211.3K
Downloads
56
Episodes
The UK's leading small business cybersecurity podcast, helping SMEs protect against cyber threats without breaking the bank.
Join cybersecurity veterans Noel Bradford (CIO at Boutique Security First MSP) and Mauven MacLeod (ex-UK Government Cyber Analyst) as they translate enterprise-level security expertise into practical, affordable solutions for UK small businesses.
šÆ WHAT YOU'LL LEARN:
- Cyber Essentials certification guidance
- Protecting against ransomware & phishing attacks
- GDPR compliance for small businesses
- Supply chain & third-party security risks
- Cloud security & remote work protection
- Budget-friendly cybersecurity tools & strategies
š PERFECT FOR:
- UK small business owners (5-50 employees)
- Startup founders & entrepreneurs
- SME managers responsible for IT security
- Professional services firms
- Anyone wanting practical cyber protection advice
Every episode delivers actionable cybersecurity advice that you can implement immediately, featuring real UK case studies
Episodes
Monday Dec 01, 2025
Monday Dec 01, 2025
What if the best way to protect your business isn't copying what the successful companies do, but avoiding what the failures did wrong? Welcome to reverse benchmarking, the cybersecurity equivalent of learning from other people's face-plants so you don't repeat them.
In this episode, Noel and Mauven flip traditional benchmarking on its head. Instead of asking "what are the best companies doing?", they explore the far more revealing question: "what did the disasters get catastrophically wrong?" From the Target breach via an HVAC vendor to ransomware attacks on UK holiday parks, the hosts dissect spectacular cybersecurity failures to extract practical lessons for small businesses.
You'll discover why copying enterprise best practices often backfires for SMBs, how compliance creates dangerous false security, and practical ways to build your own "disaster library" of lessons learned. Plus, the hosts reveal why some of the worst cybersecurity advice comes from studying successful companies rather than failed ones.
This isn't just negativity packaged as strategy. It's a systematic approach to identifying your business's genuine vulnerabilities by examining where others fell through the cracks. Because in cybersecurity, knowing what not to do is often more valuable than copying what others claim works.
Why This Episode Matters
One in three small businesses were hit by cyberattacks last year. The average cost? A quarter of a million pounds, with some reaching seven million. But here's the crushing statistic: 60% of small businesses close within six months of a cyber incident.
Traditional benchmarking tells you to copy what big enterprises do. Reverse benchmarking shows you what kills businesses like yours, so you can avoid becoming the cautionary tale in someone else's podcast.
Key Takeaways
1. Traditional Benchmarking Often Fails SMBs
- Copying FTSE 100 security on a shoestring budget is a losing game
- Enterprise solutions don't scale down effectively
- By the time you copy last year's "best practice," threats have evolved
- Context matters more than copying
2. Compliance ā Security
- Being compliant doesn't mean you're secure
- Compliance is like passing your driving test - it proves you know the rules, not that you'll never crash
- Checkbox culture creates dangerous complacency
- Attackers don't check your certifications before striking
3. The Statistics Are Sobering
- One third of SMBs hit by cyberattacks annually
- Average breach cost: Ā£250,000
- Some breaches: Ā£7 million
- 60% of small businesses close within six months post-attack
- NCSC estimates 50% of UK SMBs will experience a breach each year
4. Real-World Disasters Teach Practical Lessons
- Target breach: Lost $162 million because HVAC vendor credentials weren't properly segmented
- Colonial Pipeline: Shutdown of major US fuel infrastructure from weak VPN password
- UK holiday park ransomware: Peak season attack forced cash-only operations
- Common thread: Basic security fundamentals ignored
5. Third-Party Risks Are Existential
- 61% of breaches involve third-party access
- Small vendors create backdoors into larger networks
- Your security is only as strong as your weakest supplier
- Segment vendor access ruthlessly
6. Practical Implementation Steps
- Build your own "disaster library" of relevant failures
- Hold quarterly "what went wrong" review sessions
- Map your business to failed case studies
- Ask "could this happen to us?" for every breach you read about
- Create no-blame culture for reporting near-misses
Detailed Show Notes
Introduction (00:00 - 01:24)
Noel poses a simple question: in the pub, what do people talk about? Their wins, mostly. This episode does the opposite by examining failures instead of successes. The hosts introduce "reverse benchmarking" as the Darwin Awards of cybersecurity, learning from others' digital disasters rather than bragging about fancy firewalls.
Key Quote: "Learn from other people's face-plants so we don't repeat them."
What Is Reverse Benchmarking? (01:24 - 03:46)
Traditional benchmarking means copying what successful companies do. Reverse benchmarking flips this around: study the worst failures in your industry and make certain you don't repeat them.
The Problem with Traditional Benchmarking:
- Big enterprises have massive IT teams and unlimited budgets
- Trying to copy enterprise security on SMB resources is futile
- Benchmarking looks backwards - by the time you implement, hackers have moved on
- If everyone in your industry has the same gap, benchmarking won't reveal it
Why It Matters Now:
- One third of SMBs were hit by cyberattacks in the past year
- Average cost: Ā£250,000, with some reaching Ā£7 million
- 60% of small businesses close within six months of a cyberattack
- Most small business owners still think they're too small to be targeted
UK Context: The National Cyber Security Centre (NCSC) estimates around half of UK SMBs will experience a breach each year. Coin flip odds. If you're sitting in a board meeting saying "hackers won't bother with us," you might as well hang a sign reading "free Wi-Fi, no password."
The Compliance Trap (03:46 - 06:15)
Many businesses believe being compliant means they're secure. This is cybersecurity's biggest misconception.
Compliance vs Security:
- Compliance is like passing your driving test - it means you know the rules, not that you'll never crash
- Or that you're a good driver
- Microsoft's security GM: "Some SMBs believe being compliant means they're safe. It doesn't."
- Hackers don't check whether you've got ISO certification before attacking
The Checkbox Culture:
- "We did our annual password change. Job done."
- Hackers respond: "Challenge accepted."
- Following checklists creates false sense of security
- Real security requires ongoing vigilance, not annual tick-boxes
The Hidden Risk: If everyone in your industry has the same security gap but meets the same compliance standards, benchmarking against them won't reveal your shared vulnerability. You're all vulnerable together, congratulating each other on your certifications.
Case Study 1: The Target Breach (06:15 - 09:42)
One of retail history's most infamous breaches demonstrates how third-party access becomes a catastrophic liability.
What Happened:
- December 2013: Hackers stole 40 million credit card numbers and 70 million customer records
- Entry point: HVAC contractor with network access
- Attackers used vendor credentials to access Target's corporate network
- Then moved laterally to payment systems
The Aftermath:
- Direct losses: $162 million
- CEO resigned
- CIO resigned
- Board chairman resigned
- Countless hours dealing with breach response, forensics, legal battles
The Lesson: Your security is only as strong as your weakest supplier. That HVAC company, plumber, or IT consultant with network access? They're potential backdoors. Target's enterprise-grade security was bypassed through a small contractor's weak credentials.
For Small Businesses:
- 61% of breaches involve third-party access
- Small businesses often provide services to larger enterprises
- Your compromise becomes their breach
- Vendor management isn't optional
Practical Actions:
- Segment vendor access ruthlessly
- No contractor needs access to your entire network
- Use separate credentials for third parties
- Monitor vendor access continuously
- Regular vendor security audits
Case Study 2: Colonial Pipeline (09:42 - 12:28)
In May 2021, a single compromised password shut down a major fuel pipeline supplying 45% of the US East Coast's fuel.
