Ransomware, Phishing and other Malware

Cyber Awareness Training Data Breaches and their consequences Ransomware, Phishing and other Malware Security Tools

HOW DO HACKERS HACK?

I’ve posted this before but it’s worth repeating, and you’ll have to forgive me for a somewhat provocative title and allow me some poetic licence, because in fact, different hacking groups do things differently, although they have much in common.  Personally, I don’t like the term hacker, much preferring cybercriminal, because anyone who accesses a system without the owners’ permission, is by definition, a criminal.  But I suppose hacker is less of a mouthful.

What is Hacking?

Hacking involves exploiting vulnerabilities in systems, software, or networks to gain unauthorised access or manipulate data using a variety of techniques and methods, which tend to combine technical tactics and social engineering.

Profiling

One of the first things a hacker, or criminal group, will do, is to profile your organisation and your people.  Favourite open sources of information include:

  • Social media: Information about hobbies, job roles, family, and schedules shared on platforms like LinkedIn, Facebook, and Instagram.  Do you have a social media policy in your company?  Do you lay down what an employee can and cannot say about your company on their personal social media pages?  Do you have a designated person in the company who handles your company’s profile on social media?
  • Company Website:  You’ll want to give prospective clients contact information of course, but you should not give out individual email addresses and you should limit profiles published.  I do give my personal profile on my website but don’t give information about any other position, leaving it to a generic phone number and email address.
  • Professional Profiles: LinkedIn is a favourite for targeting businesses, as it provides details about an individual’s role, connections, and organisational structure.
  • Personal Websites or Blogs: These may reveal contact details, interests, or sensitive information inadvertently.  The same issues that appertain to social media apply here. 
  • Data Brokers: Cybercriminals can purchase detailed dossiers on individuals from data aggregator sites.

With all of these things you’re walking a bit of a tightrope.  You need to advertise and you need to provide potential customers with relevant information to allow them to contact you easily, but at the same time you need to be careful of what you give away.  Use generic email addresses and phone numbers and limit the information you give in profiles.

Phishing and Pretexting

Another favourite is phishing and pretexting.

  • Phishing Emails: We all know, or at least I hope we know, what phishing is.  Attackers send emails designed to extract more information, such as login credentials, by posing as a trusted entity.  In this context, it could be as simple as the attacker wanting to verify information by perhaps sending an email to a discovered address but wanting to confirm that individuals position in the company.  That just requires a response showing a signature block, so the phishing email might seem very innocuous.
  • Fake Surveys or Job Offers: These can be used to obtain detailed personal or professional data.

Favourite Reconnaissance Tools

Hackers don’t need an array of expensive tools to do their job, neither do they need to spend hours developing their own. There are a variety of reconnaissance tools used by attackers, including open-source intelligence (OSINT) tools, WHOIS lookups and scanning misconfigured systems using commercially available tools such as Nmap and Nessus, which identify open ports, services and weak configurations.  This is why it’s essential to regularly scan your network for these weaknesses.  Ports can be opened for a particular reason and never closed again.  It’s a common fault.

We are now seeing new models increasingly. In particular ransomware as a service (RaaS) is a cybercrime business model where  operators write software and affiliates pay to launch attacks using said software. Affiliates do not need to have technical skills of their own but rely on the technical skills of the operators. The “ransomware as a service” model is a criminal variation of the “software as a service” business model. This model allows small threat attackers to gain access to sophisticated ransomware tools at lower costs, also lowering the threshold of entry into cybercrime and complicating defenses against hacking.

Here at H2 we scan the dark web daily looking for leaked credentials, particularly email credentials.  When we on board a new client we nearly always get hits with sometimes up to 20+ compromised email addresses including passwords.  You might ask why they’d be on the dark web – simple, they are often up for sale on dark web marketplaces.

Psychological Profiling

In terms of cybercrime, who’s heard of psychological profiling?  Cybercriminals analyse:

  • Behavioural Patterns: Regularity in actions, such as times a person is online, financial habits, or common purchases.
  • Weaknesses and Triggers: Examples include a recent job loss, major life changes, or emotional vulnerabilities, which they exploit through spear-phishing or scams.

I’ve often argued on these pages, that your employees are both your first line of defence and your greatest weakness, and that a good cyber awareness programme is worth its weight in gold.  Cybercriminals often focus on employees in specific departments (like HR, finance, or IT).

  • LinkedIn and Organisation Charts: Identify individuals with access to sensitive data.
  • Impersonation: Pretending to be a senior executive to trick lower-level employees (e.g., through Business Email Compromise attacks – I’ve written about the CEO scam a lot).
  • Technical Probing: Use of phishing or malware to breach a target’s employer.

Conclusion

In conclusion, what I’ve tried to do here is give you a flavour of what you may be up against, and I hope, I’ve shown you that for all the reasons shown above technology comes last after people and process.  All the tech in the world won’t prevent issues arising from the above and is just one part of an integrated defence in depth required to prevent disaster.

Cyber Awareness Training Data Breaches and their consequences Ransomware, Phishing and other Malware

Frequency of Cyber-Attacks and their Effects

There is a lot of discussion around the number and effects of cyber-attacks in the UK and beyond.  There are those who believe that the instance is under reported, often because the organisation under attack is concerned about reputational damage and this can be a contributing factor to many paying up when subject to a ransomware attack.  And there are those who think the number of attacks is over estimated, especially in reports commissioned by vendors of cyber-security products, to scare up business.  Personally, I can see both arguments, but I tend to come down on the side of under reported.

