Clear-headed cyber defence for UK business leaders
Companies House is often treated as an administrative obligation, yet it is the public source of truth about a company’s directors, ownership and registered address. This article sets out why boards should govern that record as a security control, with practical oversight of authorised filers, filing alerts and correction paths.
Annual report cyber disclosures are too often treated as communications rather than governance. This article sets out how UK directors can govern the narrative so that claims are evidence-based, consistent with risk appetite and defensible under scrutiny.
Break-glass accounts are approved once and then too often left unexamined, even though they offer the shortest path to total compromise when misused. This article sets out a board-level protocol for emergency access, the evidence directors should require, and a short scenario test that can be run in a fifteen-minute board session.
Quantum computing is often filed under future technology, yet the risk to long-lived sensitive data begins now. This article sets out a practical board agenda for cryptographic discovery, supplier dependency, migration budgeting and the questions directors should ask about UK timelines.
A board cyber exercise is often a comfortable hour in which directors agree they would, of course, cope. This article argues that the value lies not in the scenario but in the decisions it forces, the assumptions it exposes and the documents it changes afterwards. It sets out what UK directors should demand before, during and after the exercise.
Departmental card purchases can place SaaS tools beyond procurement and security review, leaving the board without a reliable map of company and customer data. This article sets out a proportionate control set for UK mid-market boards: spend visibility, risk-based approval, a short security questionnaire and disciplined exit checks.
A domain is not an asset the organisation owns outright; it is a registration held under terms, renewed on a clock and administered through accounts that can be compromised. This article sets out why UK boards should treat domains, DNS and brand impersonation as security controls, and what to ask before the next renewal passes unnoticed.
For UK founders and boards preparing to sell, cyber maturity must be evidenced rather than asserted. This guide sets out how to present a credible position to buyers, avoid the diligence red flags that chip away at value, and use a focused 90-day plan to protect the deal.
A security operations centre visit can be a valuable assurance exercise or a polished distraction. This guide sets out how UK boards can structure the time, question what they observe and convert a day on the floor into evidence that defences work in practice.
Boards rehearse containment far more often than they rehearse disclosure. This guide sets out the pre-agreed thresholds, named decision-makers and evidence discipline that let UK directors notify the ICO, sector regulators and the market promptly, consistently and without manufacturing fresh liability.
UK boards are conversant with joiner, mover and leaver controls for people, yet service accounts, API keys, bots and OAuth tokens often sit outside that discipline. This article offers a board-level framework for governing non-human identities through named ownership, constrained privilege, lifecycle rules, monitoring expectations and a tested containment plan.
Legacy technology rarely announces itself as a board risk. It appears as a maintenance line, a tolerated workaround or a supplier dependency that no one owns. This article offers directors a practical framework for bringing ageing systems into the open and deciding, deliberately, whether to accept, transfer, remediate or retire them.
AI meeting assistants are becoming a routine feature of UK boardrooms, yet few boards have a clear view of where sensitive discussions, privileged advice and personal data are processed or stored. This article sets out a practical standard for approving, configuring and reviewing meeting-recording tools without sacrificing boardroom confidentiality for operational convenience.
Directors' own working habits can bypass controls that the organisation has spent years building. This article sets out a proportionate protocol for approved channels, device hygiene, travel briefings and the valuation of an executive inbox.
Boards tend to measure data by its usefulness, not its exposure. This article sets out how directors can treat retention and deletion as a security control, with practical tests for legal holds, backups, suppliers and board reporting.
Most UK organisations can say when a person left. Far fewer can prove when their access ended. This article sets out why offboarding breaks across HR, IT and line management, what evidence boards should expect, and a practical 30-day control calendar for closing the leaver access gap.
A ransomware demand compresses complex legal, ethical and commercial questions into hours. UK boards can reduce that pressure by agreeing a defensible decision framework long before an incident occurs, with clear prohibitions, escalation routes and an evidence trail that shows reasonable judgement.
Board cyber papers are usually built around disclosure risk, yet in factories, utilities and facilities the controlling concern is whether the line keeps running and whether people stay safe. This article sets out how UK directors can govern operational technology risk without importing IT assumptions into environments that cannot absorb them.
A penetration test informs board decisions only when it is scoped around material business risk, not around a generic checklist. This guide explains how UK leaders should commission the work, challenge severity labels and convert findings into a prioritised remediation plan.
Group cyber policies rarely travel as cleanly as boards assume. This article sets out a practical assurance model for UK groups, using a fictional plc with three acquired businesses to show where subsidiary-level oversight breaks down and what directors should ask for in 2026.