What Happened:
- Ransomware attack forced shutdown of 5,500-mile pipeline
- Entry point: Weak VPN password
- No multi-factor authentication (MFA) on VPN access
- Company paid $4.4 million ransom (partially recovered later)
The Impact:
- Fuel shortages across southeastern United States
- Panic buying, price spikes
- Emergency government declarations
- Week-long shutdown of critical infrastructure
The Lesson: Credentials are your front door. If you're not protecting them properly, you've left the door unlocked with a welcome mat out for attackers.
For Small Businesses: The Colonial Pipeline didn't fail because of sophisticated zero-day exploits or nation-state malware. They failed because they didn't have MFA enabled on remote access.
Your Action Items:
- Enable MFA everywhere, particularly VPN access
- Enforce strong password policies
- Monitor for credential compromise
- Phishing-resistant MFA (hardware tokens or biometrics) for privileged access
- Regular access reviews
The Cost-Benefit Reality:
- Hardware security keys: Ā£40-70 per user
- Potential breach cost: Ā£250,000 average
- MFA prevents 99.9% of automated credential attacks
- The mathematics are straightforward
Case Study 3: UK Holiday Park Ransomware (12:28 - 15:15)
Closer to home, a UK holiday park discovered that timing matters when ransomware strikes.
What Happened:
- Ransomware attack during peak summer season
- All booking systems encrypted
- Payment processing down
- Guest check-ins disrupted
The Business Impact:
- Had to operate cash-only during busiest period
- Couldn't process new bookings
- Lost revenue during most profitable weeks
- Guest experience severely compromised
- Reputation damage
The Lesson: Attackers choose timing deliberately. They struck during peak season when the business would be most desperate to restore operations quickly and most likely to pay the ransom.
For Small Businesses: Seasonal businesses are particularly vulnerable during peak periods. That's precisely when attackers strike, knowing you can't afford downtime.
Your Defence Strategy:
- Offline, air-gapped backups tested regularly
- Incident response plan practiced before peak season
- Alternative payment processing methods ready
- Staff trained on ransomware procedures
- Crisis communication templates prepared
The Backup Reality: Having backups isn't enough. You need to test restoration procedures. The middle of a ransomware attack is not the time to discover your backups don't work or take three weeks to restore.
Why Reverse Benchmarking Works Better (15:15 - 17:45)
Traditional approaches focus on aspirational goals. Reverse benchmarking focuses on avoiding catastrophic failures.
The Psychological Advantage:
- Failures provide concrete examples of what not to do
- Success stories often omit the messy details
- Disasters reveal the actual attack patterns you'll face
- Real consequences make lessons stick
The Practical Advantage:
- You learn what actually breaks in the real world
- Not theoretical best practices that might work
- Understand attack chains step by step
- See how small gaps become massive breaches
The Cost Advantage:
- Avoiding one disaster pays for years of modest security investment
- You don't need enterprise budgets to avoid enterprise mistakes
- Focus resources on genuine vulnerabilities
- Not on impressive-sounding but irrelevant controls
The Timeliness Advantage:
- Recent failures reflect current threat landscape
- More relevant than last year's "best practices"
- See how threats evolve in real-time
- Adapt defences to actual attack methods
Building Your Disaster Library (17:45 - 19:29)
Practical implementation of reverse benchmarking for your business.
Step 1: Collect Relevant Failures
- Focus on breaches in similar-sized businesses
- Same industry or adjacent sectors
- Similar technology stack
- Geographic relevance (UK regulations, threat actors)
Step 2: Quarterly Review Sessions
- "What went wrong" meetings with your team
- Review recent breaches systematically
- Ask: "Could this happen to us?"
- Identify similar vulnerabilities in your environment
Step 3: Map to Your Environment
- For each breach, trace the attack path
- Identify which elements exist in your business
- Where are your equivalent vulnerabilities?
- What would the impact be if it happened to you?
Step 4: Prioritise Actions
- Not every lesson requires immediate implementation
- Focus on high-probability, high-impact scenarios first
- Quick wins vs long-term projects
- Balance cost against realistic risk
Step 5: Create Your "Anti-Playbook"
- Document what you'll never do based on failure analysis
- Share with team so everyone knows the "forbidden" approaches
- Update as new disasters emerge
- Make it living document, not static policy
Resources to Monitor:
- NCSC Weekly Threat Reports
- Information Commissioner's Office (ICO) breach reports
- Industry-specific security bulletins
- UK Cyber Security News
- Global breach databases with UK filter
Creating a No-Blame Culture (19:29 - 20:45)
If people hide mistakes, you lose the chance to fix vulnerabilities before an actual breach occurs.
The Aviation Model: Airlines improve safety by fostering no-blame culture for near-misses. They want to hear about every close call so they can fix systemic issues before disaster strikes.
Applying This to Cybersecurity: If Janet in accounting falls for a phishing test, berating her is counterproductive. Instead, make it a learning opportunity for everyone. Next time, she might be the one to spot a real phishing attempt and save your business.
Practical Implementation:
- "Lessons learned" sessions, not "who screwed up" meetings
- Focus on systems and processes, not individuals
- Reward reporting of near-misses
- Share failures anonymously when needed
- Celebrate catches of suspicious activity
The Payoff: Fear doesn't work. Education does. When people feel safe reporting potential issues, you catch problems early before they become breaches.
Summary and Call to Action (20:45 - 21:37)
Sometimes the best way to secure your business is by studying the worst failures out there and doing the opposite.
Key Principles:
- Traditional benchmarking can lead you astray for SMBs
- Reverse benchmarking provides genuine security advantage
- Study disasters: Target, Colonial Pipeline, holiday park ransomware
- Build it into regular practice, not one-off exercise
Your Mindset Shift: Think of yourself as Sherlock Holmes of cyber failures. Every incident is a case study that makes your business smarter. In cybersecurity, boring is good. If nothing's happening, it means your defences are working.
Immediate Actions:
- Start your disaster library this week
- Schedule your first quarterly review session
- Map one recent breach to your business environment
- Implement one lesson learned from this episode
- Share this approach with your team
Resources Mentioned
Statistics and Studies
- National Cyber Security Centre (NCSC): UK SMB breach probability estimates
- Microsoft Security: Compliance vs security research
- Industry reports: 61% of breaches involve third-party access
- Bernard Ma: Quote on benchmarking limitations
Case Studies Referenced
- Target Corporation data breach (2013): HVAC vendor compromise, 40 million cards stolen, $162 million loss
- Colonial Pipeline ransomware (2021): VPN password compromise, $4.4 million ransom, critical infrastructure shutdown
- UK holiday park ransomware: Peak season attack, cash-only operations
UK Regulatory and Advisory Bodies
- National Cyber Security Centre (NCSC): www.ncsc.gov.uk
- Information Commissioner's Office (ICO): www.ico.org.uk
Recommended Reading
- NCSC Weekly Threat Reports
- ICO breach notifications and enforcement actions
- Industry-specific security bulletins
- UK Cyber Security News aggregators
Practical Checklist: Start Your Reverse Benchmarking Practice
This Week:
- Create a folder or document for your "disaster library"
- Sign up for NCSC weekly threat report emails
- Identify three recent breaches in businesses similar to yours
- Schedule your first quarterly "what went wrong" review meeting
This Month:
- Map one major breach to your business environment
- Identify your equivalent vulnerabilities to the mapped breach
- Implement one quick-win lesson from disaster analysis
- Share this approach with your leadership team
This Quarter:
- Hold your first formal reverse benchmarking session
- Build your "anti-playbook" of forbidden approaches
- Establish no-blame reporting culture for near-misses
- Review and update third-party access controls
Ongoing:
- Weekly review of new breach reports
- Monthly check: "Could this happen to us?"
- Quarterly team review sessions
- Annual comprehensive vulnerability mapping
Questions for Your Team
Use these discussion prompts in your quarterly review sessions:
- Which recent breach in our industry most closely resembles our business model?
