6 things every UK SME should have locked down this year: 1. MFA on every admin account, not just email 2. Immutable, tested backups (test the restore, not just the backup) 3. Cyber Essentials as a baseline, not a badge 4. An incident plan people have actually read 5. AI with guardrails: know what Copilot and chatbots can access before you roll them out 6. Someone whose job it is to own all of the above Save this. Stuck on #6? That's us.

Most UK firms hit by ransomware had backups. The problem: they'd never tested a restore, or the backups were online and got encrypted too. A backup you haven't restored from is a hope, not a plan. Keep one copy offline or immutable. When did you last test a full restore?

This week: ransomware. The mindset shift that matters: stop asking 'will we be hit' and start asking 'how fast could we recover.' Most can answer the first, not the second. Tested backups and a clear plan turn a disaster into a bad day. Could you recover by Friday?

MFA recap: turn it on everywhere, not just email; prefer an app or key over SMS; don't forget VPN, admin and finance. The cheapest, highest-impact move in security. Want to know your gaps? A quick cyber health check maps them. What's still on your list?

Most businesses switch on MFA for email and stop there. The gaps attackers love: remote access and VPN, admin accounts, finance systems, and that one legacy app nobody wants to touch. MFA is only as good as its coverage. Which systems still log in with just a password?

Not all MFA is equal. SMS codes are better than nothing, but they can be intercepted or SIM-swapped. An authenticator app or a hardware key is far stronger, and phishing-resistant options now stop even the fake-login tricks. On SMS? Worth upgrading. What are you using?

Stop forcing staff to change passwords every 90 days. It just produces Password1!, then Password2!. Modern advice: long passphrases, unique per site, backed by a password manager, and change only if breached. Less hassle, far safer. When did yours last get a rethink?

This week: passwords and MFA, the highest-return fix most businesses have. One stat to start: Microsoft found MFA blocks over 99% of automated account-takeover attacks. If it's not on everywhere, that's the gap attackers use. Where's it still off for you?

This week's phishing recap: the tell is urgency plus a link, verify money requests on a second channel, MFA makes a click survivable, no-blame reporting gets it caught fast. Not sure where your gaps are? A quick cyber health check shows them. Which of these is weakest for you?

FortiBleed is active now: attackers are seizing admin control of Fortinet firewalls and locking owners out. One quick fix today: list every Fortinet device, check its firmware, and get admin off the public internet. We'll help you close the gap. #CyberSecurity

Fake phishing tests can help or backfire. Gotcha-style tests that shame people just teach them to hide clicks. The useful version is low-stakes and followed by a 2-minute "here's the tell" so people actually learn. Test to teach, not to catch. How does yours feel to staff?

Even your sharpest people will click a good phish eventually. That's not a training failure, it's human. The goal isn't zero clicks, it's a survivable click: MFA so a stolen password isn't enough, and fast reporting so you can act. What's your backstop when someone clicks?

Denmark's Central Person Register breach hit 8.8m people. The lesson for UK SMEs? You hold more old data than you think. Map your most sensitive system, cut access to least privilege, test your response plan. We can help. Details below. #CyberSecurity

The phishing that actually costs money is quiet: a request to change bank details or approve an invoice, styled as internal. One rule stops most of it, verify any money or data request on a second channel. A quick call beats a payment you can't undo. Do you have that rule?

Phishing in 2026 doesn't look like the old spam. It's a perfect copy of your bank, a text from your CEO, a fake Teams login. The tell is rarely spelling now, it's urgency plus a link. Slow down, check the sender, go direct. Seen a convincing one lately?

FortiMail zero-day (CVSS 9.8) is under active attack. Attackers can hit the gateway with no password needed. Today: find any FortiMail in your estate, confirm firmware, patch, check logs. Need a hand? We can help. Source and team in the first comment. #CyberSecurity

Cyber Awareness Month starts tomorrow. If you want more than a month of posters, start by knowing where you actually stand: what's patched, who has MFA, whether your backups restore. You can't fix what you haven't measured. Where would a check find your biggest gap?

The problem with once-a-year security awareness: people pass the quiz in October and click the link in January. Awareness isn't an event, it's a habit. A short, regular nudge beats an annual module every time. How does your team keep it front of mind?

Cyber Awareness Month starts Thursday. Most firms mark it with a poster and a test email everyone forgets by November. The ones who get value pick one habit and change it for good: MFA everywhere, a password manager, a tested backup. What's the one you'll fix this year?