Your customer swears they're secure. The firewall's up, the endpoint agent's running, and nobody's shouted about ransomware this morning. Then you find an employee email address and password sitting in a leaked database, and the conversation changes fast. That's the bit too many service providers miss. Attack surface reduction isn't about collecting more alerts, it's […]
UK businesses are not dealing with a theoretical threat. In the government's 2025 survey, 43% of businesses and 30% of charities said they'd experienced a cyber security breach or attack in the previous 12 months, and the cost to UK businesses in 2024 was estimated at £64 billion Government Cyber Security Breaches Survey 2025. For […]
Friday changes have a habit of turning into Monday incidents. A rule that looked harmless at 17:45 gets pushed above the wrong exception, a client's file server starts answering more broadly than it should, and by the time someone notices, the clean change note has become a support ticket, a phone call, and an awkward […]
Privileged account management is the discipline of locking down admin-level credentials and access with vaults, just-in-time access, and session monitoring. It matters because 80% of security breaches involve privileged credentials, and 82% of insider-misuse breaches took more than a week to detect according to the industry summary and Verizon-linked reporting cited here. A lot of […]
A customer wants clearer visibility of its exposed systems. You need an authorised, proportionate method, not a noisy scan launched without context or change control. That's the situation many MSPs, consultants and technology resellers face when a routine infrastructure review becomes a wider conversation about customer risk. This field guide to commands for Nmap moves […]
A customer rings after a breach story breaks in the press and asks the same blunt question every MSP owner hears sooner or later, can this happen to us too? The honest answer is yes, and the harder truth is that the attack everyone worries about is rarely the first thing that happens. By the […]
A breach call rarely arrives at a convenient time. It's usually a client ringing in a panic because someone spotted suspicious logins, a mailbox rule they didn't create, or credentials turning up where they shouldn't. At that point, the MSP owner owns the clock, the evidence and the story the client can later tell the […]
A customer says their login looked normal, but an admin account started behaving in ways nobody can quite explain. The support desk sees no obvious outage, the account owner denies any change, and the manager wants to know whether this is a glitch, a misuse issue, or the start of an incident. That is the […]
An engineer turns up on a site, checks the server inventory, and finds a Windows Server vulnerability that's been sitting there for months. The patch exists. The service window never got booked, the update never got tested, and everyone assumed “we'll do it next maintenance cycle”. That's how a routine administrative task becomes a breach […]
You've just finished a breach call. The client wants to know whether the file you found on the server is genuine, who touched it, and whether it can be used in a complaint, an insurance claim, or a legal review. If your notes are vague, or if the evidence has passed through several hands without […]