- Do we have the same entry points that attackers used in [specific breach]?
- What would be our equivalent business impact if we experienced this type of attack?
- Which quick fixes could we implement this month to avoid similar failures?
- What systemic vulnerabilities do we share with failed organisations?
- Are we making the same assumptions that led to their breach?
- Would our backup and recovery process work in a real crisis?
- Do our third-party vendors have access they don't need?
- Where are we relying on compliance rather than actual security?
- What's our single point of failure that resembles their weakness?
Next Episode Preview
Episode 30: The Office Printer Hacker Saga
Yes, office printers are a genuine security risk. Sounds hilarious, but it's genuinely scary. We'll explore why that seemingly innocent device in the corner is actually a network-connected computer with hard drives, stored documents, and often the same default admin password it shipped with.
You'll discover the printer botnet that attacked an entire city, the university students who made campus printers output memes, and why your MFP (multi-function printer) knows more about your business than you'd be comfortable with.
If you think printers are just about paper jams and toner costs, this episode will open your eyes to why printer security belongs in your threat model. Subscribe so you don't miss it.
Share Your Story
Have you learned from a cybersecurity blunder, either your own or someone else's? We'd love to hear about it. Send your story to us (anonymously if you prefer), and we might feature it in a future episode.
Got a cybersecurity dilemma keeping you up at night? Send it our way. We'll tackle it in our down-to-earth style in upcoming episodes.
Connect With The Show
Subscribe: Available on Apple Podcasts, Spotify, and all major podcast platforms
Leave a Review: Your reviews help other small business owners find practical cybersecurity advice
Website: thesmallbusinesscybersecurityguy.co.uk
Email: hello@thesmallbusinesscybersecurityguy.co.uk
Legal Disclaimer
The views and opinions expressed in this podcast are those of the hosts and do not necessarily reflect the official policy or position of any organisations they work for, employers, advertisers, sponsors, or any other entities connected to the show.
This podcast is for general educational and informational purposes only. It should not be treated as professional advice tailored specifically to your business circumstances. Your situation is unique, and you should consult with qualified cybersecurity professionals before implementing significant changes to your systems.
Whilst we strive to keep all information accurate and current, the cybersecurity landscape evolves rapidly. Always verify critical technical details with qualified professionals before making major decisions.
We cannot accept liability for any losses or problems that may result from following the suggestions in this podcast. Please think of us as knowledgeable colleagues sharing insights, not contracted consultants providing formal advice. When in doubt, get a second opinion from someone who can assess your specific situation.
Copyright Ā© 2025 The Small Business Cyber Security Guy. All rights reserved.
Episode Tags
#Cybersecurity #SmallBusiness #ReverseBenchmarking #CyberThreats #DataBreach #UKBusiness #SMBSecurity #InformationSecurity #ThreatIntelligence #SecurityStrategy #BusinessProtection #CyberResilience #RiskManagement #SecurityPodcast #UKCyber #NCSC #ThirdPartyRisk #ComplianceVsSecurity #CyberEducation #BusinessContinuity
Monday Nov 24, 2025
Monday Nov 24, 2025
In this provocative second instalment of the accountability series, hosts Noel Bradford and Mauven MacLeod lay out a detailed proposal for a UK cybersecurity enforcement regime that balances protection for small businesses with personal liability for negligent directors. They compare the current weak regulatory approach to the Health and Safety Executive model, cite international evidence from Singapore, and explore why criminal consequences ā up to fines, disqualification and, in extreme cases, prison ā might be necessary to change boardroom behaviour.
The episode explains a three-tier framework: Tier 1 (micro and small businesses) protected by Cyber Essentials and criminal liability only for gross negligence; Tier 2 (25ā250 employees) required to follow industry-reasonable practice with qualified oversight and documented policies; and Tier 3 (large organisations and public sector) held to the highest standards (ISO/SOC) with lower thresholds for prosecution. The hosts walk through concrete, measurable standards, outcome-based testing, and safe-harbour defences for businesses that engage accredited advisors.
Key technical and organisational measures discussed include Cyber Essentials, MFA, patching and backups, incident response plans, staff training, qualified security oversight (fractional CISOs or accredited MSPs), and government-approved lists of assessors. The episode stresses practical testing ā inspectors verifying controls actually work ā to prevent compliance theatre and ensure certificates match reality.
Noel and Mauven outline a phased five-year implementation pathway: publication and guidance, data collection and mandatory reporting, staged enforcement beginning with large organisations, then medium businesses, and finally full enforcement ā all accompanied by funded support programs, subsidies, and free advisory services to help firms comply.
Costs, benefits and market effects are examined: basic Tier 1 protections are framed as affordable (Cyber Essentials, free MFA), while stronger governance yields lower insurance premiums, preferential procurement, and overall reduced breach costs. The hosts discuss the need to upskill the ICO into a technically capable enforcement agency, political and industry pushback, and international alignment with EU, Singapore and Australia precedents.
The episode closes with a call to action for listeners: implement the basics now (Cyber Essentials, MFA, updates), pressure MPs and industry bodies for proportionate enforcement, and spread the conversation. Expect debates about proportionality, false positives, and safeguarding SMEs, but the central case is clear: a calibrated, evidence-based accountability regime could dramatically reduce breaches and force cybersecurity into the boardroom.
Monday Nov 17, 2025
Monday Nov 17, 2025
What happens when business negligence causes serious harm to thousands of people? If a faulty ladder injures someone, directors face prison time. If forty million people have their data stolen due to poor security, they receive a strongly worded letter.
In this provocative first episode of our two-part series, Noel and Mauven examine the shocking disparity between health and safety enforcement and cybersecurity regulation in the UK. We compare the HSE's tough approach (prison sentences, director liability, millions in fines) with the ICO's gentle touch (guidance, occasional fines, zero criminal consequences).
With 40 million voter records compromised at the Electoral Commission resulting in just a formal reprimand, whilst construction directors regularly face 18-month prison sentences for single workplace accidents, we ask the uncomfortable question: why is cybersecurity enforcement essentially performative?
This isn't anti-business rhetoric. This is an evidence-based examination of a broken system that fails to protect either businesses or the public, presented through statistics, case studies, and historical precedent, which demonstrates that personal accountability is effective.
