The Small Business
Cyber Security Guy
Welcome to my blog and podcast, where I share brutally honest views, sharp opinions, and lived experience from four decades in the technology trenches. Whether you're here to read or tune in, expect no corporate fluff and no pulled punches.
Everything here is personal. These are my thoughts, not those of my employer, clients, or any poor soul professionally tied to me. If you’re offended, take it up with me, not them.
What you’ll get here (and on the podcast):
Straight-talking advice for small businesses that want to stay secure
Honest takes on cybersecurity trends, IT malpractice, and vendor nonsense
The occasional rant — and yes, the occasional expletive
War stories from the frontlines (names changed to protect the spectacularly guilty)
I've been doing this for over 40 years. I’ve seen genius, idiocy, and everything in between. Some of it makes headlines, and most of it should.
This blog and the podcast is where I unpack it all. Pull up a chair.
Five Questions That Reveal Your Business Needs Strategic IT Leadership (And It's Not What You Think)
Most UK businesses think they're fine without strategic IT leadership until they're not. These five diagnostic questions expose the difference between thriving with technology and merely surviving despite it.
Question 1: Are technology decisions made strategically or reactively? If you're replacing servers because they died rather than planned refresh cycles, you need help.
Question 5: Will current systems scale gracefully as you grow? Planning to double in size without considering technology impact is business suicide.
Answer honestly: reactive technology management costs more than strategic guidance. The question isn't whether you need leadership—it's whether you'll get it before competitors do.
£180k CIO vs £25k Fractional: Why Smart UK Businesses Choose the Latter
Full-time CIO in London: £180k-250k annually plus benefits. Fractional CIO: £15k-30k for strategic expertise when you need it.
The mathematics are brutal, but the quality difference might surprise you. Many fractional executives are senior professionals who prefer variety over corporate politics.
You get FTSE 250 CIO experience for a fraction of full-time cost. While your competitors burn budget on executives who spend half their time in meetings, you access strategic guidance scaled to actual needs.
Smart UK businesses are realising that technology leadership isn't about seat time—it's about strategic thinking that drives business results.
Stop Calling Dave from IT, Your CIO (He's Not, and It's Destroying Your Business)
Dave from IT is brilliant at keeping your systems running. But calling him your CIO is like calling your mechanic an automotive engineer.
Most UK small businesses confuse operational IT support with strategic technology leadership, and it's costing them millions. While Dave troubleshoots email issues, real CIOs design five-year technology roadmaps.
The difference? Strategic thinking that aligns technology investments with business objectives. Fractional CIO services deliver genuine C-level expertise for £15k-30k annually versus £180k+ for full-time hiring.
Stop expecting Dave to be everything. Give him the strategic backup he desperately needs.
60% of Small Businesses Don’t Survive Cyberattacks. Are You Listening Yet?
Cybersecurity isn’t just an enterprise issue — it’s a survival issue for UK SMEs. With 96% of attacks aimed at small businesses and 60% of victims closing within six months, the myth of being “too small to hack” is lethal.
This article tears apart the excuses business owners use, reveals the hidden costs of breaches, and explains why simple, affordable defences like Cyber Essentials, patching, MFA, and staff training are the only reason some firms survive. Don’t wait until it’s too late — find out why cybersecurity has become the difference between continuity and closure.
Why Small Businesses Must Rethink Cybersecurity NOW (Before It’s Too Late)
Cybersecurity is not just an enterprise problem. With 96% of attacks targeting small businesses and 60% of victims closing within six months, UK SMEs face a survival crisis.
This article exposes the myths keeping businesses vulnerable, the real financial impact of attacks, and the role of supply chain risk. It explains why Cyber Essentials and board-level governance are no longer optional, but essential.
Written for directors and leaders, it lays out practical steps to protect your business before it’s too late.
The Massive Lie That’s Killing UK Businesses: Cybersecurity is NOT Just an Enterprise Problem
Cybersecurity is not just an enterprise problem. With 96% of attacks targeting small businesses and 60% of victims closing within six months, UK SMEs face a survival crisis. This article exposes the myths keeping businesses vulnerable, the real financial impact of attacks, and the role of supply chain risk. It explains why Cyber Essentials and board-level governance are no longer optional, but essential. Written for directors and leaders, it lays out practical steps to protect your business before it’s too late.