The exact number of UK businesses failing solely due to cyber incidents is difficult to pinpoint, research indicates that a significant percentage of businesses have been impacted by cyber-attacks, and a substantial portion of those that are targeted end up closing down. Specifically, one study showed that 60% of small businesses close within six months of a cyber-attack. Furthermore, a recent report states that more than one in four UK businesses have experienced a cyber-attack in the past year.  The sources I used to put this together include:

  • Cyber security breaches survey 2024 – GOV.UK9 Apr 2024
  • Which UK
  • Raconteur







  • Simpson Wreford LLP








Note:  I did not use data from reports commissioned from Vendors.

Let’s take a closer look:

  • Prevalence of cyber-attacks:
  More than 25% of UK businesses have reported being hit by a cyber-attack in the past year.



  • Impact on small businesses:
  A concerning 60% of small businesses fail within six months of experiencing a cyber-attack. 





  • Factors contributing to business failure:
  Cyber-attacks can lead to financial losses, reputational damage, data breaches, and operational disruptions, all of which can severely impact a business’s ability to survive, especially small businesses. 





  • Business impact:
  The survey we mentioned highlighted that nearly three-quarters of business leaders believe a cybersecurity incident will disrupt their business in the next 12 to 24 months. 
  • Specific examples:  
In the past few months, major UK retailers like Marks and Spencer, the Co-operative Group, and Harrods have been targeted by cyberattacks as well as businesses that have now ceased trading, such as Knights of Old.

While these statistics highlight the severity of the issue, it’s important to note that cyber-attacks can be a contributing factor to business failure, rather than the sole cause. Other factors like poor management, economic downturns, or market competition can also play a role. However, the increasing sophistication and frequency of cyber threats make it crucial for businesses of all sizes to prioritise cybersecurity measures to mitigate risks and protect their operations. 

With my focus remaining with SMEs, it concerns me that SMEs of all sizes still do not prioritise cyber security other than putting a tick in the box, by, for example, obtaining certifications like cyber essentials.  Whilst this is a good thing and not to be dismissed, they are often doing this for marketing purposes rather than any commitment to cyber security which can mean that once the certification is obtained for a 12 month period, standards can then be let slip and I base this on obtaining the certification for a client, returning 12 months later, and finding many of the same issues recurring that we dealt with the year previous.

Cyber criminals target SMEs, don’t think that because an SME has smaller revenue and therefore smaller reward for the criminal, that they are immune.  SMEs are often targeted because they will have spent much less in terms of money and effort in protecting themselves against attacks.  They lack good advice and guidance, they can’t afford a full-time cyber security professionals and in fact, probably don’t need one full time, but they do not seek that vital guidance.  SMEs must understand that they are seen a low hanging fruit.

I’ve made this final point many times, and that is cyber awareness training.  Most cyber-attacks begin with some form of social engineering.  Your company will be profiled, and the attacker will obtain information from open sources such as companies house, your website and marketing, simple phone calls to obtain names and phone numbers etc.  Then comes the emails phishing for information or to plant malware on your systems.  The first line of defence here is always your employees, the more they know, the more they can protect your business.  Cyber Awareness training is not a nice to have, it’s essential and is the cheapest and quickest win you can make in your cyber defences.

Cyber Awareness Training Data Breaches and their consequences Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Supply Chain Security

The Effects of Downtime on Your Business Can Be Devastating

I’ve talked in the past about what SMEs really care about when it comes to cyber security.  Do they really care about the technicalities of an attack or scam?  Do they really care about the technical aspects of a piece of protective software or hardware?  My argument is that they neither need nor want to know how this stuff works.  What they do want to know can be summed up pretty easily.

  1. How vulnerable are they to an attack and/or scam?
  2. What would be the effects if that attack or scam succeeded?
  3. What can they do about it, and how much will it cost them?

I wrote mostly about points a and c in a blog earlier in the year, https://hah2.co.uk/what-do-sme-owners-and-directors-want-from-cyber-security/, and I’ve included the link if you want to read it.  This time I’m concentrating on point b and the effects of the downtime that it creates.

Downtime following a cyberattack can have serious consequences for businesses, and individuals. We can categorise these into several key areas:

  1. Financial Costs
  • Lost Revenue: For e-commerce platforms, financial institutions, or other time-sensitive industries, downtime directly results in revenue losses.  All businesses will suffer some degree of revenue loss if they can’t carry out their business because their access to suppliers, customers and operations are seriously curtailed.
  • Operational Costs: Companies may need to pay overtime to staff to keep the business going manually without access to IT, hire external cybersecurity experts, or invest in replacement hardware or software.
  • Regulatory Fines: Non-compliance with regulations like GDPR or industry focused standards, due to downtime or data breaches can lead to significant fines.
  • Damage to Reputation
  • Loss of Customer Trust: Downtime can erode confidence, especially if sensitive customer data is exposed or if services are unavailable for extended periods.
  • Brand Damage: Affected organisations may face negative publicity, making it harder to attract and retain customers or partners.
  •  Operational Disruption
  • Service Outages: Critical systems might be offline, affecting production lines, supply chains, or essential services.
    • Loss of Productivity: Employees unable to access IT systems are effectively idle, causing delays in work and project completion.

Note:  Points d and c were what essentially led to the collapse of Knights of Old.  When they were hit with a ransomware attack which took out their IT systems, they were unable to fulfil time sensitive orders which led to the cancellation of those orders, damaging their brand and seriously impacting customer trust.  They never recovered and are now out of business.