What You'll Learn
The Two Regulators: A Tale of Vastly Different Consequences
- Why HSE directors face up to 2 years imprisonment, whilst the ICO never imposes criminal penalties
- How HSE issued 13,424 enforcement notices and 399 prosecutions in 2023-24
- Why the ICO issued just Ā£2.7 million in total UK fines, whilst EU regulators issued over Ā£1 billion
- The legal frameworks that create this enforcement gap
The Public-Private Accountability Divide
- Electoral Commission breach: 40 million records compromised, 14 months of hostile state access, consequence: formal reprimand
- Construction site failures: single injuries lead to prison sentences and director disqualifications
- Why do government organisations face minimal consequences for security failures
- The message this sends about who matters and who doesn't
Historical Context: How HSE Transformed Workplace Safety
- 85% reduction in workplace fatalities since the Health and Safety at Work Act 1974
- How personal criminal liability changed director behaviour overnight
- The construction industry transformation from dangerous to safety-conscious
- Evidence that accountability actually works when properly enforced
Arguments Against Director Liability (And Why They Fail)
- "Security is too complex for criminal standards" - why doesn't this hold up
- "Small businesses can't afford proper security" - HSE already handles proportionate enforcement
- "Innovation will suffer" - data showing the opposite effect in the safety sector
- "Current system works fine" - statistics proving it demonstrably doesn't
The Current State of Inertia
- Why ICO enforcement focuses on "guidance and support" over punishment
- Political pressure keeps cybersecurity consequences minimal
- Business lobby resistance to accountability measures
- The broken incentive structure that rewards negligence
Key Statistics Referenced
-
HSE Enforcement 2023-24:
- 13,424 enforcement notices issued
- 399 prosecutions brought
- Ā£73.8 million in fines
- Regular prison sentences (average 12-18 months for serious breaches)
-
ICO Enforcement 2023-24:
- Ā£2.7 million total fines across all UK GDPR violations
- Zero prison sentences imposed
- Zero director disqualifications
- Focus on "guidance and support" over punishment
-
Electoral Commission Breach:
- 40 million UK voter records compromised
- The hostile state actor maintained access for 14 months
- Basic security failures: poor patching, weak passwords, inadequate monitoring
- Consequence: Formal reprimand only
-
Impact Statistics:
- 85% reduction in workplace fatalities since the Health and Safety at Work Act 1974
- EU regulators issued over Ā£1 billion in GDPR fines (vs the UK's Ā£2.7 million)
- Keymark Construction director: 18 months' prison for fatal fall (2023)
Notable Cases Discussed
Health and Safety Enforcement
- Keymark Construction (2023): Director sentenced to 18 months imprisonment following fatal fall due to inadequate safety measures
- Corporate Manslaughter Act 2007: Multiple organisations convicted when management failures caused death
Cybersecurity Non-Enforcement
- Electoral Commission (2023-24): 40 million voter records compromised by hostile state actor, 14 months of system access, consequence was formal reprimand with no financial penalty or personal liability
- British Airways GDPR Fine: Initially Ā£183 million, reduced to Ā£20 million, no director consequences despite preventable security failures
Why This Matters for Small Businesses
This isn't about attacking business owners. It's about exposing a system that fails everyone:
- Honest businesses suffer when competitors cut security corners without consequences
- Directors lack incentive to invest in security when breaches only result in fines the company pays
- Small businesses become collateral damage when larger organisations treat security as optional
- The current approach demonstrably doesn't work - breaches increase year on year despite ICO "guidance"
Understanding this enforcement gap helps you see why cybersecurity culture hasn't undergone the same transformation as workplace safety culture. Part 2 will explore what accountability with teeth would actually look like, and how to protect SMEs whilst implementing it.
Resources Mentioned
- HSE Annual Report 2023-24: Full enforcement statistics and prosecution details
- ICO Enforcement Data: Annual reports showing UK GDPR fine totals
- Health and Safety at Work Act 1974: Foundation legislation that transformed UK workplace safety
- Corporate Manslaughter and Corporate Homicide Act 2007: Criminal liability framework for organisations
- Electoral Commission Breach Report: Technical details of 14-month compromise
- EU GDPR Enforcement Tracker: Comparison of UK vs European enforcement approaches
Hosts
Noel Bradford 40+ years in IT/Cybersecurity across enterprise and SMB sectors. Former Intel, Disney, BBC. Current CIO/Head of Technology for boutique security-first MSP. Brings enterprise-level knowledge to small business constraints.
Mauven MacLeod Ex-NCSC Government Cybersecurity Analyst with deep threat intelligence expertise. Glasgow-based security professional who translates complex government-level security concepts into practical SMB advice.
Coming in Part 2
"What If Cyber Had Corporate Manslaughter? The Case for Personal Liability"
We'll explore:
- Specific legislative framework for "Corporate Cyber Manslaughter"
- SME protection mechanisms (proportionate thresholds)
- How other countries successfully implement director liability
- Expected cultural transformations
- Practical compliance guidance
- What "reasonable care" actually means for small businesses
Take Action
-
Share Your Thoughts: Should directors face criminal liability for gross cybersecurity negligence? Comment on our website or social media.
-
Prepare for Part 2: Start thinking about what security measures you currently have in place. Could you demonstrate "reasonable care" if asked?
-
Review Your Security: Whilst we wait for better enforcement, don't wait to improve your security. Free resources available from NCSC.
-
Subscribe: Make sure you don't miss Part 2, where we build the case for what enforcement with teeth would actually look like.
-
Forward This Episode: Every business owner needs to understand why the current system fails them.
Episode Details
Runtime: 42 minutes
Release Date: November 17th 2025
Series: Part 1 of 2
Category: Cybersecurity, Business, Technology, Policy
Content Warning: Discussion of regulatory failures, system criticism, and calls for significant policy change. Evidence-based but provocative examination of current enforcement approaches.
Connect With Us
Website: thesmallbusinesscybersecurityguy.co.uk
LinkedIn: [The Small Business Cyber Security Guy]
Email: hello@thesmallbusinesscybersecurityguy.co.uk
Tags
#Cybersecurity #SmallBusiness #UKBusiness #DataProtection #ICO #HSE #RegulatoryEnforcement #DirectorLiability #GDPR #BusinessSecurity #CyberAccountability #SecurityPolicy #UKRegulation #DataBreach #ElectoralCommission #CorporateManslaughter #BusinessCompliance #CyberGovernance #SecurityLeadership #RiskManagement
Transcript
Full episode transcript available on our website at thesmallbusinesscybersecurityguy.co.uk
Support the Show
If this episode opened your eyes to the enforcement gap, please:
- Leave a 5-star review on Apple Podcasts
- Share with business owners in your network
- Follow us on LinkedIn for ongoing discussion
- Subscribe to ensure you catch Part 2
Next Episode: Part 2 - What If Cyber Had Corporate Manslaughter?
All Episodes: thesmallbusinesscybersecurityguy.co.uk/podcasts
The Small Business Cybersecurity Guy Podcast offers practical, actionable cybersecurity advice for UK small businesses. We translate enterprise-grade security into affordable, implementable solutions for businesses with 5-50 employees.
Disclaimer: This podcast provides general information and discussion about cybersecurity and business topics. This is not intended as legal, regulatory, or professional advice. Listeners should consult qualified professionals for personalised guidance tailored to their specific circumstances.
Ā© 2025 The Small Business Cyber Security Guy. All rights reserved.
Tuesday Nov 11, 2025
Tuesday Nov 11, 2025
Graham Falkner delivers an authoritative deep dive into November 2025's Patch Tuesday updates, covering the most critical security vulnerabilities affecting businesses of all sizes. This month brings a perfect storm of actively exploited zero-days, critical Exchange Server flaws, and hundreds of patches across Microsoft, Adobe, Oracle, SAP, and third-party vendors. From Windows kernel exploits to e-commerce platform takeovers, November's vulnerability landscape demands immediate attention from IT teams.
