Compliance Theatre vs Real Security: This Week We Ask You to Prove It
Two numbers. Ninety four per cent of UK business leaders say they’re confident their organisation could detect and respond to a data breach. Five per cent of UK businesses hold Cyber Essentials, the government’s baseline security certification.
Both numbers are real. Both come from proper research. And the gap between them is this week’s entire theme.
Confidence Is Not a Control
Businesses say all sorts of things about their security. We use MFA. Our backups are secure. Only authorised people can access customer data. We’d cope with ransomware.
None of that means anything until somebody asks the follow-up question: prove it.
This week we’re doing exactly that, using the government’s own Cyber Security Breaches Survey 2025/2026, the NCSC’s latest incident figures, and two real UK client audits where the gap between claimed and actual security got very uncomfortable, very quickly.
What’s Coming This Week
Tuesday, we pull apart the government breaches survey line by line: what UK businesses actually have in place versus what they say they have.
Wednesday, we look at what the NCSC is seeing on the ground, four nationally significant attacks a week, and what that means for a business betting on “it won’t happen to us”.
Thursday, a practical guide to building an evidence pack: the actual proof that your controls work, not just a policy document nobody’s read since it was written.
Friday, a real case study. Five people sharing one login. A twelve year old laptop with four gigabytes of RAM. What happens when a business tries to close that gap, and what happens when it doesn’t.
Saturday, an argument for why 5% Cyber Essentials adoption after twelve years should embarrass every boardroom in the country.
What This Means for Your Business
-
Pick one control you claim to have and try to prove it this week. MFA, backups, restricted admin access, whatever comes to mind first. If you can’t produce evidence in ten minutes, you’ve found your starting point.
-
Read Thursday’s guide before you spend a penny on certification. Building the evidence first makes any Cyber Essentials assessment faster and considerably cheaper.
-
Block time for the full series. This week builds directly on the governance and risk work from earlier in the series, and sets up next week’s finale.
| Source | Article |
|---|---|
| GOV.UK | Cyber security breaches survey 2025/2026 |
| Elixirr / Intelligent CISO | 94% of UK business leaders confident despite rising attacks |
| NCSC | Cyber Essentials overview and requirements |