Research & Analysis
Insights
In-depth guides on cybersecurity, compliance, and AI risk for organisations in regulated industries.
How to Build a Cybersecurity Strategy: A Practical Guide for UK Businesses
A cybersecurity strategy defines why you invest in security and what outcomes you expect. This guide covers risk appetite, strategic goals, guiding principles, and measurement frameworks.
Read more
Hotel Cybersecurity Risk Benchmark 2026
84% of hotel properties experienced a cyber incident in 2025. Five confirmed breaches from the past twelve months show how credential theft, vendor compromise, and AI-driven front-desk campaigns land in practice.
Read more
Cyber Essentials vs ISO 27001: Which Certification Does Your Business Need?
Cyber Essentials covers 5 technical controls in weeks. ISO 27001 is a full management system that takes 6-18 months. Here is how to choose the right certification path for your stage of growth.
Read more
PCI DSS Compliance for UK Businesses: A Practical Guide to v4.0
Version 4.0 is now the only active standard. Understand the 12 requirements, which self-assessment questionnaire applies to your business, and how to reduce your compliance scope.
Read more
Reducing Microsoft dependency: the case for change and a practical roadmap
Microsoft's cloud breaches, CLOUD Act exposure, and licensing structure are driving enterprise decisions to reduce dependency. We set out the real risks and a realistic migration path.
Read more
Voice deepfakes and CEO fraud: how AI voice cloning is targeting payment authorisation
AI voice synthesis clones an executive's voice from minutes of public audio. Finance teams are receiving calls that sound exactly like their CEO. Here is how the attack works and the controls that stop it.
Read more
Ransomware: should you pay? The UK legal and practical framework
UK law has no blanket ban, but paying a sanctioned group may be illegal, paying doesn't reduce an ICO fine, and most victims who pay don't recover all their data. A framework for deciding before the attack happens.
Read more
Microsoft 365 security hardening: the controls most organisations are missing
M365 defaults are built for adoption, not security. Legacy authentication enabled, admin accounts used for email, external sharing wide open. Here is what to fix and in what order.
Read more
UK Cyber Security and Resilience Bill: what it means for your organisation
The Bill replaces NIS 2018, brings managed service providers and data centres into scope, and gives regulators the power to inspect before an incident happens. Here is what changes and what to prepare.
Read more
EU AI Act: the updated enforcement timeline after the Digital Omnibus
The Digital Omnibus has delayed the Annex III high-risk AI deadline to 2 December 2027. Most businesses using AI in HR, credit or biometrics are in scope and need to understand the updated timeline.
Read more
EU AI Act: what is now in force and what the digital omnibus changed
This guide covers what is now in force, what the Digital Omnibus changed, the four risk tiers, which AI uses are already banned, deployer obligations for high-risk AI, GPAI model rules, and the €35M fine structure.
Read more
NIS2 Enforcement: Early Penalties, What the First Cases Reveal, and What to Do Now
The first enforcement actions are in. Notification timing gaps, missing supply chain evidence, and board records are the consistent findings. Here is what the early cases reveal.
Read more
Agentic AI Security Risks: What Happens When AI Acts on Your Systems
AI agents that read email, query databases, and execute code create an attack surface your existing controls were not built for. This guide covers prompt injection, over-permissioning, and the governance controls that work.
Read more
Passkeys and Passwordless: The Practical Guide for IT and Security Leaders
Passwords fail three ways: phished, breached, or reused. FIDO2 passkeys remove the shared secret model entirely. Here is what enterprise rollout looks like and where to start.
Read more
When AI processing requires a DPIA: what triggers the test and what to put in it
Most AI deployments trigger GDPR's DPIA requirement without anyone noticing. Here is how to apply the nine-criteria test to Copilot, HR AI, and other common tools.
Read more
Microsoft Copilot: How to deploy without exposing confidential data
Copilot sees everything your employees can see. If your Microsoft 365 permissions have never been reviewed, that is a bigger problem than it sounds.