Key Topics Covered
Microsoft Security Updates
- 89 total vulnerabilities patched (12 critical, 4 zero-days)
- CVE-2025-0445: Windows Kernel privilege escalation (actively exploited)
- CVE-2025-0334: Chrome V8/Edge JavaScript engine RCE (actively exploited)
- CVE-2025-0078: Exchange Server unauthenticated RCE (CRITICAL - affects Exchange 2016/2019/2022)
- CVE-2025-1789: MSHTML remote code execution via Office documents
- CVE-2025-59287: WSUS vulnerability (9.8 CVSS, actively exploited, required re-release)
- 23 remote code execution vulnerabilities across Windows, Office, and developer tools
Adobe Security Updates
- 35+ vulnerabilities patched across multiple products
- CVE-2025-54236: Adobe Commerce/Magento input validation flaw (9.1 CVSS, actively exploited, Priority 1)
- CVE-2025-49553: Adobe Connect XSS vulnerability (9.3 CVSS)
- Patches for Illustrator, FrameMaker, Photoshop, InDesign, Animate, Bridge, Substance 3D
Oracle Critical Patch Update (October 2025)
- 374 new security patches addressing ~260 unique CVEs
- CVE-2025-61882: Oracle E-Business Suite zero-day (exploited by ransomware groups)
- 73 patches for Oracle Communications (47 remotely exploitable without authentication)
- 20 patches for Fusion Middleware (17 remote unauthenticated)
- 18 fixes for MySQL
- Updates for PeopleSoft, JD Edwards, Siebel, Oracle Commerce, Database Server
SAP Security Updates
- 18 new security notes plus 1 updated note
- CVE-2025-42890: SQL Anywhere Monitor hardcoded credentials (10.0 CVSS - PERFECT SCORE)
- CVE-2025-42887: SAP Solution Manager code injection (9.9 CVSS)
- CVE-2025-42944: NetWeaver Java insecure deserialisation (updated patch)
- CVE-2025-42940: CommonCryptoLib memory corruption
Mozilla Firefox Updates
- Firefox 145.0 released November 11th
- 15 security vulnerabilities fixed (8 high impact)
- New anti-fingerprinting measures halving trackable users
- Memory safety and sandbox escape prevention
Apple Security Updates
- iOS/iPadOS 17.1 and macOS 14.1 released
- 100+ vulnerabilities patched across iPhones, iPads, Macs
- Critical kernel and WebKit bugs fixed
- Zero-click exploit prevention
Google Security Updates
- Chrome 142 with 5 security bug fixes
- Android November 2025 bulletin (patch level 2025-11-01)
- CVE-2025-48593 and CVE-2025-48581 affecting Android 13-16
Third-Party Critical Vulnerabilities
- WordPress Post SMTP plugin: CVE-2025-11833 (9.8 CVSS, actively exploited, 200,000+ sites affected)
- WatchGuard Firebox: CVE-2025-9242 (critical out-of-bounds write, 75,000 devices exposed)
- Cisco IOS/XE routers: CVE-2025-20352 (SNMP service, actively exploited for rootkit deployment)
Critical Action Items for Businesses
IMMEDIATE (Deploy Within 24-48 Hours)
- Microsoft Exchange Server - Apply CVE-2025-0078 patch or isolate internet-facing servers
- Adobe Commerce/Magento - Deploy CVE-2025-54236 hotfix immediately if running Magento
- Windows Kernel - Patch CVE-2025-0445 zero-day exploit
- Edge/Chrome - Update browsers to address CVE-2025-0334
- Oracle E-Business Suite - Verify CVE-2025-61882 patch deployed
- WordPress Post SMTP - Update to v3.6.1 or remove plugin
- Cisco routers - Apply CVE-2025-20352 patches and check for compromise
HIGH PRIORITY (Deploy Within 1 Week)
- SAP systems - Apply critical patches for CVE-2025-42890 and CVE-2025-42887
- WSUS servers - Verify CVE-2025-59287 patch installed correctly
- Adobe Connect - Update to version 12.10
- Firefox, Chrome, Edge - Deploy browser updates organisation-wide
- Android devices - Deploy November 2025 security bulletin
- WatchGuard Firebox - Apply CVE-2025-9242 patch
STANDARD PRIORITY (Deploy Within 2-4 Weeks)
- All other Microsoft patches - Complete Windows and Office updates
- Adobe Creative Suite - Update Illustrator, Photoshop, InDesign, etc.
- Oracle - Complete October CPU deployment across all Oracle products
- SAP - Apply remaining security notes across SAP landscape
CVE Quick Reference
| CVE ID | Vendor | Severity | Status | Product |
|---|---|---|---|---|
| CVE-2025-0445 | Microsoft | Critical | Actively Exploited | Windows Kernel |
| CVE-2025-0334 | Microsoft | Critical | Actively Exploited | Edge/Chrome V8 |
| CVE-2025-0078 | Microsoft | Critical | Not Exploited Yet | Exchange Server |
| CVE-2025-1789 | Microsoft | Critical | Not Exploited Yet | MSHTML |
| CVE-2025-59287 | Microsoft | Critical (9.8) | Actively Exploited | WSUS |
| CVE-2025-54236 | Adobe | Critical (9.1) | Actively Exploited | Magento/Commerce |
| CVE-2025-49553 | Adobe | Critical (9.3) | Not Exploited Yet | Adobe Connect |
| CVE-2025-61882 | Oracle | Critical | Actively Exploited | E-Business Suite |
| CVE-2025-42890 | SAP | Critical (10.0) | Not Exploited Yet | SQL Anywhere Monitor |
| CVE-2025-42887 | SAP | Critical (9.9) | Not Exploited Yet | Solution Manager |
| CVE-2025-11833 | WordPress | Critical (9.8) | Actively Exploited | Post SMTP Plugin |
| CVE-2025-20352 | Cisco | High | Actively Exploited | IOS/XE SNMP |
| CVE-2025-9242 | WatchGuard | Critical | Not Exploited Yet | Firebox Firewalls |
Resources & Links
Vendor Security Bulletins
- Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide
- Adobe Security Bulletins: https://helpx.adobe.com/security.html
- Oracle Critical Patch Updates: https://www.oracle.com/security-alerts/
- SAP Security Notes: https://support.sap.com/securitynotes
- Mozilla Security Advisories: https://www.mozilla.org/security/advisories/
- CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Patch Tuesday Resources
- Microsoft Tech Community: https://techcommunity.microsoft.com/
- Patch Tuesday Dashboard: https://patchtuesdaydashboard.com/
- Security Week Patch Tuesday Coverage: https://www.securityweek.com/
Small Business Cybersecurity Resources
- Blog: https://thesmallbusinesscybersecurityguy.co.uk
- NCSC Small Business Guide: https://www.ncsc.gov.uk/smallbusiness
- Cyber Essentials: https://www.ncsc.gov.uk/cyberessentials
Key Statistics
- 89 Microsoft vulnerabilities patched
- 4 actively exploited zero-days (Microsoft)
- 23 remote code execution flaws (Microsoft)
- 35+ Adobe vulnerabilities fixed
- 374 Oracle security patches
- 18 SAP security notes
- 200,000+ WordPress sites affected by Post SMTP bug
- 75,000 WatchGuard devices exposed online
Narrator
Graham Falkner brings his distinctive voice to The Small Business Cyber Security Guy Podcast's research segments. With a background as a former movie trailer narrator and Shakespearean actor, Graham delivers technical security information with gravitas and authority, providing the factual foundation for Noel and Mauven's practical discussions.
About The Small Business Cyber Security Guy Podcast
The Small Business Cyber Security Guy Podcast translates enterprise-grade cybersecurity into practical, affordable solutions for small and medium businesses. Hosted by Noel Bradford (40+ years IT/cybersecurity veteran) and Mauven MacLeod (ex-NCSC government analyst), the show combines deep technical expertise with authentic British humour to make cybersecurity accessible, actionable, and entertaining.
Target Audience: UK small businesses (5-50 employees) who need practical cybersecurity advice within real-world budget and resource constraints.
Connect With Us
- Website: https://thesmallbusinesscybersecurityguy.co.uk
- Subscribe: Available on Apple Podcasts, Spotify, and all major podcast platforms
- Social Media: Follow us on LinkedIn for daily cybersecurity insights
- Contact: hello@thesmallbusinesscybersecurityguy.co.uk
Ā
Help us spread the word about practical cybersecurity for small businesses:
- ā Subscribe to never miss an episode
- ā Leave a review on Apple Podcasts or Spotify
- ā Share this episode with other business owners who need to hear this
- ā Comment below with topics you'd like us to cover next
- ā Visit the blog at thesmallbusinesscybersecurityguy.co.uk for written guides and resources
Disclaimer
This podcast provides educational information about cybersecurity topics. While we strive for accuracy, the threat landscape changes rapidly. Information is current as of November 2025 but may become outdated. Always verify patch information with official vendor sources and test updates in your specific environment before deployment. The hosts are not liable for any actions taken based on this information. Always implement cybersecurity measures appropriate to your business needs and risk profile.
