Articles on risk management: practical cyber security and technology leadership insights for UK SMEs, written by James Griffiths.
There is a tempting logic in the idea of assessing your own security posture. Your internal team knows the environment, understands the history of decisions made, and can move quickly without the overhead of onboarding an outside party. So why bring in someone from outside? Why pay for the privilege
Questionnaires are theatre. Real risk reduction looks very different. Third-party risk keeps showing up in breach reports, regulator findings, and insurance claims. Yet most organisations still manage it with long questionnaires, annual reviews, and a false sense of control. This is not a tooling pr
AI is not breaking cybersecurity. Weak identity controls are. AI just makes the consequences faster, cheaper, and harder to ignore. Right now, too many security strategies are being reshaped around AI threats while the same organisations still run fragile identity and access management systems. This
Third-party risk is now one of the biggest blind spots in UK cyber security. Most attacks still land through simple things like phishing and poor patching, but when something really disruptive happens, a supplier is often involved somewhere in the chain. Government and NCSC-aligned data backs this u
In November 2025, CrowdStrike publicly announced that it had terminated an insider who leaked screenshots of internal dashboards to a hacker collective. While CrowdStrike maintains its systems were not compromised and customer data was unaffected, the incident highlights a critical truth: insider th
On 15 October 2025, the UK Information Commissioner’s Office (ICO) imposed a combined £14 million penalty on outsourcing giant Capita plc and Capita Pension Solutions Limited for serious data protection failings linked to its 2023 cyber-attack. The ICO split the fine into £8m for Capita plc and £6m
Introduction In July 2025, the UK government unveiled plans to introduce a targeted ban on ransomware payments by public sector bodies and regulated operators of critical national infrastructure (CNI). This represents a significant shift in the state’s approach to cyber-extortion: instead of mere g
Introduction The discovery of a critical vulnerability in Salesforce’s AgentForce, dubbed ForcedLeak, has set off alarms in the enterprise technology and security world. It shows clearly that embedding AI agents within business systems is not just a matter of functionality or convenience it is now a
Introduction Cybersecurity regulations across Europe are tightening, with the EU’s NIS2 Directive (Network and Information Security Directive) taking centre stage. While the UK is no longer a member of the European Union, NIS2 still has major implications for British organisations. Many UK companies
Introduction On 20 August 2025, Apple quietly rolled out emergency security patches for iOS, iPadOS and macOS. These updates iOS 18.6.2, iPadOS 18.6.2 (plus 17.7.10 for some older pads), macOS Sequoia 15.6.1, Sonoma 14.7.8 and Ventura 13.7.8 don’t include flashy new features. Instead, they fix a ser
Release Date: 12 August 2025 Applicable Version: Windows 11 version 24H2 Build Number: 10.0.26100.4946 (OS Build) Patch ID: KB5063878 1. Context and Significance Every second Tuesday of the month, Microsoft delivers its highly anticipated Patch Tuesday updates. In August 2025, this rollout encompass
The UK’s National Cyber Security Centre (NCSC) has officially released version 4.0 of the Cyber Assessment Framework (CAF) a significant update that reflects the changing cyber threat landscape, technological advancements, and evolving regulatory needs. With CAF becoming the de facto benchmark for a