60% of Small Businesses Die After Cyberattacks – Are You Next?
Sixty per cent of small businesses don’t survive a cyberattack. That’s not a scare tactic, it’s a reality. UK SMBs are under siege, targeted in 96% of attacks because criminals know you’re under-protected and overconfident. This post rips apart the myth that cybersecurity is “only an enterprise problem” and shows how MSP malpractice, human error, and supply chain risk are leaving businesses exposed.
Most importantly, it lays out the simple, affordable steps like Cyber Essentials that block 95% of attacks. Because once the breach hits, it’s already too late.
The UK Government's Ransomware Gambit: Why Your SMB Just Became a Bigger Target
The UK Government's July 2025 consultation response commits to implementing world-leading ransomware legislation by late 2026.
Three key proposals include payment bans for public sector/CNI, universal 72-hour incident reporting, and government pre-approval for private sector payments.
This will dramatically increase ransomware targeting of SMBs as criminals pivot from restricted sectors to easier private targets.
Cyber Essentials: The £300 Security Framework That Actually Works (And How to Get It Without Going Mental)
After Monday's podcast revelation that government cybersecurity frameworks can actually make sense, let's talk implementation reality. Cyber Essentials costs £320-600 for self-assessment, takes 2-4 weeks of focused effort, and genuinely stops 80% of attacks targeting UK SMBs.
But here's what the NCSC won't tell you: most businesses discover massive security gaps during the assessment process. I've guided dozens through certification, and the pattern is always the same.
"We thought we were secure" becomes "bloody hell, how were we not breached already?" Pull up a chair, this is going to be educational.
Cyber Essentials Deep Dive: Five Controls That Actually Work
After Monday's podcast revelation that government frameworks can actually make sense, let's dive deep into the five Cyber Essentials controls that provide enterprise-level protection without enterprise-level budgets. Boundary firewalls, secure configuration, access control, malware protection, and patch management.
Five areas that stop 80% of attacks against 80% of small businesses 80% of the time. That's a lot of eighties, but the maths works.
These aren't theoretical controls dreamed up by bureaucrats who think cybersecurity means installing antivirus and hoping for the best. They're battle-tested defences based on actual attack analysis.
Cyber Essentials: When Government Frameworks Actually Make Sense
Right, let's address the elephant in every small business owner's mind after last week's White House security episode: if we're facing enterprise-level threats, do we need enterprise-level budgets? The answer is a resounding no.
The UK's Cyber Essentials framework takes everything we learned about systematic security thinking and distills it into five achievable controls that cost less than most businesses spend on coffee.
Insurance companies love it (lower claims), government contracts require it, and it stops 80% of attacks cold.
Enterprise thinking, small business budget. Pull up a chair.
How Corner Shops Can Get White House Security
After last week's mind-bending dive into White House security with Theresa Payton's insights, you're probably wondering if protecting your business requires government-sized budgets and ex-GCHQ analysts. The answer will surprise you. Monday's episode reveals how the UK's Cyber Essentials framework takes everything we learned about systematic security thinking and makes it achievable for businesses that can't hire situation room experts.
Five controls, 80% protection against real threats, costs less than your monthly coffee budget. From presidential protection to practical implementation. Episode drops Monday morning.
Stop Getting Fooled: A Small Business Guide to "Verify and Never Trust" Security
When someone who protected the President's digital communications tells you to "verify and never trust," you should probably listen. Former White House CIO Theresa Payton's evolution of Reagan's famous principle isn't just clever wordplay - it's essential survival advice for 2025. Deepfakes can fool video calls, AI perfectly mimics email writing styles, and social engineering has become so sophisticated that even cybersecurity professionals get caught out. When seeing and hearing are no longer believing, systematic verification becomes your primary defense. Here's your step-by-step guide to implementing enterprise-level verification procedures without enterprise-level complexity - or budgets.
Stop Bleeding Money on Yesterday's Shortcuts
After this week's deep-dive into technical debt psychology, let's talk about actually fixing the bloody mess. Your "temporary" solutions from 2019 are now permanent vulnerabilities that criminals are actively exploiting.
Every day you delay proper technical debt management, you're bleeding money on maintenance, security patches, and the inevitable breach costs. I've seen £50 million companies destroyed by technical debt they knew existed but couldn't prioritize properly.