Read more
Ransomware recovery: how to restore your systems without reinfecting them
Most organisations restore before confirming the attacker has left. Six steps to reliable ransomware recovery.
Read more
NIS2 enforcement: what regulators check and what happens if you're not ready
Regulators are auditing organisations now. Here is what they look for, how fines are calculated, and what to prioritise first.
Read more
Shadow AI: the data leak hiding in your organisation's everyday tools
Employees paste sensitive data into personal AI tools daily. Most organisations have no idea it is happening. Here is what to do about it.
Read more
What is cybersecurity?
Cybersecurity protects systems, networks and data from attack. A practical guide to what the discipline covers, common threats and where to start.
Read more
Microsoft 365 Copilot: how to implement it safely and what goes wrong when you don't
Copilot inherits your existing Microsoft 365 permissions — every file a user can access, the AI can surface. This guide covers the permissions audit, technical prerequisites, real-world vulnerabilities, and the adoption steps that determine whether the rollout succeeds.
Read more
Machine identities: the attack surface your security team isn't managing
API keys, service accounts and TLS certificates now outnumber user accounts. Most organisations have no complete inventory.
Read more
Zero Trust architecture: the identity-first security model for remote and hybrid organisations
The corporate perimeter no longer defines your security boundary. Zero Trust replaces implicit network trust with verified identity and device compliance on every request. This guide explains the five pillars, where to start, and how it maps to NIS2 and ISO 27001.
Read more
Cyber Resilience Act: a compliance guide for manufacturers and distributors of connected products
The EU Cyber Resilience Act is in force. Vulnerability reporting to ENISA becomes mandatory in September 2026. Full compliance is required by December 2027. This guide covers who is in scope, the three product classes, SBOM requirements, and what to do now.
Read more
Deepfakes and identity fraud: how AI voice and video manipulation is targeting businesses
AI voice cloning takes three seconds of audio. Real-time face-swapping passes live video calls. The $25M Arup fraud showed what happens when both tools are combined. This guide covers vishing, KYC bypass, and the verification controls that hold up under real attacks.
Read more
ISO 42001: the AI management system standard your organisation needs to know
ISO/IEC 42001:2023 is the first internationally recognised, certifiable framework for AI governance. This guide explains the standard's structure, the AI system impact assessment, how it pairs with ISO 27001, and how it maps to EU AI Act obligations.
Read more
AI-generated and polymorphic malware: how autonomous threats are evading detection
Malware that rewrites its own code using AI is outpacing signature-based defences. This guide explains polymorphic and metamorphic techniques, the BlackMamba POC, underground LLM tools like WormGPT, and the behavioural EDR controls that actually stop them.
Read more
Beyond the password: how attackers bypass MFA and how to stop them
Stolen credentials are behind over 80% of enterprise breaches, and adversary-in-the-middle proxy attacks bypass TOTP and push MFA in real time. This guide explains six bypass techniques, why FIDO2 is different, and the session-layer controls that close the gaps.
Read more
How to conduct a DORA gap analysis: a step-by-step framework for FinTechs
DORA has applied since January 2025. Most FinTechs have partial controls and open gaps across all five pillars. This framework shows you where to look, what to measure, and how to build a prioritised remediation roadmap your board can approve.
Read more
NIS2 vs. ISO 27001: do you need both, and where do you start?
NIS2 is EU law. ISO 27001 is a voluntary standard. Both land on the same compliance officer's desk, and about 70% of what they require overlaps. This guide maps what you get for free, where the gaps sit, and which to tackle first.
Read more
MFA: why one extra step prevents most breaches
MFA stops over 99% of automated credential attacks. Most businesses know they need it but haven't deployed it properly. This guide covers MFA types, where to start, common mistakes, and how to configure it in Microsoft 365.
How much should your business spend on IT? A budget framework for SMEs
Most SMEs spend 1–2% of revenue on IT. Benchmarks for professional services suggest 4–7%. This guide covers the five spending categories, hardware refresh cycles, software audits, and building a three-year IT budget.
