Insights
Perspectives on security, compliance and risk.
Latest insight
PHP2Shell: what the critical PHP vulnerabilities mean for your organisation
Two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution and are being exploited. What is affected, why configuration changes are not enough, and the five steps to take this week.
Categories
Managed security
The best MDR providers in the UK: how to build a shortlist that fits
There is no single best MDR provider, only the best fit for your estate, sector and regulator. The four types of MDR provider in the UK market, who each suits, the seven tests that separate them, and how to get from a longlist to a shortlist.
9 October 20267 min readAI governance
Seven questions to answer before your organisation rolls out generative AI
Generative AI tools are usually adopted before anyone has decided how to govern them. Seven questions to answer first, covering where AI is already in use, what data goes in, what the tools can reach, who checks the output, who owns it and which rules apply, and how to evidence the answers.
9 October 20267 min readCertification
Nine reasons ISO 27001 surveillance audits go wrong, and how to avoid them
Most ISO 27001 surveillance audit findings have nothing to do with new threats. They come from an ISMS that was parked after certification. The nine findings auditors raise most often, what each one means, and how to keep the system running between audits.
9 October 20268 min readOperational resilience
Seven signs it's time for a red team, not another penetration test
A penetration test finds weaknesses in the systems you scope. A red team tests whether your organisation would notice and stop a real attacker. Seven signs you have outgrown annual penetration testing, the signs you are not ready yet, and what to ask a red team provider.
9 October 20267 min readCertification
Five reasons Cyber Essentials applications fail, and how to pass first time
Most Cyber Essentials failures come from the same five gaps: unsupported software, late patches, missing multi-factor authentication, an incomplete scope and admin rights used for everyday work. What each one means, how to find it before the assessor does, and how to write answers that pass.
9 October 20266 min readCertification
How to choose an ISO 27001 consultant: what to ask before you sign
A buyer's guide for UK organisations choosing ISO 27001 help: whether you need a consultant at all, why the consultant and the certification body must be separate, the experience that matters, how good consultants scope the work, and the red flags.
6 October 20269 min readManaged security
How to choose an MDR provider: the questions that separate the services
A buyer's guide to managed detection and response for UK organisations: what a good service includes, the questions that separate providers, where your data goes, how pricing works, and the red flags to walk away from.
6 October 20269 min readOperational resilience
The wealth manager's cyber brief: what the regulator expects, and what actually goes wrong
A brief for COOs and risk leads at wealth and asset managers: operational resilience and impact tolerances, named accountability under SM&CR, third-party concentration, and the payment fraud that targets client money.
5 October 202612 min readOperational resilience
The Cyber Resilience Act and the plant floor: two obligations UK manufacturers keep confusing
A practical guide for IT and operations leads at UK manufacturers: what the EU Cyber Resilience Act asks of the products you ship, what IEC 62443 asks of the plant that makes them, and why treating the two as one programme leaves both half done.
2 October 202613 min readCompliance
The NHS Data Security and Protection Toolkit, done honestly
What the DSPT is, who has to complete it, and what honest completion actually involves for private healthcare providers, clinical services businesses and NHS suppliers, including the legal duties that sit alongside it and why clinical continuity is the real test.
30 September 202611 min readCompliance
GxP data integrity and cyber security: why a validated estate makes ordinary security harder
Where MHRA data integrity expectations, EU GMP Annex 11, FDA 21 CFR Part 11 and GAMP 5 meet security practice, and how heads of IT, quality and risk in pharma reconcile patching, access control and audit trails with change control.
25 September 202615 min readOperational resilience
The Cyber Assessment Framework for energy operators: what it asks, and how to evidence it
A practical guide for heads of IT, OT managers and risk leads at UK energy and utilities operators under the NIS Regulations 2018: how the NCSC Cyber Assessment Framework is built, what an evidence pack actually contains, and where assessments usually come apart.
22 September 202613 min readOperational resilience
When should you security test a technology migration? Before it goes live, not after
Waiting until a technology overhaul is finished before testing it leaves new systems live and unchecked while the old ones are still running. How to align security validation to each deployment phase, and what it catches.
16 September 20267 min readCompliance
How do misconfigurations cause breaches? The 29-minute problem
Most breaches start with a misconfiguration, not a zero-day. Why configuration drift defeats point-in-time compliance, and how to close the gap between finding a problem and fixing it at machine speed, safely.
17 July 20269 min readCertification
Cyber Essentials for supply chain contracts: how to certify at speed and stay compliant
The Cyber Resilience Pledge means major buyers now require Cyber Essentials from their suppliers. How to certify fast, meet the 14-day patching rule and stay compliant all year, without a large security team or budget.
9 July 20265 min readBoard & governance
Cyber risk reporting for boards: what good looks like
How to report cyber risk to a board so it informs decisions rather than reassures: the metrics that matter, the ones to drop, a one-page format that works, and the cadence regulators now expect.
1 July 20268 min readBoard & governance
Questions every Managing Partner should ask about cyber risk
Ten questions that let a Managing Partner or board pressure-test the company's cyber posture in a single meeting, without needing to be technical, and what a credible answer to each one sounds like.
24 June 20269 min readCompliance
What law firms should expect from supplier security questionnaires
Why clients now send law firms detailed security questionnaires, what they typically ask, the answers that win and lose confidence, and how to turn a recurring chore into a standing evidence pack.
18 June 20268 min readCertification
Preparing for Cyber Essentials Plus: what the audit actually checks
What Cyber Essentials Plus adds over the standard certification, the five control areas the hands-on audit tests, the gaps that most often cause a fail, and how to be ready before the assessor arrives.
11 June 20268 min readAI governance
The EU AI Act: a readiness guide for UK organisations
A walkthrough of the EU AI Act: the timeline, who is actually in scope (including UK organisations serving EU users), and a practical four-step path to audit-ready AI governance ahead of the Act's phased deadlines (transparency from August 2026, high-risk for standalone systems from December 2027).
6 June 20269 min readOperational resilience
The ransomware readiness checklist
A practical readiness checklist covering the four stages of ransomware defence: reducing the chance of entry, limiting the spread, recovering without paying, and responding when it happens, with the questions a board should be able to answer.
28 May 20269 min readCyber insurance
The cyber insurance renewal checklist for boards
A board-level checklist for the weeks before a cyber insurance renewal: the controls underwriters now require, the evidence to gather, and the questions leadership should confirm before anyone signs the questionnaire.
21 May 20268 min readCompliance
DORA Article 28 explained: what it actually means for your suppliers
A practical guide for COOs and heads of risk at FCA-regulated companies working out what DORA's third-party requirements mean in supplier audits, board papers and contract renegotiations.
12 May 202612 min readCertification
Cyber Essentials, Cyber Essentials Plus and ISO 27001: which one do you actually need?
A practical comparison for UK organisations working out which certification answers the insurer, the client supplier audit, or the procurement requirement that has landed.
8 May 202610 min readCyber insurance
What insurers are asking now: the cyber renewal questionnaire, decoded
A line-by-line look at the questions UK underwriters are sending mid-market regulated companies at renewal, what each one is really asking for, and what good evidence looks like.
22 April 202610 min read