  • Data Loss
  • Corruption or Deletion: Cyberattacks like ransomware can encrypt, leak or destroy critical data, which may take days or weeks to recover, even with backups.
  • Intellectual Property Theft: If attackers steal proprietary information, it can be sold to competitors or leaked online.
  • Security Gap
  • Exploitation of Vulnerabilities: Downtime often exposes weak points in an organisation’s infrastructure, which may need to be patched or rebuilt.
  • Increased Risk of Future Attacks: Downtime may signal to attackers that the organisation is a viable target.
  •  Legal and Regulatory Implications
  • Breach of Contract: Failure to meet service-level agreements (SLAs) due to downtime can result in legal action from customers or partners.
  • Insurance Implications: Cyber insurance claims may be denied if the company failed to follow adequate preventative measures.
  •  Psychological and Social Impact
  • Employee Stress: Staff may feel pressured to resolve issues quickly, leading to burnout.
  • Customer Frustration: Extended downtime can alienate loyal customers, particularly in industries where continuity is critical, such as healthcare or finance.
  •  Broader Economic and Societal Impacts
  • Supply Chain Disruption: Downtime in one organisation can ripple through its partners, affecting entire supply chains.
    • Critical Infrastructure Risks: Attacks on essential services like utilities or healthcare systems can have life-threatening consequences.

I have blogged many times about the mitigation strategies you can take, that don’t need to break the bank, but the bottom line, proactive measures can significantly reduce the impact of cyberattacks and the associated downtime.  Understand your vulnerabilities and threats, base your spend on protecting against those threats, starting with the most serious, and then working down.  Don’t try and get to 100% security, it doesn’t exist, so understand what risks you find acceptable and what risks you don’t.

Cyber Awareness Training Data Breaches and their consequences Identity and Access Management Ransomware, Phishing and other Malware Security Security Tools

PROACTIVE CYBER SECURITY

Proactive security, protective monitoring, security operations – all pretty much means the same thing in terms of cyber, at least in the corporate world and the larger, more sensitive Government organisations.  I’ve been involved with the design and commissioning of security operations centres for a long time.  I designed the first for the FCO, under contract to HP, ran the security team for the Identity and Passport Service which included a security operations centre, amongst others.  But the one thing I knew, was that it was too complex and expensive for an SME, even though it would bring them great benefits.

I’ve been talking and posting a lot recently about this subject because I think it’s extremely important and hasn’t, in the past, resonated with SME owners and management simply because it was considered by many to be purely in the province of the corporate world and was way too expensive for an SME to even consider.  Well, that cost issue is no longer the case and there is a system, which we use to provide a managed service for SMEs, that is very affordable.  So that leaves us to consider whether it is something that an SME would consider as an essential element of their cyber defences, now that it is affordable.

Typically, an SME would generally want such a solution that balances strong security coverage with affordability, simplicity, and minimal disruption to daily operations.  Here’s what I think they would like to include if they could afford it.

  1. Comprehensive Threat Visibility
  • Log collection from key systems (servers, endpoints, cloud services, firewalls, applications).
  • Real-time monitoring for suspicious activities (e.g., failed logins, privilege escalation, data exfiltration).
  • Ability to spot both external attacks (phishing, malware) and insider threats.
  • Actionable Alerts, Not Noise
  • Intelligent alert prioritisation to avoid alert fatigue.
    • Context-rich notifications so the SME knows what happened, why it matters, and what to do next.
    • Possibly AI-driven correlation of events to detect patterns.
  •  Ease of Use & Low Overhead
  • Simple dashboards that non-experts can navigate, or more likely, a managed service as an SME will have little or no resource to give to this.
  • Minimal in-house expertise required to operate.
  • Fast onboarding and configuration.
  •  Reporting
  • Reports that are east to read, management focused and not full of jargon.
  • Audit trails for investigations.
  • Incident Response Integration
  • Clear escalation paths (automated and manual).
  • Integration with existing tools (ticketing systems, email, Slack/Teams).
  • Ability to block malicious IPs or disable compromised accounts quickly.
  • Affordability & Scalability
  • Pricing that fits SME budgets (no enterprise-only costs).
  • Scales up with business growth without a full rip-and-replace.
  • Easy and flexible deployment.
  • Coverage regardless of where your staff work, in the office, remote or on the move.
  • Resilience & Reliability
  • Works even if parts of the infrastructure are down.
  • Secure storage and backup of monitoring data.
  • Regular updates to threat detection rules.

In short: An SME doesn’t just want raw data — they want reassurance, clarity, and quick guidance so they can protect their systems without hiring a large security team.  And that’s what we are offering, assurance.  There’s no such thing as 100% security, so if you’re looking for that, then we can’t help you.  Using this system our managed service plays the percentages by monitoring your defences, telling you in no uncertain terms where your defences aren’t up to the job, alerting you to problems and providing advice and guidance on how to fix stuff.

So, what exactly are we offering.  Well, it’s a 24/7 service which provides a manned interface between you and us, on the end of the phone or by email in working hours, and an automated response service in silent hours.  Doing it that way you don’t have to pay for expensive night shifts.  The staff on duty don’t just monitor your systems but provide advice and guidance as well, giving you a cyber security resource on tap.

Specifically, we are covering off:

Email Security – Stay ahead of potential email threats with our user-friendly, API-based active protection.

Endpoint Security – Safeguard laptops and desktops against cyber threats like malware and ransomware.

Cloud Data – Enable cloud data protection for secure collaboration with external users.

Secure Browsing – Keep your browser secure with a provided extension, protecting you from viruses and malicious sites.

Awareness Training – Empower employees to be the first line of defence against the ever-evolving landscape of cyber threats.

Phishing Simulation – Regularly simulate cyber-attacks, including phishing emails, to identify vulnerabilities and educate staff to the dangers of Phishing.

External Risk – Obtain actionable insights on external threats by scanning your digital footprint and exposed vulnerabilities. This includes regular scanning of the dark web looking for compromised email addresses and credentials.