Here's your framework for triaging technical debt before it kills your business: assess, prioritize, execute, and maintain. No psychology, no excuses, just practical steps to stop the bleeding.
Podcast Ep7: Technical Debt - The Digital Quicksand Drowning UK Businesses
M&S lost £300 million because decades of technical debt left them unable to respond to basic social engineering. Co-op faced identical DragonForce attacks but recovered quickly through operational agility. The difference? M&S accumulated digital debt like a hoarder accumulates rubbish, whilst Co-op invested in resilience.
Technical debt isn't just old software - it's every deferred security decision, every "temporary" workaround, every vendor relationship without oversight.
Podcast Episode 7 reveals how your past shortcuts are creating tomorrow's business extinction events. Because criminals don't attack your current systems - they attack your accumulated incompetence.
The SME That Discovered 247 Unauthorized Cloud Services in One Week
Buckinghamshire engineering firm thought they had "pretty good visibility" into their IT environment. DNS monitoring revealed 247 unauthorized cloud services, 43 different communication platforms, and £127,000 annual Shadow IT spending they didn't know existed. Dropbox, Google Drive, OneDrive, iCloud, plus dozens of project management tools, design software subscriptions, and messaging platforms. One week of DNS logs exposed six years of unauthorized software proliferation.
The technical implementation took four hours. The business transformation took six months. Today, you can start discovering what's actually running in your network using the same techniques that saved this business from digital chaos.
Shadow IT: The Digital Squatters in Your Business
Episode 6 drops today with a statistic that'll make your blood run cold: 42% of business applications are unauthorized. While you're worrying about hackers, your helpful employees have built them a data highway using WhatsApp customer service, Karen's Dropbox backup strategy (password: "Password"), and seventeen project management tools for twelve people.
Mauven brings her NCSC perspective on government Shadow IT disasters, while Noel shares the DNS monitoring method that revealed 200+ cloud connections in one SMB. This isn't theoretical cybersecurity, this is happening in your business right now. Listen before the digital squatters invite criminal friends.
Passkeys, Passwordless, and the End of Excuses: Why This Time It's Actually a Good Thing
Passwords are circling the drain, and this time it’s for real. Microsoft, Apple, and Google are killing off passwords and pushing passkeys by default across their platforms.
Microsoft is going passwordless by force, Apple is making it seamless, and Google is syncing passkeys everywhere. The UK government is onboard too, rolling out passkeys across public services.
This isn’t future talk, it’s happening now. If your IT provider is still clinging to complex password policies and SMS MFA, you’re being left behind.
Passkeys work. They’re safer, faster, and available today. So why are you still dragging your feet?
The Psychology of Password Chaos: Why Smart People Make Terrible Choices
After Monday's podcast and yesterday's NCSC deep-dive, I want to tackle the elephant in the room: if three random words are so brilliant, why do smart business owners still use "password123"? Why does 78% password reuse persist despite constant breach warnings? The answer isn't technical ignorance - it's human psychology.
We're fighting millions of years of evolution with spreadsheets and complexity requirements. Our brains aren't wired for digital security, they're wired for survival shortcuts. Understanding this psychology is the key to implementing security that actually works in the real world.
Three Random Words: The NCSC Solution That Actually Works
After last night's podcast revelation about our collective digital archaeology disaster, let's talk about the solution hiding in plain sight. The UK's National Cyber Security Centre dropped wisdom that sounds too simple to work: pick three random words for your passwords. "Coffee train fish." "Wall tin shirt." "CabbagePianoBucket."
Easy to remember, nightmare to crack, and unlike "password123," not on every hacker's greatest hits list. While we're mashing together words and numbers in barely inventive combinations, the NCSC figured out human psychology and gave us something that actually works.
⚠️ Full Disclaimer
This is my personal blog. The views, opinions, and content shared here are mine and mine alone. They do not reflect or represent the views, beliefs, or policies of:
My employer
Any current or past clients, suppliers, or partners
Any other organisation I’m affiliated with in any capacity
Nothing here should be taken as formal advice — legal, technical, financial, or otherwise. If you’re making decisions for your business, always seek professional advice tailored to your situation.
Where I mention products, services, or companies, that’s based purely on my own experience and opinions — I’m not being paid to promote anything. If that ever changes, I’ll make it clear.
In short: This is my personal space to share my personal views. No one else is responsible for what’s written here — so if you have a problem with something, take it up with me, not my employer.