operations and exposed their tactics.

Berkeley Research Group (BRG) Data Breach

A cyberattack on BRG compromised sensitive data related to Catholic Church sex-abuse cases. The attacker used impersonation tactics via Microsoft Teams to deploy Chaos ransomware, leading to concerns over the exposure of victims’ identities.

Emerging Cyber Threat Trends for SMEs

AI-Powered Phishing and Deepfake Attacks

Cybercriminals are leveraging AI to craft convincing phishing emails and deepfake audio impersonations of executives, deceiving employees into authorising fraudulent transactions.

Ransomware-as-a-Service (RaaS)

The availability of RaaS platforms has lowered the barrier for launching ransomware attacks, making SMEs prime targets due to their valuable data and often limited security infrastructure.

Supply Chain Vulnerabilities

Attackers exploit weaknesses in third-party vendors to infiltrate SMEs’ systems, as seen in incidents involving compromised software packages on platforms like NPM.

Business Email Compromise (BEC)

Scammers use AI to mimic emails from corporate partners and managers, leading to fraudulent financial transactions. In Australia, BEC attacks have increased by 7% year-on-year, with SMEs being particularly vulnerable.

Proactive Measures for SMEs

To mitigate these threats, SMEs should consider the following actions:

Implement Multi-Factor Authentication (MFA)

Enhance account security by requiring multiple verification methods.

Regular Employee Training

Your staff are your first line of defence and need to be educated on recognising phishing attempts and social engineering tactics.

Secure Supply Chains

Vet third-party vendors for cybersecurity compliance and monitor for unusual activities. Are you in a supply chain for a major company? Are you facilitating a back door into their systems?

Invest in AI powered security tools

Utilise advanced solutions capable of detecting and responding to sophisticated threats. H2 has a couple of suggestion here that are affordable to SMEs.

Protective Monitoring

How do you know that your expensive solutions are protecting you? Do you know if you’ve suffered a stealth attack where the attacker has built a back door into your systems? Do you know if you’re hard-earned cash is being siphoned off? How vulnerable are you to an attack? A monitoring solution for SMEs is now available at an affordable price.

Data Loss Prevention

Are you sure you know exactly where all your data is? Are you sure that documents attached to emails aren’t still sitting on your email server? Do you know if other documents have been downloaded from your cloud storage whilst your staff work from home, and then uploaded but a copy is still sitting on their laptop? Data proliferation over time is almost a given. Can you encrypt your sensitive data so that even if it’s stolen, it’s useless to the thief? An affordable solution now exists.

Develop an Incident response and business continuity plan

No matter how well you protect yourself, you still need to prepare for potential breaches with a clear strategy to minimise impact and recover operations swiftly.

FEAR, UNCERTAINTY AND DOUBT

Or as it’s known amongst cyber security sales teams, FUD. It’s a tried and tested method of trying to hook new sales and is often used by sales teams at, shall we say, a slightly lower level than the top end enterprise sales teams who, like me, don’t like it and stay shy of it.

OK, so now I’ve established my ethical credentials, how do I let my clients and potential clients, know what the threats are and how vulnerable to them, they are. There’s a fine line between FUD and education. People don’t need to be scared into doing things, they need to be educated into it and they have every right to know what the threat landscape looks like, and how vulnerable they are to it.

What’s the Threat in 2025?

It is expected that in 2025, organisations can expect to face a variety of cyber threats, including AI-powered attacks (see https://hah2.co.uk/?s=Artificial+Intelligence), ransomware with complex extortion tactics (https://hah2.co.uk/?s=Ransomware), supply chain attacks (https://hah2.co.uk/?s=Supply+Chain), vulnerabilities in IoT and 5G networks, and the rise of deepfake technology. Cybercriminals are leveraging AI to automate attacks, develop advanced malware, and bypass traditional security measures. Additionally, ransomware attacks are becoming more sophisticated, with some now stealing data alongside encryption, increasing the pressure on victims to pay. Supply chain vulnerabilities are also a major concern, as attackers can target third-party vendors to gain access to larger networks. The increasing number of IoT devices (see https://hah2.co.uk/?s=IOT) many of which lack robust security, also presents a significant challenge, as they can be easily exploited for attacks that disrupt critical infrastructure. Deepfake technology is also becoming more accessible, making it easier for attackers to create realistic fake content for various malicious purposes.

How Does This Impact SMEs?

So where do SMEs sit in this space? There is still the perception amongst them that they are too small to be worth attacking, that the rewards for the cybercriminals aren’t enough and they won’t bother. Well, let’s debunk that. SMEs are seen as low hanging fruit. They will have much smaller budgets than the bigger players, they will almost certainly outsource their IT and as I’ve said often, you can outsource your IT, but not your responsibility. There is a dearth of cyber security expertise, not just within the SMEs themselves, but also amongst the IT outsourcers they use.

In 2025, it is anticipated that SMEs will face evolving cyber threats, including AI-powered phishing, ransomware, and supply chain vulnerabilities, along with insider threats and IoT exploits. AI is going to have a very real impact on the attacks designed against SMEs. Why? Because AI provides automation, and automation is the key to making real money when attacking SMEs. Think it through. If a criminal organisation can attack hundreds, if not thousands of targets using one automated attack, with an expectation of say 50% success, with extremely little effort using AI, then that’s good business for them. AI-driven attacks are predicted to be a top concern, with sophisticated phishing campaigns and deepfake fraud attempts on the rise. Ransomware continues to pose a significant risk, especially for SMEs with limited cybersecurity resources.

Supply Chain Security

Supply chain vulnerabilities are also a growing concern, as hackers can exploit connections with external vendors to breach multiple businesses. This latter should be a very real concern for any SME that is in the supply chain of a major organisation. Just imagine the consequences for that SME if their customer is attacked, losing money and reputation, and can pinpoint the attack as coming via the SME. How would that impact the SME? Well, the financial and reputational consequences would probably kill their business.

Ramsac, in their 2025 SME threat report, tells us that a mid-sized UK logistics company fell victim to a ransomware attack in June 2023. They infiltrated the company’s network and left a note on screens: “If you’re reading this, it means the internal infrastructure of your company is fully or partially dead.” The attackers had encrypted the firm’s files and threatened to leak confidential data, essentially holding the business hostage. They also reported that a large retail breach occurred when attackers compromised a small HVAC subcontractor (with far weaker IT security) and used those credentials to penetrate the larger corporate network. That attack led to the theft of millions of customer card details and tens of millions of dollars in damages – all traced back to a third-party SME vendor being hacked via a phishing email.

In Summary

We published a piece recently about cyber security and the SME and rather than repeat it here, we’ll simply give you the link – https://hah2.co.uk/cyber-security-and-the-sme/. It reiterates some of my hobby horses, chief amongst them being cyber awareness training. I’ve said before, but it bears repeating, that your staff are your first line of defence and are either your greatest asset, or your greatest risk. The actions you take as an owner/director/manager, will decide which.

SMEs are facing increased pressures on their resources and the temptation to park cyber security until times are better, increases alongside those pressures, but avoid complacency, let’s discuss what you might be able to do procedurally and at low cost. If you have invested in tech, is it the right tech and is it doing what you think it’s doing? That’s never a given.

Cyber Awareness Training