Insurance – Mitigate the cyber risk associated with evolving threats through tailored coverage at the right price (optional; aligning your premiums with your security posture can lower those costs).

Here are some questions to ask yourself and if you answer yes to most of them, then you might be a fit for this service:

  • Do you employ around 1-250 staff members?
  • Does falling victim to cybercrime worry you?
  • Could you continue to operate your business without your IT systems?
  • Is a recent cyber scan of your public domain on your radar?
  • Are you aware of the constantly evolving cyber threats and tactics?
  • Does your business need protection against these advancing cyber threats?
  • Are you looking for coverage under a cyber insurance policy?

Keep your eye out for a webinar that we will shortly be doing which will provide a full demo of the system, or if you prefer, contact us and we will give you a one-to-one demo, with no obligation.  You can follow this with a totally free 14-day trial covering your whole estate, again with no obligation.

If you wanted this system, you might still think it’s too expensive for you, well, it’s only £14 per user per month, so if you only have 10 IT users amongst your staff, that would be £140 per month on a rolling 30-day contract i.e. you can quit with just 30 days’ notice.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Working Practices

Scams v Hacks

We hear a lot about the consequences of cyber-attacks and data breaches but not a lot about the specific threats against SMEs, rather than the generic threats against all businesses.  In general businesses are more likely to be targeted by scammers (social engineering attacks) than by purely technical attacks.  But why?  Attacks against individual SMEs are not going to bring in a lot of profit for the criminal, so they often go after multiple targets all at once.  How they do that is to craft an attack which can be automated and directed at many SMEs all at once.  The easiest way to do that is via a social engineering attack.  Let’s take a look at what we mean by that.

Scams and social engineering attacks rely heavily on human error.  Not only do SMEs have weaker defences than their corporate cousins, but they spend little, if anything, on cyber awareness training.  The attack that brought down Knights of Old, reducing a once thriving business to bankruptcy in a frighteningly short time, was the result of a weak password being cracked.  That suggests that OK, a stronger password protocol and the use of MFA would have been of great benefit but so would educating the users about social engineering and how they can protect the company and their jobs.

Typically, we see:

  • Phishing emails that trick employees into giving credentials or downloading malware.
  • Business email compromise (BEC) — attackers impersonate executives to request bank transfers or the immediate payment of an invoice.
  • Fake invoices or supplier fraud.

It’s done this way simply because it’s easier and cheaper to execute than a technical attack.  It’s scalable with scammers sending thousands of phishing emails, and it often bypasses technical defences by exploiting people directly.

In addition to the traditional attacks, we are now facing AI generated attacks, enabling criminals to design scams that are even more scalable and to be produced more quickly.  Some examples include:

Deepfake CEO Fraud (AI-Generated Voice or Video)

A finance employee receives a video call from someone who appears to be the CEO instructing them to urgently transfer funds to a supplier. The video and voice are AI-generated deepfakes using real footage and voice samples taken from public online sources.  This has happened in the UK causing a UK based firm to lose over £20m in early 2025.  Obviously not an SME but the attack was not difficult to generate.

Another AI attack was an upscale of the Business Email Compromise:

Criminals use AI to monitor and mimic email communication styles. They craft perfectly worded emails from a company executive asking the accounting team to update supplier bank details or pay fake invoices.  What is new in 2025 is that AI now personalises these scams based on internal speech patterns and tone scraped from Slack or Teams (when credentials are compromised and that list is not exhaustive – other online messaging systems are available).

One scam that we are now seeing more of is the fake job applicant scam targeting HR departments and IT onboarding teams.  Scammers apply for remote jobs using fake CVs and AI-generated video interviews. Once hired, they gain access to internal systems and exfiltrate data or install malware.  They’re playing the long game here, but it can really pay off.

There are lots of examples and I’ll just put in a couple more:

How many of you use Software as a Service (SaaS) and pay a subscription? In this case a fake renewal notice is sent for services like Microsoft 365, Zoom, or Slack. The email contains a link to a spoofed portal, which steals company admin credentials when they try to “log in.”   A new twist in 2025 is that the phishing emails are personalised with real invoice numbers and recent usage data scraped from prior breaches.

Most of you are probably on LinkedIn, even if you are not particularly active on there.  We are now seeing more of the LinkedIn Clone Attack.  What happens here is that the scammers clone the LinkedIn profile of a known business leader and use it to reach out to employees or partners, proposing urgent collaborations or investment opportunities that include malicious links.  In a more advanced tactic, they use AI-generated responses in real-time chats that make these accounts seem very real.

So, in conclusion, whilst we cannot rule out the more technical attack on an SME, we can say that the most likely attack will come via some sort of scam, often nowadays using AI.  The defences need to be in depth and will include some technical defences but often the best defence against social engineering is cyber awareness training and this is generally ignored by SMEs.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Risk Analysis and Security Strategy

Ransomware – The Threat That Keeps On Giving


I know I’ve banged on about this quite a bit recently, but I make no apologies for it.  It has sprung to the front again following the Panorama programme on Monday night which highlighted the often catastrophic effects of ransomware on companies, and had interviews with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA), with an NCA rep saying that 2025 is shaping up to be the worst year ever for ransomware and the CEO of NSCS calling on businesses to face up to the issue and sort out their cyber defences.

The programme highlighted that Ransomware as a Service (RaaS) now enables less skilled attackers to run ransomware, complete with support and updates. Over 70% of attacks now use these services.
 
Attackers have shifted to double/triple extortion schemes, encrypting data, threatening to leak it, and sometimes targeting associated partners or customers. Next-gen ransomware, e.g. LockBit 4.0, BianLian etc, is rolling out advanced stealth, data theft, and automated lateral movement techniques, using an initial breach to jump across to other parts of your network or that of your partners and customers.
 
