⭐100K+ Monthly Downloads

⭐Top 20 Apple Management

⭐100K+ Monthly Downloads ⭐Top 20 Apple Management

The Small

Business

Cyber Security Guy

Welcome to the blog and podcast, where we share brutally honest views, sharp opinions, and lived experience from four decades in the technology trenches. Whether you're here to read or tune in, expect no corporate fluff and no pulled punches.

Everything here is personal. These are my and the team’s thoughts, opinions forged in the heat of battle! And not those of our employers, clients, or any other professional with whom we are associated.

If you’re offended, take it up with us, not them.

What you’ll get here (and on the podcast):

  • Straight-talking advice for small businesses that want to stay secure

  • Honest takes on cybersecurity trends, IT malpractice, and vendor nonsense

  • The occasional rant — and yes, the occasional expletive

  • War stories from the frontlines (names changed to protect the spectacularly guilty)

I've been doing this for over 40 years. I’ve seen genius, idiocy, and everything in between. Some of it makes headlines, and most of it should.

This blog and the podcast are where we break it all down.

Grab a coffee and pull up a chair, you need to see this!

Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message. Stop the Security Industry Bullshit. Wear Your Message.
Stop the Security Industry Bullshit. Wear Your Message.
Compliance & Risk Management Corrine Jefferson Compliance & Risk Management Corrine Jefferson

Is a Card Number Personal Data? The Court of Appeal Has Answered. Here Is What Your Business Needs to Do with That Answer.

In September 2024, a UK tribunal concluded that 5.6 million stolen card records might not constitute personal data. The argument was structural, not frivolous. Hackers who cannot identify individuals from card numbers alone are not, the Upper Tribunal suggested, processing personal data.

The Court of Appeal corrected that in February 2026. Lord Justice Warby's ruling establishes a clean and reusable test: you assess whether data is personal from the controller's perspective, not the attacker's.

I want to explain exactly why that matters, what "jigsaw identification" means in practice, and the five steps your business should take before the end of this month.

Read More
Industry Analysis, Opinion & Analysis Noel Bradford Industry Analysis, Opinion & Analysis Noel Bradford

Europe Is Leaving. The UK Is Sleepwalking. And Nobody in Charge Seems Bothered.

France banned Zoom and Teams from government. Germany is migrating 30,000 workstations to open source and saving €15 million a year. The Dutch Parliament demanded exit strategies from US cloud. Switzerland declared US cloud unsuitable for government data.

The UK has produced no sovereign cloud strategy, no government migration programme, no regulatory enforcement on CLOUD Act exposure, and no explicit guidance for commercial organisations.

Noel Bradford, with 40-odd years of watching the UK IT establishment make the same mistakes on repeat, asks the question nobody in Whitehall wants to answer: when did we decide that digital independence was somebody else's problem?

Read More
Compliance & Risk Management, Guest Blog Kathryn Renaud Compliance & Risk Management, Guest Blog Kathryn Renaud

DUAA: The "Keep Calm and Build a Workflow" Act 

The Data (Use and Access) Act just went live on 5 February, and if you're only hearing about it now, you're not alone. The commencement regulations were published two days before the provisions kicked in. That's the government's idea of adequate notice. Guest contributor Kathryn Renaud cuts through the panic with something actually useful: four repeatable workflows for DSARs, complaints, cookies, and automated decisions that any UK SMB can build this week with tools they already own. No expensive software. No consultant fees. Just structure, ownership, and documented processes. Read this before the ICO comes knocking.

Read More
Industry Analysis Noel Bradford Industry Analysis Noel Bradford

Why Another SOC 2 Certified Company Just Got Breached

BREAKING: Another SOC 2 certified company just suffered a massive data breach. Shocked? You shouldn't be. While they were busy documenting their security procedures in triplicate, hackers walked through the front door they forgot to lock. This is compliance theatre in action: expensive certificates that impress auditors but don't stop criminals. Today's reality check exposes why governance frameworks fail against real threats and what UK SMBs should learn from this latest security disaster

Read More

⚠️ Full Disclaimer

This is my personal blog. The views, opinions, and content shared here are mine and any contributors and ours alone. They do not reflect or represent the views, beliefs, or policies of:

  • Our Day Job employers

  • Any current or past clients, suppliers, or partners

  • Any other organisation We affiliated with in any capacity

Nothing here should be taken as formal advice — legal, technical, financial, or otherwise. If you’re making decisions for your business, always seek professional advice tailored to your situation.

Where we mention products, services, or companies, that’s based purely on our own experiences and opinions — We are not being paid to promote anything. If that ever changes, we’ll make it clear.

In short: This is my personal space to share my personal views. No one else is responsible for what’s written here — so if you have a problem with something, take it up with me, not my employer.