Next Episode
Stay tuned for our next episode where Noel and Mauven discuss practical patch management strategies for small businesses, including how to prioritise updates when you can't deploy everything immediately.
Episode Length: 10-11 minutes
Difficulty Level: Intermediate to Advanced
Best For: IT managers, business owners, MSP clients, anyone responsible for patching
The Small Business Cyber Security Guy Podcast - Making Enterprise Cybersecurity Practical for Small Businesses
Tuesday Nov 11, 2025
Tuesday Nov 11, 2025
The Spy Who Monitored Me - Ofcom's VPN Surveillance Farce
Episode Information
Episode Title: The Spy Who Monitored Me: Ofcom's VPN Surveillance Farce
Episode Number: Hot Take
Release Date: 11 November 2025
Duration: Approximately 18 minute
Hosts: Mauven MacLeod & Graham Falkner
Format: Research segment with heavy sarcasm
Episode Description
Ofcom's monitoring VPNs with a secret AI tool they refuse to name. Because nothing says "liberal democracy" quite like government surveillance of privacy tools.
In this punchy episode, Mauven and Graham dissect TechRadar's exclusive revelation that Ofcom is using an unnamed third-party AI monitoring system to track VPN usage following the Online Safety Act. With 1.5 million daily users allegedly bypassing age verification, the UK's communications regulator has decided the solution is... monitoring everyone.
Spoiler alert: the technology can't distinguish between your accounting manager accessing company systems and someone bypassing age checks. But why let technical limitations get in the way of a good surveillance programme?
We examine the mysterious, unnamed AI tool, the questionable 1.5 million user statistic that appears nowhere in official documents, Section 121's encryption-breaking powers that remain dormant in the Act, and what this means for small businesses using VPNs for legitimate security purposes.
If you've ever wondered what it's like when a supposedly liberal democracy starts copying China's approach to internet regulation, this episode is your depressing guide.
Key Topics Covered
The Surveillance Revelation
- Ofcom confirms use of unnamed third-party AI monitoring tool
- TechRadar exclusive: "We use a leading third-party provider" with zero transparency
- Government surveillance of privacy tools sets a dangerous precedent
- Comparison to authoritarian regimes (China, Russia, UAE, Iran)
The Numbers That Don't Add Up
- 1.5 million daily VPN users claim appears nowhere in official Ofcom documents
- No published methodology or verification
- VPN detection cannot determine the intent or legitimacy of use
- Analytics show VPN use is lower in countries with greater online freedom
What Actually Happened on July 25th
- The UK Online Safety Act child safety duties became fully enforceable
- Mandatory "highly effective age assurance" replaced simple checkbox verification
- Proton VPN: 1,400% surge in UK signups within hours
- NordVPN: 1,000% increase in downloads
- ProtonVPN beat ChatGPT to become the #1 free app on Apple UK App Store
The Small Business Nightmare
- Business VPNs are essential security hygiene for remote work
- Ofcom's monitoring cannot distinguish legitimate business use from circumvention
- Undisclosed data collection creates unknowable privacy risks
- GDPR compliance implications when the government monitors your security tools
Section 121: The Spy Clause
- Powers to require client-side scanning of encrypted communications
- Government promises not to use "until technically feasible"
- Cryptography experts: impossible without destroying encryption
- Apple shelved similar plans in 2021
- Signal and WhatsApp threatened to leave the UK market
The Authoritarian Playbook in Action
- Scope creep within days: blocking parliamentary speeches, news coverage, forums
- A cycling forum shut down due to compliance costs
- Small platforms are closing rather than face a compliance nightmare
- Chilling effect on legitimate content and discussion
International Surveillance Creep
- 25 US states passed similar age verification laws
- EU debating Chat Control (mandatory encrypted message scanning)
- Australia is implementing age verification for search engines
- Legislative arms race using "protecting children" as a universal justification
What Small Business Owners Must Do
- Document all VPN usage for legitimate business purposes
- Maintain VPN security protocols despite surveillance theatre
- Get legal advice if operating any platform with user-generated content
- Fines up to Ā£18 million or 10% of global revenue
- Criminal liability for senior managers
The GDPR Compliance Paradox
- How do you assess data protection risks from secret surveillance tools?
- Opacity makes compliance verification impossible
- Government monitoring creates unassessable risks to customer data
Ā
Resources & Links Mentioned
Primary Source
- TechRadar Exclusive: Ofcom is monitoring VPNs following Online Safety Act
Key Organizations Quoted
- Open Rights Group - James Baker's comments on surveillance precedent
- Check Point Software - Graeme Stewart's comparison to China, Russia, and Iran
Government Resources
- Online Safety Act 2023 - UK Government legislation
- Ofcom Online Safety Guidance - Hundreds of pages of vague compliance requirements
- Section 121 - Client-side scanning provisions ("spy clause")
VPN Statistics Sources
- Proton VPN: 1,400% surge report
- NordVPN: 1,000% increase report
- Apple UK App Store rankings: July 25-27, 2025
Related Coverage
- Petition to Repeal Online Safety Act: 550,000+ signatures
- Peter Kyle (UK Technology Secretary) statement on critics
- Parliamentary debate triggered by petition threshold
Additional Reading
- GDPR compliance implications of government surveillance
- Cryptography expert analysis of client-side scanning
- Apple's 2021 decision to shelve client-side scanning plans
- Signal and WhatsApp statements on Section 121
Key Quotes from Episode
Mauven: "Nothing says 'liberal democracy' quite like government agencies tracking privacy tools. What's next, monitoring who buys curtains?"
Graham: "Train its models. That's AI speak for 'we're hoovering up data and hoping the algorithm figures it out.' As a former actor, I can recognise corporate theatre when I see it."
Mauven: "The 1.5 million number appears exclusively in media reports citing 'Ofcom estimates.' It's like citing your mate Dave as a source on quantum physics."
Graham: "So Ofcom creates a law that makes people deeply uncomfortable about their privacy, people respond by protecting their privacy, and Ofcom's solution is to monitor those privacy tools? It's like putting cameras in the changing rooms to make sure people aren't being indecent."
Mauven: "James Baker from the Open Rights Group nailed it when he told TechRadar that VPN monitoring sets 'a concerning precedent more often associated with repressive governments than liberal democracies.'"
Graham: "Peter Kyle, the UK Technology Secretary, literally said critics of the Online Safety Act are 'on the side of predators.' That's not policy debate. That's emotional blackmail designed to shut down legitimate concerns about civil liberties."
Mauven: "George Orwell is looking at this thinking 'bit on the nose, isn't it?'"
Action Items for Small Business Owners
Immediate Actions
-
Document VPN Usage
- List which employees use VPNs
- Document business purposes for encrypted connections
- Maintain evidence of legitimate use for potential regulatory action
-
Maintain Security Protocols
- Continue using VPNs for remote work security
- Don't let surveillance theatre compromise actual cybersecurity
- Protect against real threats (ransomware, phishing, etc.)
-
Assess Platform Compliance
- If you operate any online platform, forum, or user-generated content site
- Get legal advice immediately
- Understand massive fines (Ā£18m or 10% global revenue) and criminal liability.