You’ll have to forgive me for being a bit smug as the programme highlighted issues that I’ve been talking about for a long time now.  Firstly, it’s not just the corporates that are targets for this.  SMEs are also very much in the firing line.  The programme highlighted an example I’ve quoted before.  Knight of Old (part of the KNP Logistics Group) suffered consequences that they just couldn’t recover from.

In June 2023, the Akira ransomware gang infiltrated the company via stolen credentials and encrypted critical systems, including freight-tracking, payments, and internal servers, displaying this chilling message:
 
“If you’re reading this, it means the internal infrastructure of your company is fully or partially dead.” 
 
The group also threatened to release over 10,000 confidential documents (payroll, invoices, financial files) as a form of double extortion. Despite having cyber insurance and backups, they couldn’t fully restore financial systems, and some backups were also destroyed.  Insurers covered only the initial cleanup (~£250k) and $1M policy, but this fell far short of covering the estimated $2.7–$5.3 million ransom or the broader economic damage.  Operational disruption prevented them from producing reports and financial statements, essential for securing bank funding. A sale fell through, as buyers wanted director guarantees they couldn’t offer.
 
The company entered administration in September 2023 and ceased operations.  Around 730 out of 900 employees lost their jobs, including many long-serving drivers and staff who were owed unpaid wages.  Local impact was severe: furloughed staff lost homes, cars, and some experienced severe personal hardship.
 
It appears that the attack was perpetrated via a weak password and the absence of multi-factor authentication (MFA), with the gang using a brute force method to crack the password.  It underscores the fact that even companies with cyber insurance and accredited systems are vulnerable.
 
Obviously, we’re not party to the full facts but the company’s directors have been quite candid in interview, and we have to wonder if something as simple as good cyber awareness training and the introduction of MFA could have stopped this attack in its tracks.  There are other factors to consider though.  The backups seemed to have failed, with some of them being destroyed by the attack, suggesting that these backups were on the same network as the main system.
 
Clearly what is needed is defence in depth, based on the tried and tested method of risk management.  The idea of defence in depth stems from military defences, where there are multiple layers to a defensive system.  In cyber security we talk about People, Process and then Technology.  I’ll once again trot out the quote from Bruce Schneier, ‘If you think technology will solve your cyber security problem, you don’t understand the problem and you don’t understand the technology’.  This aligns very well with the opinion of both NCSC and NCA that the majority of these attacks are more in line with scams than with technical hacking.
 
Rather than bore you with the components of risk management in cyber, I’ll just point you towards a short video we produced on the subject.
 
Risk Management – a short video
 
We produced another video which highlights social engineering.  That is the method by which much of these attacks are undertaken which are not particularly technical in nature.  It’s the People part of the risk management process and is arguably the quickest and cheapest win any company can take.  It’s a continual source of wonder amongst cyber security professionals that a large focus remains on technology whilst ignoring this vital element.  Our short video tries to hit the highlights but in this changing landscape, we haven’t hit them all.
 
Social Engineering – A Short Video
 
The takeaway from this should be that no one is safe or immune from a ransomware attack, particularly ransomware as a service.  This latter means that the attacker doesn’t need to be technically proficient, just determined.  It enables attackers to target multiple companies at once.  If they, for instance, attack 1000 companies at the same time, using the same service, and ask for moderate amounts of ransom, they only need to hit around a 40-50% success rate to make a decent profit.  Add in AI which makes this so much easier to do, and you’ve got an idea of how much of a business this is for criminal and nation state sponsored gangs.

Cyber Awareness Training Data Breaches and their consequences General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy Security Tools Supply Chain Security Working Practices

Do CISOs have a role in the Small to Medium Enterprise?

A Chief Information Security Officer or CISO, is a post you almost never find in an SME, even those at the top end of that sector.   This has contributed to the growth of what is known as fractional appointments i.e. appointments that are not full time with the incumbents often taking roles in more than one organisation, thus the term Fractional.

 Anyone taking any role in an SME management team will need to be pragmatic, practical and bring cost effectiveness to their discipline.  The CISO role is no different and is all about managing risk, enabling the business and ensuring trust in a very cost sensitive environment.

The CISO can play a crucial role in an SME by ensuring that the organisation’s information and data assets are secure. While the CISO role in a large corporation may be more siloed or focused on strategy, in an SME the CISO often wears multiple hats, balancing strategy, operations, and hands-on technical work.

Challenges Unique to SMEs

I’ve often talked about the challenges that SMEs face, focusing as I do on cyber security.  Let’s just have a quick recap looking at where the CISO fits in with these unique challenges.

  • Limited budget and staff: This is the main reason why SMEs will not employ a full time CISO, they simply can’t afford it.  The other being that an SME probably doesn’t require a full-time resource anyway.  Because of this lack of resource the CISO may also act as a hands-on security engineer or IT lead, perhaps liaising with a contracted IT outsourcer.
  • Lack of security culture: Many SMEs don’t prioritise security until after a breach.  The CISO will be able to raise awareness and provide advice and guidance before the fact.
  • Rapid growth and change: Scaling securely is a key challenge as SMEs expand and there are often gaps left because of overlooking the need to embed security at the design stage.  The CISO can plug that gap.