Business email compromise: the fraud hiding in your inbox
BEC doesn't need malware or malicious links. Attackers impersonate executives, suppliers, and lawyers to redirect payments. Phishing losses jumped 274% in one year. This guide explains how it works and how to stop it.
Ransomware: what to do before, during and after an attack
Ransomware appeared in 88% of SMB breaches. Average demands now exceed £100,000 before recovery costs. This guide covers the defences that limit damage, what to do in the first 24 hours, and how to recover without paying.
Signs your IT infrastructure is holding your business back
Recurring helpdesk tickets, rising costs with no clear cause, staff using personal tools to get around IT. These are not random problems. They are signals that your infrastructure has structural gaps. This guide covers seven warning signs and what each one means.
The Cybersecurity Baseline Every Business Should Have in Place
The security controls every business should have: MFA, patching, backups, access control, and incident response. Prioritised and free of jargon.
Read more
How to build an IT service desk without hiring a full team
Most growing businesses do not need a large in-house IT team to run effective support. This guide covers support tiers, ticketing setup, realistic SLAs, and when a managed service provider makes more sense than another hire.
What is penetration testing and when does your business need one
A penetration test simulates a real attacker to find weaknesses before someone else does. This guide explains the difference from a vulnerability scan, the types of test available, and how to act on the results once you have them.
In-house IT vs. managed service provider: how to decide
Most SMEs make this decision reactively. This guide covers the real costs, trade-offs, and decision framework for choosing between an in-house IT hire and a managed service provider.
Windows 10 end of life: what your business needs to do now
Microsoft stopped patching Windows 10 in October 2025. Around 30% of business machines in the UK and EU are still running it. This guide covers your options: upgrade in place, replace hardware, or buy extended support.
The most common cybersecurity mistakes small and medium businesses make
Treating security as a one-time project, skipping MFA, giving everyone admin rights. These mistakes are common, avoidable, and expensive. This guide covers seven of the most frequent errors and what to do instead.
Implementing cybersecurity controls for NIST CSF 2.0 and NIS2
NIST CSF 2.0 and NIS2 require the same cybersecurity controls. Most organisations implement them twice. This guide maps all 10 NIS2 Article 21 measures to their CSF 2.0 equivalents and shows how to run one security programme that satisfies both.
Read more
ISO 27001: building IT security management for small and medium businesses
ISO 27001 gives smaller businesses a structured IT security management system: identify what you are protecting, assess the risks, and put controls in place. This guide covers the six-step path, realistic timelines, and what it costs.
Read more
The cybersecurity risks hotels need to address, and usually don't
A mid-size hotel holds more sensitive data per customer than most banks: payment cards, passport numbers, loyalty data, and travel patterns in one place. This analysis covers the four attack surfaces that matter most, and what a credible security baseline actually looks like.
Read more
Using AI in your healthcare organisation without creating GDPR exposure
Healthcare AI is moving fast, but most tools that process health data create GDPR and EU AI Act obligations that generic guidance misses entirely. Five questions to ask before any clinical or administrative AI deployment.
Read more
IT risk and cybersecurity in financial services: what DORA requires
DORA sets binding IT risk and cybersecurity requirements for banks, insurers, and payment firms across the EU. Most firms have addressed the five pillars. Third-party ICT risk, where the deepest gaps sit, is where most still fall short.
Read more
What your cyber insurer expects before paying a claim
Cyber insurers now require specific technical controls before binding cover and before paying claims. This guide covers what underwriters check, how claims get evaluated, and which exclusions are catching organisations out.
Read more
NIS2 cybersecurity readiness: the 10 security controls your organisation needs
NIS2 is a practical cybersecurity baseline, not just a regulatory checkbox. It covers access control, incident detection, supply chain risk, and more. This guide walks through all 10 mandatory security controls and how to get them in place.
Read more
GDPR compliance for businesses in the EU: what you actually need to have in place
Eight years on, many organisations still have gaps in the basics: no lawful basis documented, breach response plans that miss the 72-hour window, and processing records that have never been updated. This guide covers the obligations that matter most.
Read more