Ongoing Monitoring
-
Stay Informed
- Section 121 could be activated at any time
- EU Chat Control could affect European operations
- US state laws are proliferating rapidly
- Monitor regulatory developments actively
-
Engage Politically
- Contact your MP about the surveillance of privacy tools
- Reference the 550,000+ signature petition
- Make it clear that this is unacceptable in a democracy
- Push back before surveillance becomes normalised
-
GDPR Compliance Review
- Assess how government VPN monitoring affects data protection obligations
- Document that opacity makes risk assessment impossible
- Consult legal counsel on compliance implications
Visual Elements (for YouTube/Video)
- Screenshot: TechRadar exclusive article headline
- On-screen text: "1.5 million daily VPN users" with question mark
- Comparison graphic: VPN use in free vs. authoritarian countries
- Timeline graphic: July 25th enforcement ā VPN surge ā Ofcom monitoring
- Text overlay: Section 121 "spy clause" powers
- Map graphic: International surveillance legislation spread (UK, US, EU, Australia)
- Infographic: Small business action checklist
Key Themes
- Government surveillance of privacy tools in supposed liberal democracy
- Technical limitations make monitoring ineffective at stated purpose
- Scope creep from child protection to political content blocking within days
- Small business caught in surveillance net designed for age verification
- International trend toward authoritarian internet regulation models
- GDPR compliance paradox when government creates unknowable privacy risks
- Practical cybersecurity must continue despite surveillance theatre
- Political engagement essential before normalization occurs
Tone & Style Notes
- Heavy sarcasm throughout - serious WTF tone without profanity
- Incredulous questioning of government logic and transparency
- Dark humour about dystopian surveillance implications
- Technical precision in explaining what monitoring can/cannot do
- Practical focus on small business implications
- Political urgency without becoming preachy
- Professional skepticism balanced with actionable guidance
CTAs (Calls to Action)
Primary CTAs
- Subscribe wherever you get your podcasts
- Share with other small business owners who need this information
- Leave a review if you found this episode useful (or terrifying)
- Visit the blog at thesmallbusinesscybersecurityguy.co.uk for full breakdown with sources
Secondary CTAs
- Drop a comment with questions about VPN security or regulatory compliance
- Contact your MP about surveillance of privacy tools
- Sign the petition to repeal the Online Safety Act (if not already done)
- Document your VPN usage for legitimate business purposes starting today
Social Media Hashtags
- #OnlineSafetyAct
- #VPNSurveillance
- #CyberSecurity
- #SmallBusinessSecurity
- #DigitalPrivacy
- #GDPR
- #UKTech
- #Section121
Next Episode Setup
[To be determined based on episode schedule]
Potential follow-ups:
- Deep dive on Section 121 and encryption threats
- GDPR compliance strategies in surveillance environment
- International comparison: UK vs. other countries' approaches
- Interview with digital rights expert on fighting surveillance creep
- Practical VPN selection and configuration for small businesses
Production Notes
Technical Specifications
- Duration: Approximately 10 minutes
- Word Count: 1,847 words
- Format: Two-host conversation (Mauven & Graham)
- Tone: Punchy, sarcastic, serious WTF energy
- Language: UK spelling and grammar throughout
- Profanity: None (despite heavy sarcasm)
Research Verification
- All statistics verified against multiple sources
- TechRadar article quotes confirmed accurate
- Government legislation references checked
- VPN provider surge numbers from official company statements
- Expert quotes verified from named sources
- No unverified claims included
Character Dynamics
- Mauven MacLeod: Ex-NCSC analyst, brings government cybersecurity expertise
- Graham Falkner: Former actor/narrator, handles research segments
- Natural professional banter with pub conversation energy
- Shared incredulity at government surveillance overreach
- Complementary expertise: technical precision + narrative delivery
Content Strategy
- Small business cybersecurity focus maintained throughout
- Practical implications prioritized over abstract privacy philosophy
- Action items clear and immediately implementable
- Balances outrage with constructive guidance
- Positions podcast as authoritative voice on UK cybersecurity policy
SEO Keywords
- Ofcom VPN monitoring
- Online Safety Act surveillance
- UK VPN usage 2025
- Business VPN security
- Section 121 encryption
- Small business cybersecurity UK
- GDPR VPN compliance
- Government VPN tracking
- Age verification VPN
- UK internet surveillance
Related Episodes
[To be linked as series develops]
Potential related content:
- Online Safety Act initial coverage (if previously covered)
- GDPR compliance series
- VPN security best practices
- Encryption fundamentals
- Remote work security
Episode Tags
Topics: VPN Surveillance, Online Safety Act, Ofcom, Government Monitoring, Privacy, Encryption, Section 121, Age Verification, GDPR, Small Business Security
Category: Technology, Cybersecurity, Privacy, Government Policy, Business
Difficulty Level: Intermediate (technical concepts explained accessibly)
Target Audience: Small business owners (5-50 employees), IT managers, privacy advocates, UK businesses
Geographic Focus: United Kingdom (with international context)
Credits
Hosts: Mauven MacLeod, Graham Falkner
Research: Advanced web research on Ofcom VPN monitoring
Script: Based on TechRadar exclusive and verified sources
Production: Graham Falkner
Music: The Small Business Cyber Security Guy
Disclaimer
This podcast episode provides commentary and analysis on publicly reported information about UK government surveillance policies. Nothing in this episode constitutes legal advice. Small business owners should consult qualified legal counsel regarding compliance with the Online Safety Act and related regulations. The opinions expressed are those of the hosts and do not represent legal or professional advice.
All statistics and quotes have been verified against multiple sources and represent information available as of the episode recording date. The regulatory landscape continues to evolve rapidly.
Blog Post Companion
Full written breakdown available at: thesmallbusinesscybersecurityguy.co.uk
Blog post should include:
- Complete source list with hyperlinks
- Detailed analysis of Section 121 implications
- Step-by-step VPN documentation guide for businesses
- GDPR compliance checklist
- Template for MP correspondence
- Updated information on the petition and parliamentary response
- International comparison chart
- Technical explainer: How VPN detection works (and doesn't work)
- Additional expert commentary
- Community discussion forum
Last Updated: [Date]
Version: 1.0
Status: Ready for production
Monday Nov 10, 2025
Monday Nov 10, 2025
In this episode of the Small Business Cybersecurity Guide, hosts Noel Bradford and Mauven McLeod are joined by Mark Bell from Authentrend (episode sponsor) to explain why the mobile phone, long promoted as a convenient authentication tool, can be one of the weakest links in your business security.
Using real-world examples, including a recent breach of a 15-person firm that relied on SMS one-time passwords, the trio outlines how simple attacks, such as SIM swapping and code interception, make SMS and many authenticator app workflows vulnerable to targeted attackers.
The hosts define multi-factor authentication in plain terms and introduce FIDO2/passkeys and hardware security keys as effective, phishing-resistant alternatives. Mark describes how hardware keys utilise public-key cryptography and local biometric verification (fingerprint on the key), ensuring that private credentials never leave the device, thereby preventing attackers from reusing intercepted codes or tricking users into authenticating to fake sites.
Practical implementation advice is covered in detail: start with a risk assessment, deploy keys in phases (prioritise privileged accounts and executives), run a pilot with high-risk users, and require at least two keys per user for redundancy. They discuss costs (roughly Ā£45 per key, with a 10-year lifespan), the productivity and help-desk savings from passwordless authentication, the effects on cyber insurance and compliance (including Cyber Essentials updates and the gap between compliance and proper protection), and strategies for legacy systems and remote workers.
The episode also highlights human factors, including making authentication easy to use (biometric keys), providing clear training and internal champions, and anticipating user resistance, which can be managed through leadership buy-in and phased rollouts.
Listeners are urged to assess their critical accounts, prioritise hardware keys for high-risk users, and run a small pilot rather than waiting for discounts ā because, as the guests stress, hardware keys can stop roughly 80% of credential-based breaches in practice.
Guests and links: Noel Bradford and Mauven MacLeod (hosts), with guest Mark Bell from Authentrend
The show notes include links to Authentrend products,NCSC guidance on passkeys and FIDO2, and step-by-step implementation resources for small businesses.