Let’s take a look at the potential elements of a job description for the role of a CISO, or a Fractional CISO, in an SME.  Of course, these may not fit everyone and it’s more of a menu for SMEs to choose from:

  1. Developing and Leading the Cybersecurity Strategy
  2. Define the overall information security roadmap aligned with the SME’s business goals.
  3. Balance security with business agility, in other words making sure security does not get in the way of business and keeping in mind budget constraints typical in SMEs.
  4. Ensure the strategy addresses risk management, compliance, and data protection.
  • Risk Management and Assessment
  • Identify and assess cyber risks relevant to the SME (e.g., phishing, ransomware, insider threats).
  • Conduct regular vulnerability assessments and penetration tests.
  • Prioritise risks based on business impact and likelihood.
  • Policy and Compliance Management
  • Develop and enforce security policies, standards, and procedures.
  • Ensure compliance with relevant regulations (e.g., GDPR, PCI-DSS etc depending on industry).
  • Prepare for audits and provide documentation to demonstrate compliance.
  • Security Awareness and Training
  • Conduct regular security awareness training for employees.
  • Create a culture of security by promoting best practices (e.g., strong passwords, phishing awareness).
  • Incident Response and Business Continuity
  • Develop and maintain an incident response plan.
  • Lead the response to security breaches and minimise damage.
  • Ensure business continuity and disaster recovery plans are in place and tested.
  • Technology Oversight and Vendor Management
  • Evaluate and implement cybersecurity tools (e.g., firewalls, endpoint protection etc).
  • Manage relationships with third-party vendors, especially cloud providers and MSSPs.
  • Ensure that vendors comply with the SME’s security requirements.
  • Ensure the SME itself is not in conflict with any security requirements of larger organisations if it is in that organisations supply chain.
  • Board and Executive Communication
  • Translate technical risks into business language for senior management.
  • Report regularly on security posture, incidents, and needs.
  • Advocate for security budget and resources in line with organisational risk appetite.

I hope that gives a feel as to why an SME might want to consider a Fractional CISO or Board Advisor.  Cyber-attacks are becoming more sophisticated, faster and harder to repel.  It is no longer just the corporates who are in the firing line.  Modern, often AI driven attacks have put everyone in the sights of the modern cyber-criminal and even from those criminal organisations that are nation state funded.  It’s never been more crucial to have professional advice and guidance on tap.

Cyber Awareness Training General Security Issues Ransomware, Phishing and other Malware Risk Analysis and Security Strategy

How Should SMEs View Cyber Security?

We experience a quite varied attitude amongst SMEs to cyber security.  There is still a prevalent view that they are not really a target because they’re not worth it, and we’ve commented again and again that this is simply not so.  SMEs are considered low hanging fruit amongst cyber criminals simply because they tend to have weaker defences and don’t have easy access to the right levels of advice and guidance.

Good cyber defences can be seen in a similar light to insurance.  Whilst you hope that you’ll never need it, you understand that it’s safer to have it and in turn, the insurance company will require you to meet certain requirements for your policy to remain extant.

100% protection against an attack is simply not possible and no responsible cyber security company will guarantee that.  But we do try and empower businesses by forging intelligent defences to protect them in an ever-evolving threat landscape, being made more dangerous as criminals adopt AI in greater numbers.

SMEs face many of the same cybersecurity threats as large organisations, but they are often more vulnerable due to limited resources, staff, and awareness. So far it’s being reported that the biggest cybersecurity threats to SMEs in 2025 include:

  1. Phishing & Social Engineering
  • What it is: Deceptive emails, texts, or calls that trick employees into revealing credentials or installing malware.
  • Why it matters for SMEs: They often have no formal training or tools to detect phishing. A single click can lead to a major breach.
  • Ransomware Attacks
  • What it is: Malware that encrypts data and demands a ransom for decryption.
  • Why SMEs are targets: They’re seen as “soft” targets, less likely to have backups or strong defences, more likely to pay.
  • Business Email Compromise (BEC)
  • What it is: Fraudsters impersonate executives or vendors to trick employees into sending money or sensitive data.  Traditionally done by email spoofing, now increasingly being done by AI impersonation.
  • Why it’s dangerous: BEC is low-tech but high impact, no malware, just manipulation. Losses can be substantial.
  • Poor Password Hygiene
  • Common issues: Weak, reused, or shared passwords; lack of multi-factor authentication (MFA).
  • Impact: Credential stuffing and brute-force attacks are easy ways into SME systems.
  • Unpatched Software & Systems
  • What it is: Outdated software with known vulnerabilities.
  • Why it happens: SMEs often delay updates due to compatibility fears or lack of IT resources.
  • Real threat: Attackers automate the search for these flaws.
  • Supply Chain Attacks
  • What it is: Attackers target less secure vendors or partners to infiltrate your network.
  • Relevance: SMEs often rely on third-party services (e.g. MSPs, cloud tools), but don’t vet their security rigorously.  Check their Ts&Cs, what are they responsible for and what are you responsible for?  This is becoming a big issue amongst those with critical supply chains of which SMEs may be a part.
  • Insider Threats (Malicious or Accidental)
  • Malicious: Disgruntled employees stealing or sabotaging data.
  • Accidental: Well-meaning staff misconfiguring systems or clicking unsafe links.
  • Problem: SMEs rarely have monitoring tools in place to catch insider issues early.
  • Insecure Remote Work Infrastructure
  • Examples: Unsecured Wi-Fi, lack of VPNs, personal device use (BYOD).
  • Why it’s risky: Many SMEs embraced remote/hybrid work without upgrading their security posture.
  1. Lack of Cybersecurity Training
  • Result: Employees don’t recognise threats or understand basic security practices.
  • Impact: Human error is still a major cause of breaches.  Cyber Awareness Training is arguably the biggest and cheapest quick win an employer can take.
  • Cloud Misconfigurations
  • Common mistake: Leaving cloud storage exposed to the internet.
  • Why it happens: SMEs may lack specialised cloud knowledge or rely on default settings.  Check with your supplier.
  • Bonus: AI-Powered Attacks
  • Emerging trend: Attackers use generative AI to craft more convincing phishing emails, deepfakes, and automated reconnaissance. Check out our earlier blog on this subject (An increase in sophistication of cyber-attacks).
  • Why SMEs should care: These tools lower the barrier for attackers and increase the success rate of scams.

