IT Security

cloud security posture assessment checklist a upright shield on plinth

Cloud Security Posture: Essential Risk Assessment Checklist

Most cloud incidents do not start with a clever exploit. They start with a storage container someone made public for a demo, an access key committed to a repository years ago, or logging switched on in one region and never in the other three. A cloud security posture assessment is the structured way of finding all of that before somebody else does. This checklist walks the whole engagement in order: scoping and read-only access, the technical domains worth reviewing, how to score findings so the list is defensible, whether to use native tooling or a dedicated platform, and what the work realistically costs in money and elapsed time.

Read more
penetration testing frequency a shield with magnifying glass

Penetration Testing Frequency: Proven Rules for Safer IT

Once a year is a floor, not a schedule. This guide sets out how often a business should conduct penetration testing and why the calendar date matters far less than what changed in the estate since the last report. It covers the twelve-month baseline and where it comes from, the seven change triggers that should force an unscheduled round, exactly what PCI DSS, ISO 27001, SOC 2, Cyber Essentials Plus and NIS2 actually require, where vulnerability scanning stops and human testing starts, indicative UK programme costs at every cadence, and how to build a calendar that survives a year of competing priorities.

Read more
cybersecurity risk register template smes a upright board of blank tiles

Cybersecurity Risk Register: Proven Template for Safe SMEs

Most cybersecurity risk register templates are built for banks and abandoned by small businesses within a fortnight. This guide strips the document back to the eleven fields that earn their place, gives likelihood and impact scales anchored to time and money rather than adjectives, and shows a worked register for a sixty-person firm with real rows, owners and treatment decisions. It also covers the four treatment options and how to use each one honestly, a two-afternoon build method, the review cadence and out-of-cycle triggers that stop the register rotting, and when a spreadsheet stops being enough.

Read more
incident response retainer cost and inclusions a shield lightning bolt plinth

Incident Response Retainer: Essential Costs to Avoid Risk

An incident response retainer is a contract you buy before anything has happened, to guarantee access to specialists who are otherwise fully booked the moment a large ransomware event hits the market. The cheapest and most expensive quotes can describe genuinely different products, and on a procurement spreadsheet they look interchangeable. This guide covers what you are actually buying: the standard reactive and proactive inclusions, the exclusions that destroy budgets, the three pricing models in common use, realistic UK cost bands for 2026 by organisation size, what response-time service levels genuinely promise, how prepaid hours are consumed and lost, and a scorecard for comparing providers before you sign.

Read more
passkeys vs mfa replace business passwords a hexagonal shield fingerprint

Passkeys vs MFA: Proven Guide to Stop Password Risk

Adversary-in-the-middle phishing kits now defeat one-time codes and push approvals routinely, which is why the multi-factor authentication you deployed in 2020 is no longer doing the job you think it is. This guide compares passkeys and traditional MFA by the attacks each one actually stops, explains how origin binding makes a passkey unphishable, sets out the parts of a typical application estate that cannot accept a passkey yet, costs the migration in service desk time and hardware, and gives a staged rollout plan that ends with weak factors switched off rather than left as a fallback.

Read more
immutable backup 3 2 1 1 0 strategy a sealed vault cube plinth

Immutable Backup: Essential 3-2-1-1-0 Strategy to Cut Risk

Ransomware crews delete the backups before they encrypt anything, which is why the old 3-2-1 rule quietly stopped being enough. This guide explains what an immutable backup genuinely is at the storage layer, how each digit of the 3-2-1-1-0 backup strategy is proved rather than claimed, the difference between governance and compliance mode, how long the lock window needs to be against realistic dwell time, what the storage overhead actually costs, the restore verification that the final zero demands, and a 90-day plan to get there.

Read more
business email compromise playbook a branching decision tree monument

Business Email Compromise Playbook: Essential Risk Guide

The document itself, not the product underneath it — how to write a business email compromise playbook that removes decisions from the moment of the incident: the five roles to name in advance, three severity tiers that stop every alert becoming a crisis, the first-hour containment order that preserves evidence before it destroys it, the bank recall clock, pre-written message templates for staff, customers and the bank, the 72-hour regulatory and insurance obligations, and the rehearsal that turns a file into a reflex.

Read more
microsoft 365 offboarding checklist departing employees a closed door slab on plinth

Microsoft 365 Offboarding Checklist: Essential Risk Guide

Disabling an account is not offboarding. This guide walks the full sequence for a departing employee — revoking live sessions rather than just resetting the password, converting the mailbox to a licence-free shared mailbox, rescuing OneDrive before the deletion clock runs, reassigning ownerless Teams, reclaiming licences and add-ons, retiring devices in Intune, and keeping the compliance evidence that proves it all happened.

Read more
microsoft 365 business email compromise response plan a hijacked mailbox shield

Microsoft 365 Business Email Compromise: Proven Risk Plan

A working response plan for UK businesses on Business Premium, E3 or E5 — what to do in the first sixty minutes, why revoking sessions matters more than resetting the password, the evidence to export before you clean anything, how to investigate inbox rules, forwarding and OAuth grants, the bank and Action Fraud clock, UK GDPR notification, full tenant recovery, and the Conditional Access and phishing-resistant MFA controls that stop it happening again.

Read more
microsoft 365 security audit tenant checklist a shield with magnifying glass

Microsoft 365 Security Audit: Proven Tenant Risk Checklist

A working tenant audit checklist for UK businesses on Business Premium, E3 or E5 — how to scope the review, enumerate privileged roles and MFA exemptions, read Conditional Access exclusions properly, harden email and DMARC, find anonymous sharing links and guest sprawl, audit OAuth consent and service principals, confirm logging and alerting would actually detect an incident, and turn the findings into a ranked list somebody will fix.

Read more
CHAT