Friday Nov 07, 2025
Friday Nov 07, 2025
On October 19th, 2025, four men dressed as construction workers stole ā¬102 million in French crown jewels from the Louvre Museum in just seven minutes. The heist was poorly executedāthieves dropped items and failed to target the most valuable piecesāyet they succeeded spectacularly.
Why? Because the world's most visited museum had been ignoring basic cybersecurity warnings for over a decade.
In this hot take, Noel Bradford examines the shocking details that emerged after the heist: the password to the Louvre's video surveillance system was "LOUVRE." Security software was protected by "THALES" (the vendor's name). Windows 2000 and Server 2003 systems were still in operation years after support ended. And a 2015 security audit with 40 pages of recommendations won't be fully implemented until 2032.
This episode examines the consequences of institutions ignoring expert warnings, the importance of accountability, and what UK small businesses can learn from a ā¬102 million failure. Spoiler: if your security is better than the Louvre's, you're doing something right.
Key Message: Security failures often begin long before the day of the breach. They start years earlier when warnings go unaddressed.
Key Takeaways
- The Louvre's password was "LOUVRE." If one of the world's most prestigious institutions used the building'sĀ name as its surveillance system password, your organisation probably has similar problems.
- Ten years of warnings, zero action - ANSSI identified critical vulnerabilities in 2014. Security upgrades recommended in 2015 won't be completed until 2032. Ignoring expert advice is organisational negligence.
- Resources aren't the problem - The Louvre had budget, expertise, and free government audits. They chose to prioritise palace restoration (ā¬60M) over security infrastructure. It's about priorities, not resources.
- Hardware authentication solves password problems - FIDO2 security keys can't be guessed, phished, or compromised through weak passwords. At Ā£30-50 per key, they're cheaper than one day of operational disruption.
- The accountability gap enables negligence - Government institutions face no consequences for catastrophic security failures, while UK SMBs receiveĀ ICO fines and potential closure for less. This double standard undermines security culture.
- Your security might be better than that of the Louvre. IfĀ you've enabled MFA, run supported operating systems, and have basic password policies, you're already ahead of a museum protecting the Mona Lisa. That's encouraging and concerning.
- Security failuresĀ often begin years before a breach - The October 2025 heist was made possible by decisions (or non-decisions) that stretchedĀ back to 2014. Prevention requires consistent action, not crisis response.
Case Studies Referenced
The Louvre Heist (October 2025)
- Incident: ā¬102 million in French crown jewels stolen in 7 minutes
- Root causes: Password "LOUVRE" for surveillance, outdated systems (Windows 2000/Server 2003), unmonitored access points
- Audit history: 2014 ANSSI audit identified vulnerabilities, 2015 audit provided 40-page recommendations
- Accountability: Director retained position, no terminations, Culture Minister initially denied security failure
- Timeline: Security upgrades recommended in 2015 won't complete until 2032
KNP Logistics (Referenced)
- Industry: East Yorkshire haulage firm
- Incident: Ransomware attack, Ā£850,000 ransom demand
- Outcome: Couldn't pay, business entered administration, 70 jobs lost
- Contrast: Small business faces closure; national institution faces no consequences
Electoral Commission (Referenced)
- Incident: Data breach affecting 40 million UK voters
- Outcome: No job losses, no significant consequences
- Relevance: Government accountability gap vs private sector enforcement
Case Studies Referenced
The Louvre Heist (October 2025)
- Incident: ā¬102 million in French crown jewels stolen in 7 minutes
- Root causes: Password "LOUVRE" for surveillance, outdated systems (Windows 2000/Server 2003), unmonitored access points
- Audit history: 2014 ANSSI audit identified vulnerabilities, 2015 audit provided 40-page recommendations
- Accountability: Director retained position, no terminations, Culture Minister initially denied security failure
- Timeline: Security upgrades recommended in 2015 won't be completed until 2032
KNP Logistics (Referenced)
- Industry: East Yorkshire haulage firm
- Incident: Ransomware attack, Ā£850,000 ransom demand
- Outcome: Couldn't pay, business entered administration, 70 jobs lost
- Contrast: Small business faces closure; national institution faces no consequences
Electoral Commission (Referenced)
- Incident: Data breach affecting 40 million UK voters
- Outcome: No job losses, no significant consequences
- Relevance: Government accountability gap vs private sector enforcement
About The Host
Noel Bradford brings over 40 years of IT and cybersecurity experience across enterprise and SMB sectors, including roles at Intel, Disney, and BBC. Currently serving as CIO and Head of Technology for a boutique security-first MSP, Noel specialises in translating enterprise-grade cybersecurity expertise into practical, affordable solutions for UK small businesses with 5-50 employees.
His philosophy centres on "perfect security is the enemy of any security at all," focusing on real-world constraints and actionable advice over theoretical discussions. Noel's direct, no-nonsense approach has helped "The Small Business Cyber Security Guy Podcast" achieve Top 90 Business Podcast status in the USA and Top 170 in the UK, with a unique cross-Atlantic audience (47% American, 39% British).
Legal & Disclaimer
The information provided in this podcast is for educational and informational purposes only and should not be construed as professional cybersecurity, legal, or financial advice. Listeners should consult qualified professionals for guidance specific to their circumstances.
Product and service mentions, including sponsors, are provided for informational purposes. The host and podcast do not guarantee results from implementing suggested strategies or using mentioned products.
All case studies and incidents discussed are based on publicly available information and reporting. Facts are verified against multiple authoritative sources before publication.
Ā© 2025 The Small Business Cyber Security Guy Podcast. All rights reserved.
Ā
Credits
Host: Noel Bradford
Production: The Small Business Cyber Security Guy Productions
Editing: Noel Bradford
Research: Graham Falkner
Show Notes: Graham Falkner
Special Thanks: ANSSI (for their audit work that we wish the Louvre had acted upon), LibƩration journalist Brice Le Borgne (for his investigative reporting), and UK small businesses everywhere who take security more seriously than world-famous museums apparently do.
Episode Tags
#Cybersecurity #SmallBusiness #UKBusiness #PasswordSecurity #Louvre #DataBreach #HardwareAuthentication #FIDO2 #CyberAccountability #InformationSecurity #RiskManagement #SMBSecurity #CyberNews #HotTake #BusinessPodcast
Next Episode: Coming Soon - Criminal Accountability for Cybersecurity Negligence (Two-Part Series)
Average Episode Downloads: 3,000+ per day at peak
Listener Demographics: 47% USA, 39% UK, 14% Other
Target Audience: UK SMBs with 5-50 employees
Ā
Monday Nov 03, 2025
Monday Nov 03, 2025
In this episode Graham and Mauven break down a major overhaul to Cyber Essentials coming into force from April 2026. The hosts explain the headline change ā mandatory multi-factor authentication (MFA) for every cloud service with no loopholes ā and how the scheme has tightened scoping so any internet-connected service or system that processes company data is now in scope.
Topics covered include the new emphasis on passwordless authentication (passkeys, FIDO2 hardware keys, and biometrics), why the NCSC is pushing these technologies, and the practical security benefits and limits of passwordless solutions. They also discuss the real-world impact on small businesses: thousands currently relying on weak passwords or shadow IT will face failed assessments, unsupported software will trigger instant fails, and many firms will need to budget for MFA where itās not free.
Graham and Mauven share concrete, actionable advice for listeners: inventory every cloud service (including forgotten Dropbox or personal Gmail accounts used for work), involve the whole team, enable MFA everywhere possible (and budget for paid options), collect and document evidence (screenshots, logs), map networks and implement segmentation where needed, and plan early to avoid rush and audit pain.
Key takeaways: the bar is being raised to reduce simple attacks, passwordless is being validated as a practical option, expect a drop in pass rates at renewal time, and businesses should start preparing now or face chaotic assessment outcomes. Hosts: Graham Falkner and Mauven MacLeod.