What practical advice would we have for SMEs?  Obviously, that depends on the SME, their vertical, how they operate etc.  But generally:

  1. Enable MFA everywhere.
  2. Train staff regularly.
  3. Keep software up to date.
  4. Back up data (and test recovery).
  5. Use endpoint protection.
  6. Identify where all your sensitive data resides.
  7. Investigate protective monitoring services.
  8. Investigate Cyber Security Insurance.
  9. Hire or consult a cybersecurity professional, even part-time.

Data Breaches and their consequences General Security Issues Identity and Access Management Ransomware, Phishing and other Malware Supply Chain Security

An Increase in sophistication in cyber-attacks in 2025

There is a lot of discussion about AI, it’s benefits to society in general and its undoubted downside.  It’s a fascinating subject and AI can really become the gift that keeps on giving, but a downside for those of us concerned with cyber security, and really that should be all of us, is that we’ve always played catch up to the cyber criminals, trying and often failing to anticipate what the next attack will be, what the next series of attacks will be.  Will it be ransomware, denial of service or perhaps a new and more sophisticated scam?  Who knows?  And there is no doubt that AI is raising the bar.

I have talked a lot about the re-emergence of the script kiddie and how AI in enabling this breed of wannabe criminals.  For those who maybe don’t now, a script kiddie was a low level, part skilled hacker, who downloaded scripts from the dark web, put there by the more competent hacker who hoped to sell them.  The script kiddie would use those scripts to try and attack targets.  But it’s also true that the more skilled and sophisticated criminal is making use of AI and finding new and innovative ways of relieving you of your hard-earned cash.

What we are seeing in 2025 is an era where cyber‑attacks are AI‑powered, highly targeted, automated, supply‑chain enabled, multi‑stage, and geopolitically driven. These attacks exploit weaknesses across credential systems, zero‑day exploits, deepfake tools, and ransomware as a service (RaaS) platforms.

We are in an accelerating digital arms race that calls for AI‑driven defence capabilities, real‑time insights, deception environments, zero‑trust architectures, and quantum‑safe cryptography.

a. AI-powered precision and scale

  • Cybercriminals are leveraging AI to automate vulnerability scans at astonishing speeds, up to 36,000 scans per second, resulting in massive volumes of stolen credentials (1.7 billion) and drastic upticks in targeted attacks.
  • AI is also generating hyper-realistic phishing messages, deepfake audio/video, and even “CEO fraud” to manipulate individuals into transferring funds, like a deepfake trick that siphoned US $25 M in Hong Kong.

b. Ransomware as a Service (RaaS) 3.0

  • RaaS platforms now enable less skilled attackers to run ransomware, complete with support and updates. Over 70% of attacks now use these services.
  • Attackers have shifted to double/triple extortion schemes, encrypting data, threatening to leak it, and sometimes targeting associated partners or customers.
  • Next-gen ransomware, e.g. LockBit 4.0, BianLian etc, is rolling out advanced stealth, data theft, and automated lateral movement techniques, ie using an initial breach to jump across to other parts of your network or that of your partners and customers.

c. Supply‑chain & third‑party infiltration

  • Attacks starting via third-party software or vendors (e.g., SolarWinds-style) allow hackers to move laterally into networks and compromise multiple organisations simultaneously.

d. State‑sponsored & geopolitical cyber warfare

  • Nation-states (China, Russia, Iran, North Korea) are not just using espionage but now partnering with ransomware gangs to conduct financially and politically motivated operations.
  • Iranian state-aligned hackers are conducting sophisticated credential theft, MFA bypass, lateral infiltration, DDoS, website defacements, and disinformation across geographies.

e.  Zero‑days and living‑off‑the‑land

  • Exploit kits now rapidly find zero-day vulnerabilities, especially in cloud environments, to bypass patching cycles.
  • Attackers increasingly use built-in legitimate software and system tools (living off the land) to evade detection.

f.  Credential theft resurgence

  • Reported credential theft incidents rose 300% from 2023 to 2024, with 25% of malware focused on stealing login data.
  • These stolen credentials are a gateway for automated brute‑force, lateral movements, and supply‑chain infiltration.

g.  Targeting of IoT, OT & mobile platforms

  • Millions of IoT and OT systems (from manufacturing to agriculture) remain insecure and are now common targets of AI‑driven automated attacks.
  • Mobile‑specific ransomware is emerging; threat actors are developing malware to extort victims directly via their mobile devices.

h.  Rise of deception technology and defence adaptability

  • In response, organisations are deploying deception tech (honeypots, decoys) to detect lateral intrusions or zero-day exploits in real time.
  • Proactive threat intelligence, zero‑trust frameworks, AI‑driven detection, and adoption of post‑quantum cryptography are becoming critical defensive measures.

SMEs still have the mind-set that these attacks are just about the corporate sector and that they are safe because they are small and not worth targeting.  Wrong.  SMEs are considered low hanging fruit because they typically spend much less on their defences and tend not to have access to the right levels of support and advice.  SMEs make up over 90% of the UK GDP, that’s huge and it makes them worth attacking if, for example, a nation state wanted to cripple the UK economy.  AI automation makes this much easier to achieve and attackers at all levels can leverage AI to automate attacks against multiple SMEs at the same time using the same methods.  If they attack 1000 SMEs at once, and get a 50% hit rate, that is good business for them.

