How are businesses improved through good cyber security?  It’s a question just about every customer, or prospective customer, of ours asks themselves.  They need to see a return on investment, after all, if you don’t see anything tangible for your money, you’re unlikely to keep going down that road.

When my business partner and I set up H2 after we returned from the Middle East where we’d been working for the HP division that was busy merging itself with CSC (been there done that, didn’t fancy returning to it), the whole question of how we could offer something that gave that return on investment, occupied much of our thinking.  What services could we offer at a price that businesses were prepared to pay, and what tangible benefits could we offer?

At first, we were purely a services company, proudly product agnostic, recommending the right products for the right solutions for the right customer.  Not at all altruistic, but rather we felt that was the right thing to do be doing.  Like many people we didn’t see COVID coming around the corner like a freight train.  The pandemic didn’t just change how we would be delivering our services, it changed the whole market, it changed working practices, which are still evolving.  That meant that we had to change or die.  A stark choice but not one that could be avoided or put off.  Like many businesses we had to reengineer the business from the ground up whilst still providing services that customers wanted and could see a need for.

An interesting google search is finding out what businesses are researching online.  I was quite surprised to find that the question ‘what is a cyber-attack?’, is the most searched phrase, by a long shot.  This suggests that many are still confused as to what a cyber-attack actually is.  Breaking that down, its probably not all that surprising because of all the various types of cyber-attack that are constantly being rammed down peoples’ throats and I think the cyber security industry needs to take responsibility for that.  There’s a big difference between education and propaganda.  FUD (fear, uncertainty and doubt) is a common method used by many to sell security.  Personally, I’m not in favour of doing that.  I like to educate, not scare.

Other subjects being searched for are ransomware, phishing, spoofing, cyber threats, insider threats and cyber awareness (there are more but they’re a long way down the list).

What people want to know hasn’t changed all that much, neither has the types of threats.  What has changed is how those threats present themselves, how the methodologies have changed in order to match new technologies and working practices, particularly the move to remote or home working and the additional threats that this poses.  AI is making a big impact already and that impact is going to get bigger as time goes on.  Email spoofing for example, that is faking an email purporting to come someone legitimate in order to get someone to take some action that is in some way fraudulent, is now being done over the phone with AI being used to fake someones voice.  It’s a scary development and there are now several well reported instances of this happening in the US.  If it’s happening there, it’s only a matter of time for it to happen in the UK and across Europe.

One of the first services we offered was the Cyber Maturity Assessment and our very first client took that service.  Our brief was to examine their Cyber Security and Data Protection posture, including policies, processes and technical configuration and controls. They were pleased that our assessment was very comprehensive in discovering the threats and vulnerabilities to their systems and that we described them in terms of business risk.  We developed comprehensive policies and processes that were all encompassing and designed to fit in with the style and presentation of their employee handbook.  All good but it required us to attend their site for a couple of days which was, at one time, normal and acceptable but in terms of the ‘new normal’, not so much.

Whilst we still offer that service, remote services are much more popular and much more in keeping with how businesses are now operating.  It doesn’t much matter where their staff are working, home, office or on the move.  What matters is that their protections are maintained regardless.

As we developed our new offerings we researched and came up with solutions that do just that.  We adopted Software as a Service (SaaS) and found some very innovative solutions that we can use to provide a managed security service to our clients at a very affordable price. 

Returning to our first paragraph, how do we show a return on investment?  Using our SaaS platform, we offer a 14 day free trial during which we can show a client where they currently stand and then carry out some quick remediations to show how that can be improved, so that the client can see the value of what they are going to get, using their own data.  It works and I commend it to you.

Check it out – https://hah2.co.uk/