We are seeing AI letting attackers scan thousands of targets at once, deploy malware bots and use brute force tools.  They are automating phishing and social engineering allowing them to deepfake audio and video, using cloned voices to mimic senior personnel in companies.  Don’t be lulled into a false sense of security, AI makes this a relatively easy thing to do, doesn’t take high levels of skill, and is highly automated.

There is a real fear that traditional firewalls and spam filters used by most SMEs may fail to detect these advanced threats.

In summary AI-driven cyberattacks pose a significant and growing threat to small and medium-sized enterprises (SMEs). While larger corporations may have the resources to defend themselves, SMEs are often more vulnerable due to limited cybersecurity budgets, staffing, and expertise.

Cyber Awareness Training Data Breaches and their consequences Ransomware, Phishing and other Malware Security

Protective Monitoring for SMEs

Security operations is a complex subject and there is no doubt that it can be expensive and difficult, even for corporate organisations who generally have the resource, both financial and technical, to run a security operations centre (SOC), or at least can afford to outsource.  I saw an RFP from a housing society for a SOC and I would be very interested to see if that contract gets let once the organisation gets the quotes, because I would be shocked if they could afford it.

Their RFP based its premise on the introduction of a Security Information and Event Management system (SIEM), which.in itself, might suggest that they don’t really know what they are asking for, or indeed, what they want.  I base this on having designed, built and operated several such operations centres in the past.

Now before the SIEM vendors and resellers pile on, let’s be clear, SIEM systems have their place and are very useful in a SOC, although I would argue that they are most certainly not the end all and be all.  My focus these days is on SMEs and for an SME there are several reasons why a SOC and an SIEM may be over the top and a cost too far.

Whilst an SIEM system is a valuable tool for cybersecurity, it comes with several drawbacks, including:

a. High Cost

  • Expensive Implementation – SIEM systems require significant upfront costs for software, hardware, and licensing.
  • Ongoing Costs – Maintenance, updates, and skilled personnel add to long-term expenses.

b. Complex Deployment and Management

  • Difficult Configuration – Setting up a SIEM system to work effectively requires extensive tuning and integration with various security tools.
  • Frequent Fine-Tuning – To avoid false positives and negatives, organisations must continuously refine alert rules and correlation policies.

c. High Volume of Alerts and False Positives

  • Alert Fatigue – SIEM systems generate numerous alerts, many of which are false positives, overwhelming security teams.
  • Difficult Prioritisation – It can be challenging to distinguish between critical threats and routine events without proper tuning.

d. Scalability Issues

  • Performance Bottlenecks – As an organisation grows, more logs and data sources can slow down the system.
  • Expensive Scaling – Scaling a SIEM to handle increasing data volumes often requires costly upgrades.

e. Need for Skilled Personnel

  • Expertise Required – SIEM systems need cybersecurity professionals to manage, analyse, and fine-tune them effectively.
  • Shortage of Talent – Finding skilled SIEM analysts can be challenging and expensive.

f. Storage and Compliance Challenges

  • Log Retention Costs – Storing large volumes of logs for compliance can be expensive.
  • Regulatory Complexity – Ensuring compliance with data protection laws (e.g., GDPR) requires careful log management.

h. Limited Threat Detection Without AI/Automation

  • Reactive Approach – Many traditional SIEMs rely on pre-set rules, making them less effective against new or sophisticated threats.
  • Lack of Automation – Without AI-driven analytics, manual investigation can be time-consuming.

Having debunked the usefulness of an SIEM system for an SME, let’s look at what an SME could do to mitigate their cyber risks.

A good cyber security strategy has always been founded upon strength in depth.  Sound security architecture, good cyber awareness training, solid access control and identity management, and the ability to protectively monitor your estate for threats, vulnerabilities, and risks. 

If you are not monitoring the effectiveness of the protections, you have spent good money on, how do you know it’s money well spent?  Are those protections doing what you think they are.  Monitoring is central to the identification and detection of threats to your business. It acts as your eyes and ears when detecting and recovering from security incidents and it enables you to ensure that devices are used in accordance with your organisational policies.

Many small to medium-sized businesses struggle with stretched resources, lean budgets, and a critical technical expertise gap. This fight against sophisticated cyber threats and outdated systems turns them into easy targets for cybercriminals. Exposed and at risk, these businesses stagger on the edge of significant disruption, financial loss, and reputational damage.  Although on the surface an SIEM system might seem to be what an SME needs, it would not fit the profile of most SMEs, being too resource intensive and costly.

We have been researching the market, looking for a way of providing a security managed service that would serve an SME, at an affordable price.  And we think we’ve found it – no, we are SURE we have found it.  Simplicity is at its core, employing enterprise-grade technology to simplify and streamline the day-to-day work. Our unified platform and onboarding process, seamlessly detects, prevents, and responds to cyber threats in the most holistic, hassle-free, and cost-effective way.

We are offering a 14 day free trial and will cover:

  1. Email security.
  2. Cloud data.
  3. Automated cyber awareness training.
  4. External risk.
  5. Endpoint security.
  6. Secure browsing.
  7. Phishing simulation.
  8. And as an added bonus we can provide cyber insurance at a price which is directly linked to your risk score within or system.  The lower your risk, the cheaper the insurance.

This system is deliberately aimed at 1-250 IT users in your business.  Most SMEs come in around 10 to 15 IT users, but we’re not precious about it.  It is a managed service, and we have our eyes on the glass and can mitigate your risks in concert with our clients providing advice, guidance and remediation as part of the service.  All this for a mere £12 per user per month.

Check it out at the link below.

Cyber Security: why do I need protective monitoring?
Scroll to top